The Top 4 Threats We Found by Investigating Every Alert for a Quarter
Prophet Security investigated alerts, finding identity attacks and session hijacking as top threats.
Prophet Security's analysis of customer alerts between May and July 2026 revealed that identity was the target in approximately half of all confirmed malicious activity. The top attack pattern observed was session hijacking, where attackers leveraged already-authenticated sessions to bypass security controls, leading to successful account takeovers. While password-based attacks were often blocked by security measures like conditional access and phishing-resistant MFA, replayed session cookies and refresh tokens circumvented these defenses.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Prophet Security?
Get an email when a new story names Prophet Security, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are increasingly targeting authenticated sessions rather than credentials, using replayed cookies and refresh tokens to bypass even phishing-resistant MFA and conditional access policies. This shift matters because most organizations have invested heavily in securing the login process while leaving post-authentication session integrity largely unguarded. The fundamental flaw is treating a valid session token as inherently trustworthy for its entire lifetime, regardless of contextual signals like IP changes or unusual activity patterns. As identity becomes the primary attack surface, defenses must extend beyond the authentication moment to continuously validate session legitimacy throughout its lifecycle.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.