By Adam Butler, Principal Cyber Solutions Architect

Twice now I’ve written about identity being the place attackers are actually winning.

First on how exposed personal data and baseline compliance were quietly rewriting what “secure” means. Then on FortiBleed, where tens of thousands of devices were accessed with credentials that were long, complex, and already known.

The response I get to both is usually some version of the same sentence: we’ve enforced MFA and our backups are immutable, so we’re covered.

Recent activity across the UK mid-market suggests attackers worked that out before we did.

MFA protects the login, not the session

Enforcing MFA felt like a finish line. Cyber Essentials made it mandatory in April, organisations rolled out authenticator apps, and the box was ticked.

The problem is what MFA actually validates. It confirms who is at the door at the moment they knock. It does not tie the resulting session to the machine that person is sitting at.

Adversary-in-the-Middle phishing kits exploit exactly that gap.

Rather than serving a crude fake login page, the kit proxies traffic to the real identity provider in real time. The user enters their password on what is, technically, the genuine sign-in flow. They approve the genuine push notification. The identity provider accepts it and issues a valid session cookie.

The proxy takes the cookie in transit.

From there, the attacker injects that token into their own browser and is, as far as the tenant is concerned, the user. No password entered. No MFA prompt. Nothing for a brute-force alert to fire on.

What follows is usually automated and fast. Scripted abuse of the Graph API, hidden inbox rules that quietly route anything mentioning invoices, remittances or bank details into Deleted Items, and business email compromise conducted from a mailbox everyone in the supply chain already trusts.

Attackers stopped encrypting because they no longer needed to

The other assumption is that good backups defeat ransomware. For a while, that was true. UK payment rates fell as backup resilience improved, and refusing to pay became a realistic position.

Threat actors responded by removing the part of the attack that backups defeat.

The dominant pattern in mid-market incidents now is data theft without encryption. It is a better business model for them for three reasons.

Encryption is loud. Renaming and rewriting terabytes of files generates exactly the kind of disk activity endpoint tooling is built to catch. Exfiltration generates almost none.

Staging and extraction use tools that are already trusted. Built-in administration utilities to collect the data, Rclone or MegaSync to move it, standard HTTPS and SFTP to carry it. It looks like traffic, because it is traffic.

And a clean restore answers the wrong question. When the threat is publishing payroll records, board correspondence and client contracts, being able to rebuild your file server does nothing for the regulatory exposure or the litigation that follows.

Dwell time has compressed accordingly. Access, stage, exfiltrate, often between midnight and five on a Sunday morning, because that is when most mid-market organisations have nobody watching.

Regulation is catching up, though not quite where people assume

The Cyber Security and Resilience Bill is now in the Lords, with Royal Assent expected later this year and phased implementation running well beyond it. It matters, but it is worth being precise about who it lands on.

Direct scope covers operators of essential services, digital service providers, managed service providers, data centres and designated critical suppliers. Most SMEs reading this are not directly regulated by it.

They will feel it anyway, from both directions. Their suppliers are being brought under statutory oversight, which changes what those suppliers are contractually obliged to prove. And their own customers, if any of them are in scope, will start asking the same questions downstream.

The enforcement regime is tiered rather than a single headline figure: up to £10 million or 2% of global turnover for standard contraventions, up to £17 million or 4% for serious ones, and up to £100,000 a day for ongoing failures. Reporting tightens to a 24-hour early warning followed by a full report within 72 hours.

Worth saying plainly: as a managed service provider, ARO is in direct scope. We are working through this for ourselves, not just advising on it.

What actually closes the gap

Three architectural priorities, none of which are new, all of which are now load-bearing.

Move privileged and high-risk users onto phishing-resistant authentication. FIDO2 keys, platform passkeys or certificate-based authentication bind the session to the device, which is the specific thing standard MFA does not do.

Validate sessions continuously rather than once. Conditional Access with continuous evaluation can revoke a live token when location, risk state or device posture changes, which is the only control that meaningfully shortens a stolen-token attack.

Cover the hours the attackers actually work. If exfiltration completes in under four hours at 3am on a Sunday, detection that stops at five on Friday is not detection. Containment has to isolate endpoints and kill sessions automatically, in real time.

How ARO helps

Our focus is on whether controls hold up against how attacks actually run, rather than how they read on an assessment.

Through Cyber Maturity Assessments, Managed Detection and Response, and identity security work, we help organisations:

  • Find the authentication gaps where token theft bypasses existing MFA
  • Get 24/7 visibility and automated containment across identity, cloud and endpoint
  • Close out-of-hours dwell time before data leaves
  • Build supply chain assurance and incident reporting ahead of the Bill

The pattern across all three of these pieces is the same, and it keeps getting harder to argue with. Attackers are not defeating controls. They are using them.

The question is no longer whether MFA is enabled. It is whether the session it issued is still yours.