Identity is the new perimeter

At Concordia on 1 October, our Managing Director, Yogesh Agarwal, opened the day with six things we keep seeing in our work with clients. A few minutes each was never going to do them justice, so we are taking them one at a time over the next six weeks. This is the first.

For years, security conversations started with the firewall: keep the wrong people out, let the right people in. Firewalls still matter. But in most of the incidents we see now, nobody breaks through anything. The attacker logs in, with a real username and a real password, and the system lets them through because, as far as it can tell, they are allowed to be there.

That is what we mean when we say identity is the new perimeter. What stands between an attacker and your data is less often a piece of network kit and more often a login, a password reset, or a person deciding whether to trust a request.

“The hackers are not breaking in now. They are using identities to get in, with full authorised access.”

Yogesh Agarwal, Managing Director, RightCue, speaking at Concordia

What this looks like in practice

Take Marks & Spencer last year. It was widely reported that the attackers got in by persuading an IT service desk to reset a password. Online orders stopped for 46 days, and M&S put the hit to operating profit at around £300m. It started with a phone call, not a technical exploit.

Then there is the case Yogesh mentioned on the day. In Hong Kong, a finance employee at the engineering firm Arup joined a video call with what looked like the company's CFO and several colleagues. Every one of them was a deepfake. By the time anyone realised, around US$25m had been paid out.

And then there are admin accounts. As Yogesh put it on the day, if someone gets hold of an account with administrator access, it is game over. They can reach the crown jewels, and everything they do looks legitimate, because it is being done by a legitimate account.

Guy Marong, who worked with Yogesh at Sony, made a related point at Concordia. Cybercrime is an industry now, with its own specialists and suppliers. Access to company networks is bought and sold. The person who logs in with your details may not be the person who stole them.

The identities nobody counts

When most organisations think about identity, they think about people: joiners, leavers, and who has access to what. That is the right place to start, but it is only part of the picture.

There are also service accounts, API keys, automated scripts and, more and more, AI agents. Each one has access to something, and each one is an identity an attacker could use. Industry research puts machine identities at more than 80 for every person in an organisation. In most of the businesses we work with, nobody has a full list of them, and many have no clear owner. Passwords get set once and never changed. Keys get created for a project and left behind when the project ends.

What has changed

Two things are worth knowing about.

First, Cyber Essentials has moved with this. Under the April 2026 changes, multi-factor authentication is mandatory for all cloud services, and an organisation that hasn't put it in place fails the assessment automatically. If your renewal is coming up, check this now rather than on the day of the assessment.

Second, the better-prepared organisations now check identity at more points than the login. The service desk, password resets, changes to supplier bank details and payment approvals are all places where someone can claim to be someone they are not. Those are the moments that need a second check.

Where we would start

None of this needs a big programme. These are the practical steps we recommend to clients:

• Know your admin accounts. List them, cut them back to the people who genuinely need them, and keep admin work separate from everyday email and browsing.
• Switch on multi-factor authentication wherever it is offered, starting with email, cloud services and anything with admin rights.
• Give your service desk a way to check who is calling before it resets a password or MFA, such as calling back on a number already on record. Then make sure the team feels able to say no, even to someone senior.
• Ask for a second check on payments and bank detail changes, through a different channel. A video call is no longer proof on its own.
• Find your non-human identities. Who owns each service account and API key, what can it reach, and when was it last reviewed?
• Look at your leavers process. Accounts that stay open after someone has gone are one of the most common gaps we find.