Does Exploitation Status Actually Matter?

Phishing-resistant authentication can significantly reduce credential theft, but attackers can target the authentication session itself. An adversary-in-the-middle attack can relay authentication and obtain a live session.

Once inside, attackers may access Microsoft 365 or Okta resources and manipulate mailboxes and security notifications. That creates a second-order problem: the attacker isn't just compromising an account—they may also be interfering with the mechanisms designed to alert defenders and users.

How should organizations design detection and response when an attacker can potentially compromise both the identity session and the warning channel?

Subscribe to our podcasts: https://securityweekly.com/subscribe

#MFA #IdentitySecurity #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec