InsightsSecurity

Identity is the new attack surface – the numbers from Microsoft

Microsoft's latest Digital Defense Report shows that attackers go after sign-ins, not servers.

· 2 min read

What does the report show?

According to the Microsoft Digital Defense Report 2025, identity-based attacks increased by 32% in the first half of 2025. More than 97% of them are simple password attacks, such as password spraying. Microsoft Entra ID blocked an average of around 7,000 password attacks per second.

The good news

Phishing-resistant multi-factor authentication (MFA) stops more than 99% of identity-based attacks – even when the attacker has the correct username and password.

At the same time, the report points out that attackers are increasingly stealing sign-in sessions after MFA is complete, for example with token-stealing malware. So MFA is the foundation, not the whole house.

What we recommend

  • Require phishing-resistant MFA for all administrators
  • Use Conditional Access to block risky sign-ins
  • Monitor sign-ins and alerts in Defender

How we can help

Security and complianceEntra ID, Defender, and Purview.IT operations with iqonic CareOne partner for your entire Microsoft environment.

Wondering what this means for your organization? Let's talk.

Request a meeting →

Read next

Security

What will you do the day a cyberattack hits?

Once a cyberattack is underway, it's too late to make a plan. The first few hours largely determine how much damage is done.

· 2 min read
Security

Scanners and printers that send email? SMTP AUTH is turned off in December

Many multifunction printers, scanners, and older line-of-business systems send email with basic password sign-in. It stops working by default at year-end.

· 2 min read
Security

Passkeys are now the default in Microsoft Entra ID

As of September 2026, passkeys are the recommended sign-in method in Microsoft 365. Users will notice it the next time they sign in.

· 2 min read
All articles →

Need an IT provider that understands your business?

Tell us a little about your business and what you need help with, and we'll reach out to schedule a no-obligation conversation.

Or call +47 977 99 889, or email post@iqonic.no.

post@iqonic.no