Identity Is the New Control Plane
Attackers are skipping endpoints and going straight for identity, cloud control planes, and finance workflows—now supercharged by AI-driven social engineering. The fastest paths to material loss are OAuth abuse and executive fraud, not one more critical patch.
Attackers are skipping endpoints and going straight for identity, cloud control planes, and finance workflows—now supercharged by AI-driven social engineering. The fastest paths to material loss are OAuth abuse and executive fraud, not one more critical patch.
The story that matters
OAuth consent abuse and AiTM bypass are handing adversaries the cloud control plane
Recent reporting from Microsoft and incident responders highlights a surge in consent-phishing and adversary-in-the-middle campaigns that capture session cookies and grant malicious OAuth apps broad Graph and storage permissions. Once a user or admin clicks “consent,” attackers mint refresh tokens, create service principals, and persist with minimal EDR signal.
The business effect is immediate: mailbox rules hide approvals, finance connectors are hijacked, SharePoint and cloud storage are quietly exfiltrated, and privileged roles are escalated without an endpoint footprint. In many cases, revoking a user session is not enough; the malicious app and service principal live on until explicitly discovered and removed.
AI-accelerated executive fraud is turning vendor payments into a cash-out lane
FBI and mainstream reporting show business email compromise losses remain the top-reported cyber crime, with attackers now using deepfake voice and video to impersonate executives and vendors during live calls. Compromised cloud mailboxes and vendor portals seed believable invoices and bank-change requests that sail through callback checks when the ‘caller’ sounds and appears legitimate.
This is no longer a pure email problem; it is a treasury and procurement control problem. Attackers target vendor master data, payment approvers, and AP workflows—where policy often lags practice—turning identity trust signals into authorization to move money. The losses are immediate, insurance recovery is uncertain, and disclosure obligations can follow.
Beyond one CVE
Today’s risk is architectural: identity trust, OAuth app sprawl, and finance workflow assumptions—not a single patch. AiTM and consent phishing convert normal login and approval steps into attacker persistence and authorization, while deepfakes exploit human verification rituals that were never designed to handle synthetic media.
The fix is programmatic: turn off default user consent; enforce admin consent workflows and allow-lists; mandate phishing-resistant MFA and step-up for admins and finance approvers; bind tokens to device and client with conditional access; rotate and inventory service principal secrets; and continuously hunt for anomalous OAuth grants, token reuse, and vendor master changes.
Enterprise risk
Materiality arrives fast when identity is the entry point: cloud tenant takeover enables silent data theft and extortion, while a single fraudulent vendor change can move seven figures in an afternoon. Median BEC losses are rising, and recovery windows are short; the first 24 hours determine whether funds can be recalled.
Regulatory and audit exposure is growing. SEC incident disclosure rules, SOX controls over financial reporting, and sectoral obligations (e.g., DORA in the EU, NYDFS Part 500) now intersect with identity and payment controls. A compromised IdP or AP workflow can trigger both cyber and financial-reporting impacts, raising scrutiny from auditors and regulators.
Concentration risk is systemic. An outage or compromise at your IdP, payroll, or AP provider becomes a sector-wide incident, while overprivileged service principals can bridge multiple SaaS estates. Insurance sublimits for social engineering frequently cap recovery well below potential losses, shifting the residual to the balance sheet.
Takeaways
Board takeaway in 20 seconds
- Attackers are skipping endpoints and going straight for identity, cloud control planes, and finance workflows—now supercharged by AI-driven social engineering. The fastest paths to material loss are OAuth.
- Fraud controls should be judged by whether they interrupt the handoffs attackers need: attention, delivery, trust, identity, web foothold, and credential payout.
What should CISOs do?
- Monitor cloud workloads that unexpectedly send mail, create bulk outbound traffic, or appear outside approved provisioning patterns.
- Treat trusted sharing services as redirect surfaces: inspect destination chains, not only the first domain a user clicks.
- Lock down exposed form plugins, workflow tools, and AI builders with patch SLAs, admin restrictions, and recent-change review.
What should boards demand?
- Evidence that payment, travel, hospitality, and support workflows require out-of-band verification at high-risk moments.
- Named ownership for public-facing convenience software before it becomes a fraud staging point.
- Metrics that show fraud controls make completion harder across attention, delivery, trust, identity, web foothold, and credential payout.
What should risk committees rethink?
- Move fraud from awareness-only training into process design: approvals, callbacks, domain monitoring, and cloud-mail anomaly response.
- Run incident scenarios for executive hospitality fraud, fake support, and compromised public web tools.
- Review whether seasonal events, procurement exceptions, and support urgency weaken verification controls faster than policy owners expect.
The board blind spot
Machine identities outnumber humans, yet service principals and API keys often have excessive, non-expiring privileges with little monitoring. Attackers know these are durable footholds that survive password resets and device wipes.
Shadow integrations—employee-installed connectors, marketplace apps, and low-code automations—silently expand your attack surface and authorization graph. Without an authoritative inventory and approval workflow, you cannot meaningfully manage consent risk.
Verification theater persists in finance: callbacks to phone numbers in the same compromised thread, acceptance of Zoom presence as identity, and single-approver exceptions for ‘urgent’ payments. These patterns are precisely what AI-enabled adversaries are built to exploit.