What Is Identity-First Security, and Why Does It Matter?

On October 20, 2026, CISA, the FBI, and the U.S. Secret Service issued a joint advisory warning that the SafePay Ransomware group has targeted more than 600 critical infrastructure providers across the Americas, Europe, and Australia.

The hackers did not use highly complex methods; instead, they exploited compromised credentials to access virtual private networks and remote services. Once inside, they used legitimate administrative IT tools to move laterally, delete backups, and steal data. They then encrypted the victims’ files, making them inaccessible, and left a ransom note demanding payment in cryptocurrency.

Identity-based attacks are now among the most common and dangerous threats facing government agencies, critical infrastructure, and businesses. A comprehensive 2026 report by global cybersecurity firm Sophos found that an overwhelming 79% of all ransomware incidents began by exploiting a compromised identity or legitimate user login. In addition, Rubrik Zero Labs found that nearly 80% of all cyberattacks are identity-driven.

Identity becomes exponentially more important under the National Cybersecurity Alliance’s (NCA) theme for Cybersecurity Awareness Month, “Don’t Make It Easy for Them.” As a trusted partner to federal agencies and cybersecurity innovators, Yes& is joining its cybersecurity clients in recognizing October as Cybersecurity Awareness Month, as awareness is the single best tool for keeping people and organizations safe from online threats.

What Does CISA Recommend to Reduce Identity-Related Cyber Risks?

The core habits the NCA champions for this year’s theme—using strong passwords, enabling Multi-Factor Authentication (MFA), and recognizing phishing—are fundamentally about identity. Adversaries aren’t using phishing emails to hack a network security system like a firewall; they’re trying to steal a user’s identity. Weak passwords and missing MFA give attackers an easy front-door key to that identity.

The CISA (Cybersecurity and Infrastructure Security Agency) joint advisory recommends:

• Regularly patch and update systems, especially firewalls and other edge devices.
• Implement Zero Trust Principles: never trust, always verify.
• Restrict administrative tools and privileges to necessary users only.
• Strengthen account security by implementing identity, credential, and access management (ICAM) policies and MFA.

Now is the time to adopt Identity-First security strategies.

What does that mean? Identity-First treats people, devices, and machine identities as the primary security perimeter, rather than the corporate network. It authenticates, permits, and continuously examines every access request, ensuring a zero-trust environment tailored to individual, context-aware risk profiles.

How Is AI Changing Identity Security Risks?

An Identity-First approach is increasingly important as adversaries and cyber criminals use artificial intelligence (AI) to scan vast amounts of source code, discover unpatched software vulnerabilities, and rapidly exploit those flaws before security teams can apply patches. Identity has become the primary battleground for modern AI-driven threats.

Beyond basic hygiene like MFA and strong passwords, organizations and individual users must shift toward continuous verification and contextual awareness to defend against AI-driven threats. Let’s look at what each can do to help protect identities:

How Can Organizations Put Identity-First Security Into Practice? 

• Implement identity threat detection and response tools to detect baseline deviations, such as an identity requesting unusual data types or authenticating from anomalous endpoints. 
• Treat AI bots, AI large language model plug-ins, and service accounts as distinct employees. Every AI agent should have its own cryptographically verifiable identity. Never allow an AI system to run on a generic system-administrator account. 
• Do not give employees or AI agents standing, permanent access to sensitive databases. Access is granted automatically upon request, limited to the exact task, and expires immediately after completion. 

How Can Employees Protect Their Digital Identities? 

• Create a secret team passphrase. If you receive a suspicious, urgent call from someone who sounds exactly like your boss or a relative, ask for the secret word over a different app or phone line to protect against audio deepfakes. 
• Never click or call back directly. If an email or message demands an urgent wire transfer or password change, ignore the links or phone numbers inside it. Instead, open a fresh message or look up their number in your official company directory to verify the request. 
• Treat browser extensions and AI plug-ins as open windows into your accounts. Regularly check your security settings and delete any tools or integrations you do not use anymore. 
• AI can perfectly mimic a coworker’s exact writing style and tone. Be skeptical of the request itself; if someone asks you to bypass standard rules or rush a financial transaction, treat it as a hack until you verify it. 

The Power of Collective Defense  

Cybersecurity relies on teamwork. The digital safety of government, businesses, healthcare, and education depends on the collective vigilance of all organizations within their networks. Cybersecurity Awareness Month should remind everyone to uphold strong security practices and help safeguard the nation’s digital environment. 

Make Complex Cybersecurity Messages Clearer

If you are looking to integrate an Identity-First messaging approach into your broader cyber resilience strategy, Yes& can help. For more information on how we can support and elevate your communications in the B2G market, please contact Carmel McDonagh.

---

Frequently Asked Questions About Identity-First Security