Visualized: How Cyberattackers Gain Access

Published

6 minutes ago

February 17, 2026

| 2,468 views

-->

Ryan Bellefontaine

Graphics & Design

Abha Patil

The following content is sponsored by Palo Alto

How Cyberattackers Gain Access

Key Takeaways

Identity weaknesses show up in 90% of Unit 42 investigations, so identity is a top control point.
Identity-driven techniques drive 65% of initial access, led by social engineering and credential misuse.
Excess permissions and token abuse help attackers move faster, so least privilege and session hardening matter.

Most breaches don’t start with a rare software exploit. Instead, attackers often gain access by taking over identity and using it like a master key.

This graphic, in partnership with Unit 42 by Palo Alto Networks, shows how cyberattackers gain access by exploiting identity paths, based on data from Unit 42 incident-response investigations.

Identity Is the Practical Perimeter

Here is a table that summarizes the main identity-driven routes attackers use to gain access.

Initial Access 1	Initial Access 2	Initial Access 3	Percentage
Other	Other	Other	35%
Identity-based techniques	Identity-based social engineering	Identify-based phishing	22%
Identity-based techniques	Identity-based social engineering	Other social engineering	11%
Identity-based techniques	Credential misuse and brute force	Credential misuse	13%
Identity-based techniques	Credential misuse and brute force	Brute force	8%
Identity-based techniques	Identity policy and insider risk	Insider threats	8%
Identity-based techniques	Identity policy and insider risk	IAM misconfigurations	3%

In the past year, Unit 42 found identity weaknesses played a material role in 90% of investigations. As SaaS and cloud use grow, identity now acts as the perimeter.

Here, “identity-driven” specifically means abusing credentials, sessions, multi-factor workarounds, or permissions to look legitimate. Because that activity blends in, defenders often lose precious time.

The Way In: Identity-Driven Initial Access

Identity-based techniques drive 65% of initial access in Unit 42’s casework. However, many organizations still focus more on patching than authentication, and many still repeat common cybersecurity mistakes that attackers exploit.Social engineering leads at 33%, including phishing designed to bypass MFA and hijack sessions. Meanwhile, credential misuse and brute-force attacks account for 21%, and policy or insider abuse accounts for 11%.

The Way Through: Identity Turns Access Into Impact

Once attackers log in, they can escalate privileges and move laterally with fewer alarms. In turn, Unit 42 found 99% of 680,000 cloud identities held excessive permissions.

Token theft and risky OAuth grants also let adversaries persist without repeated logins. Consequently, one over-privileged human or machine identity can expand the blast radius quickly.

Countermeasures That Disrupt Identity Attacks

Start with phishing-resistant MFA such as passkeys or FIDO2 keys for high-value roles. Next, rotate machine credentials, shorten sessions, and shift admins to just-in-time elevation.

You can also connect identity telemetry across cloud and SaaS to spot unusual access chains sooner.

See why cyberattacks are getting 4x faster

Related Topics: #social engineering #cyber intrusions #phishing #cyberattacks #technology

Click for Comments

var disqus_shortname = "visualcapitalist.disqus.com";
var disqus_title = "Visualized: How Cyberattackers Gain Access";
var disqus_url = "https://www.visualcapitalist.com/sp/pal01-how-cyberattackers-gain-access/";
var disqus_identifier = "visualcapitalist.disqus.com-195539";

Charted: U.S. Pension Retirees Now Outnumber Active Workers Guest
Visualized: How Cyberattackers Gain Access Guest
Mapped: What Powers Each U.S. State and Canadian Province? Guest
Ranked: U.S. States by AI and Data Center Jobs Guest
Ranked: What People Value Most in the U.S., UK, and Germany Guest
Visualizing the Critical Minerals Powering the AI Boom Guest
The Periodic Table of STEM Careers Guest
Mapped: The World’s Countries by Political System Guest
Ranked: Countries with the Most Winter Olympics Medals Guest
Ranked: The Best Countries at Creative Thinking Guest

You are here

Visualized: How Cyberattackers Gain Access