Identity and access management requires a Zero Trust approach

The report warns that AI-enhanced phishing and adversary-in-the-middle/OAuth phishing attacks are increasingly able to bypass MFA and hijack authenticated sessions across platforms like Microsoft 365, and recommends adopting continuous verification, device-level controls, and Zero Trust practices (illustrated by ThreatLocker capabilities) to limit post-authentication impact.