The 2026 Threat Picture for Security Leaders: Identity, Supply Chain and Deepfake Fraud

The cyber threat landscape in 2026 is defined less by new malware than by attackers reusing trust that already exists: valid identities, trusted software suppliers and the familiar faces and voices of colleagues.

Each of these trust relationships is hard to monitor, and each lets an intruder look like a legitimate user.

This briefing covers three threat areas that security leaders should prioritize (identity-based attacks, supply chain attacks and deepfake fraud), the data behind them, and the controls that give the most risk reduction per dollar.

It ends with a 90-day action plan mapped to NIST CSF 2.0.

The cyber threat landscape by the numbers

The headline data shows attackers moving faster and leaning on third parties. The Verizon 2026 Data Breach Investigations Report analyzed more than 22,000 confirmed breaches.

It found third-party involvement in 48% of breaches, vulnerability exploitation as the initial access vector in 31%, ransomware in 48% and a human element in 62% (2026).

Speed has changed what “timely” response means. The CrowdStrike 2026 Global Threat Report put average eCrime breakout time (initial access to lateral movement) at 29 minutes in 2025, with the fastest observed at 27 seconds.

It also found that AI-enabled adversaries increased operations by 89% year over year (2026).

Metric	Value	Source (year)
Breaches involving a third party	48%	Verizon DBIR (2026)
Exploitation as initial access	31%	Verizon DBIR (2026)
Credential abuse as initial access	13%	Verizon DBIR (2026)
Average eCrime breakout time	29 minutes	CrowdStrike (2026)
Reported U.S. cybercrime losses, 2024	$16.6 billion	FBI IC3 (2025)

Note that the DBIR shows credential abuse falling as an initial access vector to 13%. That does not mean identity risk is shrinking.

Stolen sessions, help-desk resets and OAuth abuse often appear later in the attack chain rather than as the first step.

Identity-based attacks: logging in instead of breaking in

Identity-based attacks use valid credentials, tokens or sessions so that activity blends with normal use (T1078 Valid Accounts).

The most damaging recent pattern is help-desk social engineering. Groups such as Scattered Spider call the service desk posing as employees, get MFA reset, and then move straight into SSO and cloud consoles.

Our coverage of Scattered Spider exploiting help desk calls to bypass MFA details the chain.

Adversary-in-the-middle phishing kits and infostealers add to the problem by capturing session cookies (T1539), which bypass MFA entirely. A recent example is the UNC6671 operation automating Microsoft 365 data theft after hijacking sessions.

Practitioner example: detecting help-desk-driven takeover (illustrative)

The highest-signal pattern is an MFA method change followed quickly by a sign-in from a new device or location. The Microsoft Entra ID KQL below is illustrative. Tune the window and exclusions to your environment.

// Illustrative: MFA method registered/changed, then risky sign-in within 2 hours
let mfaChanges = AuditLogs
  | where TimeGenerated > ago(7d)
  | where OperationName in (“User registered security info”, “Admin registered security info”,
                            “User deleted security info”, “Reset password (by admin)”)
  | extend User = tostring(TargetResources[0].userPrincipalName)
  | project ChangeTime = TimeGenerated, User, OperationName;
SigninLogs
| where TimeGenerated > ago(7d) and ResultType == 0
| join kind=inner mfaChanges on $left.UserPrincipalName == $right.User
| where TimeGenerated between (ChangeTime .. ChangeTime + 2h)
| where DeviceDetail.isCompliant != true
| project User, OperationName, ChangeTime, TimeGenerated, IPAddress, Location, AppDisplayName

Identity is now the control plane of the cyber threat landscape, so pair the detection with a process control: help-desk staff should verify identity through a callback to a number on file, or through manager approval, before resetting MFA for privileged users.

Supply chain attacks: compromising one to reach many

Supply chain attacks exploit the trust organizations place in vendors, managed service providers and open-source packages (T1195 Supply Chain Compromise).

The 48% third-party figure in the DBIR covers several routes: a vendor’s breach exposing your data, a vendor’s remote access being used against you, and malicious code delivered through trusted updates.

The open-source ecosystem has been especially active. Self-propagating worms have hit npm repeatedly, including the Shai-Hulud attack that compromised more than 400 npm packages by stealing maintainer tokens and republishing poisoned versions.

These incidents target developer and CI/CD secrets, which in turn unlock cloud environments.

Practitioner example: build-pipeline hardening

• Pin dependencies with lockfiles and enforce npm ci (or the equivalent) in CI so builds cannot silently pull new versions.
• Delay adoption of newly published package versions (for example, a 24-72 hour cool-off) for non-security updates.
• Disable install scripts by default (npm config set ignore-scripts true) and allow-list the packages that need them.
• Give CI jobs short-lived, least-privilege credentials through OIDC federation instead of long-lived secrets.
• Generate an SBOM for every release so you can answer “are we affected?” within hours when the next package compromise lands.

For vendors, risk tiering matters more than questionnaires. Identify the suppliers with standing network access or admin rights in your tenant, and require phishing-resistant MFA, logging and breach notification terms from them first.

Deepfake fraud: when the caller sounds right

Deepfake fraud uses synthetic audio or video to impersonate trusted people (T1656 Impersonation).

The best-known case remains the 2024 incident in which a Hong Kong employee of engineering firm Arup transferred about $25.6 million across 15 transactions after a video call in which the “CFO” and other colleagues were all deepfakes (reported 2024).

The FBI’s PSA on generative AI in financial fraud (2024) describes voice cloning and live AI video used to pose as executives.

The control lesson is that recognition is no longer authentication, a point made in The Caller Sounds Right.

That Used to Mean Something. Finance and HR processes need multi-step checks that do not depend on recognizing a face or voice.

Payment-verification controls that hold up

1. Require out-of-band callback to a number from the vendor or employee master file, never one given in the request.
2. Require two-person approval above a defined threshold, with the second approver contacted independently.
3. Hold any change to bank details for a fixed period and confirm it through a known contact.
4. Agree code phrases for executives who may request urgent action while travelling.

Priority controls mapped to NIST CSF 2.0

Most organizations cannot fund everything at once, so prioritize controls that cut across the whole cyber threat landscape. The controls below address all three threat areas and map to NIST CSF 2.0 functions and CIS Controls v8.

Control	Threats addressed	CSF 2.0	CIS v8
Phishing-resistant MFA (FIDO2/passkeys) for all admins and remote access	Identity, deepfake-led resets	PR.AA	6.3, 6.5
Hardened help-desk identity verification	Identity	PR.AA, PR.AT	6.1, 14.1
Session token protection and short session lifetimes	Identity	PR.AA	6.2
Third-party risk tiering and access reviews	Supply chain	GV.SC	15.1–15.7
Dependency pinning, SBOMs and CI secret hygiene	Supply chain	GV.SC, PR.PS	16.4, 16.5
Payment verification and callback procedures	Deepfake fraud	PR.AT, GV.RM	14.1
Detection tuned for sub-hour breakout times	All	DE.CM, RS.MA	8, 13, 17

CSF 2.0’s new Govern function (GV.SC for supply chain risk) gives leaders a ready-made place to assign ownership for vendor risk, which many programs still treat as a procurement task.

A 90-day action plan

Resilience planning should also extend beyond cyber; the U.S. Small Business Administration’s guidance on how to prepare for a range of threats is a useful baseline for continuity planning in smaller organizations. For the cyber program itself:

• Days 1-30: Enforce phishing-resistant MFA for admins; rewrite the help-desk MFA reset procedure; publish a payment-callback rule to finance.
• Days 31-60: Tier top vendors by access; deploy the MFA-change-then-sign-in detection; turn on lockfile enforcement and install-script restrictions in CI.
• Days 61-90: Run a tabletop exercise built on a deepfake CFO request and a poisoned package; measure time-to-contain against a 29-minute breakout benchmark.

Leaders who track markets for treasury or digital-asset exposure (for example, checking crypto coin prices when holding digital assets) should add those holdings and their custody to the threat model, since exchange and wallet compromise is a recurring target for state-backed groups.

Key takeaways

• The cyber threat landscape in 2026 centers on abused trust: identities, suppliers and familiar voices.
• Third parties were involved in 48% of breaches in the 2026 DBIR, and exploitation led initial access at 31%.
• Average eCrime breakout time fell to 29 minutes, so detection and containment must work in under an hour.
• Identity-based attacks increasingly go through help desks and stolen sessions, not just stolen passwords.
• Deepfake fraud is best stopped by process (callbacks, dual approval), not by trying to spot fakes.

FAQ

What are the biggest cyber threats right now?

Identity-based attacks using stolen credentials and sessions, supply chain compromise through vendors and open-source packages, ransomware and data extortion, exploitation of edge devices, and deepfake-enabled fraud are the main threats security leaders are prioritizing.

What is an identity-based attack?

It is an attack in which the intruder uses valid credentials, session tokens or a fraudulently reset MFA method to log in as a legitimate user. Because the activity looks like normal use, it often evades malware-focused tools.

How do supply chain attacks work?

Attackers compromise a trusted supplier, such as a software vendor, managed service provider or open-source package maintainer, and use that trusted position to deliver malicious code or access to the supplier’s customers.

How can companies protect against deepfake CEO fraud?

Require out-of-band callbacks to known numbers, two-person approval for large payments, holding periods for bank-detail changes and agreed code phrases. Do not rely on recognizing a voice or face.

What is breakout time in cybersecurity?

Breakout time is the time an attacker takes to move from the first compromised host to other systems in the network. CrowdStrike measured an average eCrime breakout time of 29 minutes in 2025.