[Video] The TTP Ep 21: When Attackers Become Trusted Users

**Executive Summary:** This Talos Threat Perspective episode overview examines how attackers leverage identity to gain, extend, and maintain access—covering targeting of identity systems and MFA, establishing persistent high-trust access, internal phishing for lateral movement, potential exploitation of over-permissioned AI agents and identity-linked access, and how adversaries blend into normal user behavior; the focus is on how identity enables attackers to scale operations and implications for defenders.