Don’t Make It Easy for Them: 15 Identity Shortcuts Attackers Count On

Overview

A practical checklist that helps security teams find and close the identity shortcuts attackers rely on most.

Most breaches don’t begin with a clever exploit. They begin with a shortcut: an MFA reset approved because the caller sounded senior, an account that stayed active after its owner left, an AI agent running on someone’s personal token. Built around this year’s Cybersecurity Awareness Month theme from the National Cybersecurity Alliance, “Don’t Make It Easy for Them”, this guide turns that message into 15 identity controls across five risk areas. Each control is a simple yes or no, backed by verified industry data, and the guide ends with a score that tells you exactly where to start.

Who This Guide Is For

The guide is written for CISOs, CIOs, heads of identity and IT leaders who want a fast, honest view of where their identity program is exposed.

It draws on what Sennovate’s identity and security operations teams see across enterprise environments every day, and on current research from CISA and the FBI, Microsoft, Verizon, IBM and CyberArk. Since 2007, Sennovate has secured more than 10 million identities and delivered over 1,000 integrations for organizations closing exactly these gaps.

Why Identity Shortcuts Matter

Attackers increasingly log in rather than break in. The gaps they use are rarely technical failures. They are everyday shortcuts taken to save time.

The Help Desk Has Become the Front Door

In their joint advisory on the Scattered Spider group, CISA and the FBI warn that attackers use social engineering to convince help desk staff to reset passwords and MFA tokens. Knowledge questions and caller supplied phone numbers make that easy.

MFA That Can Be Talked Around

Push prompts can be spammed until a tired user taps Approve, codes can be phished in real time, and legacy protocols skip MFA altogether. Microsoft observed about 6,000 MFA fatigue attempts per day over a single year.

Access That Outlives Its Purpose

Leavers keep access to apps outside SSO, movers collect privileges with every role change, and contractor accounts stay open long after the project ends. Credential abuse was the way in for 22% of breaches in Verizon’s 2025 Data Breach Investigations Report.

Machine and AI Identities Nobody Owns

Service accounts, API keys and AI agents now far outnumber people, often with broad access and no named owner. CyberArk’s 2025 research found 82 machine identities for every human, and 42% of them hold sensitive or privileged access.

The bottom line:

Find and close the identity shortcuts attackers rely on, across people, machines and AI agents, without slowing the business down.

The Identity Checklist: 15 Controls in 5 Areas

The checklist below covers 15 controls across five areas. Score yourself honestly: one point for every control you can say yes to today, then use the score bands at the end to see where to start.

1. High risk resets (MFA, new device, password for privileged users) require phishing resistant verification, not knowledge questions.

Attackers no longer need to steal a password when they can ask for a new one. Security questions can be researched or guessed from social media, so replace them with stronger checks such as a push to an already registered device, a manager approval or a verified video call.

2. Identity is confirmed through a channel already associated with the user, never one the caller provides.

If the caller supplies the callback number or email address, the attacker controls the verification. Always use the contact details already on record in your HR or identity system, and reach the user there before taking any action.

3. Resets of privileged accounts require a second approver and alert the SOC.

A privileged account reset is the fastest route to full control of an environment. A second approver slows an attacker down enough to be caught, and an alert to the SOC means someone is watching the moment it happens.

4. Phishing resistant methods (FIDO2 security keys or passkeys) are required for administrators.

Codes sent by text or shown in an app can be phished in real time, and text messages can be intercepted through SIM swaps. FIDO2 security keys and passkeys are bound to the real website, so a fake login page gets nothing it can use. Start with administrators, then extend to anyone with access to sensitive data.

5. Push notifications use number matching, and repeated prompts trigger an alert.

MFA fatigue attacks send prompt after prompt until a tired user taps Approve. Number matching asks the user to enter a code shown on the login screen, which an attacker on another device cannot see, and alerting on repeated prompts turns the attack into an early warning.

6. Legacy authentication protocols that bypass MFA are disabled.

Older protocols such as POP, IMAP and basic authentication cannot enforce MFA, so attackers use them to test stolen passwords at scale. About 99% of password spray attacks Microsoft observed used legacy authentication. Turning them off closes a door most users never knew was open.

7. Departing users lose access to every application, including those outside SSO, within one business day, and removal is verified.

Disabling a directory account is not the same as removing access. Apps outside SSO, local accounts and active sessions can keep working for weeks after someone leaves. Set a one business day target, cover every application, and confirm removal rather than assuming it.

8. Role changes remove previous access, not just add new access.

When a move only adds access, privileges pile up over the years until long serving employees can reach almost everything they ever touched. Make removal of old access part of the transfer workflow, signed off by the previous manager.

9. Contractor and partner accounts have an expiry date set at creation.

Contractor and partner accounts are often created in a hurry and forgotten when the project ends. With third party involvement in breaches doubling to 30% in Verizon’s 2025 report, an expiry date at creation means access ends by default and has to be renewed on purpose.

10. Administrative access is granted just in time, with approval and an expiry, rather than standing.

Standing admin rights give attackers a permanent prize. With just in time access, privileges are granted for a specific task and a set window, then removed automatically, so a stolen account has far less to offer.

11. Every privileged account has a named owner and its use is logged.

A privileged account that nobody owns is one nobody will notice being misused. A named owner answers for each account, and session logging gives investigators a clear record of exactly what was done.

12. Access reviews show reviewers actual usage and confirm revoked access is gone.

Rubber stamp reviews happen when reviewers see a long list of names with no context. Showing real usage, such as last login and recent activity, makes it easy to remove what is not needed, and a follow up check confirms the removal actually happened.

13. Every service account, API key and AI agent has a named human owner.

Service accounts, API keys and AI agents are created for projects, and projects end. Without a named owner, nobody reviews their access or notices when they behave strangely. Assign an owner at creation, and reassign ownership when that person leaves.

14. AI agents run on their own identities, never an employee's personal credentials.

An agent running on an employee’s token inherits all of that person’s access and hides its actions behind their name. Giving each agent its own identity makes it possible to limit its access, trace what it does and switch it off without affecting anyone else.

15. Credentials and trust relationships for machines rotate or expire, and unused ones are removed.

Machine credentials and trust relationships such as OAuth grants and API keys often stay valid for years. Regular rotation limits the damage of a leaked secret, and removing unused ones closes access paths nobody is watching. IBM’s 2025 report found that 97% of organizations with an AI related breach lacked proper AI access controls.

Your Score

Add up your yes answers.

• 13 to 15, Strong: focus on keeping it that way as AI agents multiply.
• 8 to 12, Typical: the gaps you have are the ones attackers look for first.
• 0 to 7, Start here: begin with controls 1, 7 and 13. They close the most common paths in.

What You’ll Gain

A Clear Baseline in One Sitting

Fifteen yes or no questions give security and identity leaders an honest view of their program without a lengthy assessment.

Priorities, Not Just a Score

Each score band points to the controls that close the most common attack paths first, so teams know where to begin this quarter.

Evidence Leadership Can Act On

Every section is backed by verified industry data, making it easier to explain identity risk to executives and boards.

Controls That Scale to AI

The same lifecycle controls that protect people extend to service accounts and AI agents, so the program keeps pace as machine identities multiply.

The result is a practical, data backed plan for making attackers’ jobs harder, starting with the shortcuts they count on most.