Even Orgs With SSO Are Vulnerable to Identity-Based Attacks

Push Security’s analysis of 300,000 accounts highlights identity as a prime attack surface: 61% rely only on SSO, 29% on passwords only, and 10% on both; 63% use MFA, yet almost all methods are phishable and about 1% of SSO accounts use phishing-resistant MFA. Key risks include 80% of password-only accounts lacking MFA, 40% of SSO+password accounts without MFA, and identity provider accounts where 17% lack MFA and 10% reuse passwords—exposing organizations to credential stuffing, brute-force, MFA fatigue, and attacker-in-the-middle phishing.