Cybercriminals Don't Need to Hack Your Business. They Just Need to Log In.

It's Monday morning. Someone accessed your company's email, downloaded confidential files, or changed a vendor's bank details before an upcoming payment.

Nothing got past your firewall, and no malicious software was installed. The attacker signed in with a real employee account.

That's the problem with identity-based cyberattacks. Criminals don't have to break through your security when a stolen password, a hijacked login session, or one approved sign-in request gets them through the front door. Once inside, their activity can look a lot like an ordinary workday.

If your business runs on Microsoft 365, cloud applications, and remote access, the accounts your employees sign in with deserve as much protection as the laptops and networks they use.

This Cybersecurity Awareness Month, the theme "Don't Make It Easy for Them" raises a fair question: How hard would it be for someone to get into your business using an existing account?

What Are Identity-Based Cyberattacks?

An identity-based cyberattack happens when someone uses another person's login credentials, digital identity or account permissions to get into business systems without authorization.

Account takeover is one type of identity-based cyberattack. It happens when someone gains unauthorized control of a legitimate account, often using stolen credentials or other compromised authentication information.

Instead of working around your security, the attacker uses access that looks legitimate.

Think about what a typical work account can reach: company email, shared documents, customer records, financial applications and conversations with vendors. Depending on that employee's permissions, whoever controls the account may be able to read sensitive messages, download confidential files or pose as the employee without raising immediate suspicion.

This is a common way in. According to Verizon's 2026 Data Breach Investigations Report, credential abuse appeared in 39% of the breaches analyzed. Exploiting software vulnerabilities remained the leading way attackers first got in, but stolen credentials continued to play a significant role in security incidents.

The concern goes beyond a stolen password. A compromised account can give an attacker access to systems your business already trusts.

How Account Takeover Attacks Happen

Some account takeover methods rely on technical weaknesses. Others rely on everyday moments employees wouldn't think twice about.

Stolen Passwords and Credential Stuffing

Say an employee uses the same password for a personal shopping site and a work application. If the shopping site suffers a data breach, criminals can take that password and try it elsewhere.

This is called credential stuffing: testing stolen username and password combinations against other services until one works.

The employee never clicked a suspicious link or downloaded anything. A password exposed somewhere can be enough to put a business account at risk, especially when no additional verification is required.

Fake Login Pages

Phishing emails have come a long way from the clumsy, misspelled scams many people still picture. A message might appear to come from Microsoft, a familiar software provider or a coworker, saying a document is waiting for review or an account needs attention.

The link opens a page that looks like a normal sign-in page. The employee enters their credentials, and those credentials go straight to a criminal.

More advanced phishing methods can also intercept authentication information, making certain forms of multifactor authentication less effective.

Stolen Login Sessions

Many business applications keep you signed in for days or weeks without asking for your password again. They do this with session tokens, which tell the application you've already authenticated.

That convenience has a downside. If an attacker steals a valid session token, they may be able to act as the signed-in employee without entering a password or completing another MFA challenge. This type of attack is known as session hijacking.

This is one reason turning on MFA doesn't eliminate every account takeover risk.

Why Compromised Employee Accounts Are Hard to Spot

Most people expect a cyberattack to be disruptive. Computers freeze, strange messages appear or employees suddenly lose access to their files.

Identity-based attacks often don't look like that.

Suppose a criminal gets into an employee's Microsoft 365 account. Depending on the account's permissions, they may be able to open email, search for financial information and review shared documents.

Here's how quiet that can be.

An attacker could create an inbox rule that moves messages containing words like "invoice,""payment," or "wire" into a folder the employee rarely checks. If the organization's security settings allow external forwarding, the attacker might also forward copies of those messages to an external address.

The employee may continue working without realizing certain vendor messages are being redirected. Meanwhile, the attacker could read financial conversations, learn which payments are due, and identify who approves them.

Microsoft 365 includes controls that can restrict automatic external email forwarding, and properly configured monitoring can help detect suspicious mailbox changes. But businesses must ensure those protections are in place.

The account is legitimate. The person using it is not.

A successful login doesn't prove the right person is signed in. Good identity security also looks for unusual behavior, unfamiliar devices, suspicious account changes and other signs of misuse of legitimate access.

Is Multifactor Authentication Enough?

If your business already requires MFA, you've taken an important step toward protecting employee accounts. The next question is which kind of MFA you're using, because not every method offers the same protection.

Text message codes and basic approval notifications add security, but they can still be vulnerable to phishing, social engineering or repeated authentication requests.

Phishing-resistant MFA, including supported passkeys and FIDO2 security keys, provides stronger protection because it's designed to prevent users from authenticating to fraudulent websites.

The Cybersecurity and Infrastructure Security Agency recommends phishing-resistant MFA wherever possible.

If your team uses an authenticator app, number matching can help prevent accidental approvals by requiring employees to confirm a number shown during sign-in.

None of this is a reason to turn off the MFA you already have while you evaluate stronger options.

Keep your MFA, but find out whether your business could use a stronger method.

6 Ways to Prevent Account Takeover in Your Business

Protecting against identity-based cyberattacks doesn't come down to a single security product. It takes a combination of account protections, sensible access policies, employee awareness and ongoing monitoring. Review these six areas with your IT team or technology provider.

1. Use Stronger Authentication Where It Counts

Require MFA for company email, financial applications, remote access and any other system that holds sensitive business information.

Prioritize phishing-resistant MFA for accounts with elevated permissions or access to especially sensitive data. If your organization relies on basic push notifications, find out whether number matching or a stronger method is available.

2. Review Who Has Access to What

Employee permissions pile up over time. Someone who moved from accounting to operations three years ago may still have access to financial applications they no longer use. A former contractor's account may remain active because no one formally requested its removal.

This is often where many businesses have their priorities backward. They spend a lot of time worrying about hackers breaking through their defenses and not nearly enough time questioning who already has access. A permissions review isn't exciting, but every unneeded account and leftover privilege is another door an attacker could walk through.

Review account permissions regularly, remove access people no longer need and set a consistent process for disabling accounts when someone leaves the organization.

3. Watch for Unusual Login Activity

A sign-in from an unfamiliar device doesn't automatically mean an account has been compromised. It does deserve a closer look.

Your IT team should have a way to investigate suspicious sign-ins, unexpected account changes such as new inbox rules or forwarding addresses and other activity that doesn't match normal business patterns. The sooner you spot suspicious activity, the better your chances of containing it.

4. Give Administrator Accounts Extra Protection

Not every account carries the same level of risk. An attacker who compromises a standard account may get into email and shared documents. Someone who compromises an administrator account could change security settings, create new accounts or reach more sensitive systems.

Limit administrative privileges to people who truly need them. Where it makes sense, use separate accounts for administrative work and everyday tasks, with stronger authentication and monitoring on the admin accounts.

5. Verify Account Reset Requests

Password resets and account recovery requests are a normal part of running a business.  They're also an opening for impersonation.

A criminal might call your help desk pretending to be an employee who lost their phone and needs to register a new authentication method. Without a reliable way to confirm who's calling, an attacker could get in without ever knowing the original password.

Make sure whoever handles account recovery knows how to verify a request before changing passwords, authentication methods or access permissions.

6. Make Reporting Suspicious Activity Easy

Employees shouldn't have to guess whom to contact when something doesn't look right. If someone receives an unexpected MFA request, sees an unfamiliar login notification or suspects their password has been exposed, they should know exactly how to report it.

They also need to feel comfortable reporting mistakes quickly. The employee who tapped Approve at 8:43 a.m. in our example is far more helpful reporting it at 8:45 than staying quiet out of embarrassment. A delayed report gives an attacker more time to access information or move into other systems.

Five Questions to Ask Your IT Provider

You don't need to understand every technical detail of identity security to have a productive conversation about it. Start with these questions:

1. Are all of our business-critical accounts protected by MFA? Ask whether phishing-resistant options are available for sensitive systems.
2. How would we know if an account was being misused? Find out what gets monitored, what triggers an alert and who investigates it.
3. How quickly do we remove access when employees leave? Confirm that account deactivation is part of a documented offboarding process.
4. Who has administrative access to our systems? Check whether elevated permissions are limited, reviewed and properly protected.
5. What happens if an employee account is compromised? Ask how your IT team would investigate, contain the incident and restore secure access.

These conversations can reveal weaknesses that don't show up during normal operations, and they're worth having before a security incident rather than after one.

Don't Make It Easy For Them

Firewalls, antivirus software and other traditional security measures still matter.  They just can't address every risk that comes with stolen credentials and compromised accounts.

Protecting your business from identity-based cyberattacks also means paying attention to who has access, how identities are verified and what happens when an account starts behaving differently. Your employees don't need to become cybersecurity experts. They need sensible permissions, strong authentication, someone watching for unusual activity and a clear process to follow when something seems off.

A forgotten account, an unnecessary permission or an unapproved login request can give an attacker an opening they should never have had. This Cybersecurity Awareness Month, take a closer look at the accounts your business relies on every day.

Sometimes the biggest security concern isn't someone trying to break down the door. 

It's someone who already has a key.

How Secure Are Your Business Accounts?

If you're not sure how well your current security measures protect against compromised accounts and unauthorized access, Fraser can help you take a closer look.

Our Free Technology Risk Assessment is a starting point for identifying potential security gaps and understanding where your business may be exposed.

Schedule a Free Technology Risk Assessment to take the next step toward protecting your business.