Identity: The Third Phase of Security Operations

This report argues that identity has emerged as a standalone security domain in cloud-first operations, showing how adversaries—from BEC actors to state-linked groups like Storm-0558—are subverting authentication and abusing third‑party identity platforms. It highlights provider-side blind spots (e.g., Azure cross-tenant exposures) and tactics like MFA token theft, urging organizations to demand greater visibility, ingest available identity telemetry, and evolve beyond the traditional host-network paradigm to secure identity.