Identity & Beyond: 2026 Incident Response Predictions

The report forecasts that by 2026 most compromises will rely on identity and cloud abuse rather than malware, emphasizing OAuth/API-based persistence, BEC that moves beyond email into collaboration and finance workflows, and “living-off-the-tenant” tactics using native cloud features. It urges DFIR teams to prioritize identity telemetry, app-level analysis, and integration monitoring, and recommends phishing-resistant MFA, extended log retention, centralized identity logs, rigorous application/service principal inventories, and near–real-time monitoring of OAuth registrations and consents.