What ENISA’s 2026 Threat Landscape Report Means for Identity Governance

Important note: ENISA was able to identify the entry point in only 5.2% of unauthorized access cases. Within this small group, exploiting vulnerabilities was the most common route at 60.4%. The report says nothing about the remaining cases, so the figures point to trends rather than a representative distribution.

Verizon’s “2026 Data Breach Investigations Report” also names vulnerability exploitation as the most common known entry point for the first time, at 31%. At the same time, credential abuse plays some role in 39% of all breaches. Our overview of the 12 most common cybersecurity threats and vulnerabilities explains which weaknesses attackers typically exploit.

6 Identity-Driven Shifts in the Cyber Threat Landscape

1. MFA Can No Longer Be Taken for Granted

Tycoon 2FA was reportedly the most widely observed phishing kit in the world in 2025. It works as an adversary-in-the-middle (AiTM) proxy built to bypass multi-factor authentication: the attacker sits between the user and the real login page and captures the password, the code, and the session.

In its outlook, ENISA also cites device code phishing and ClickFix as examples of a broader trend. Instead of exploiting technical flaws, attackers abuse legitimate login procedures and user trust. In device code phishing, victims are tricked into approving the attacker’s code on a genuine login page. ClickFix persuades users to “fix” a supposed problem themselves, which makes them run malicious code.

For governance, this means MFA alone is not enough. What matters is what an account can do once it is logged in.

2. Infostealers Get Around Passwords and MFA

According to ENISA, credential theft in 2025 still relied heavily on infostealers. This is malware that harvests credentials and identity data from an infected machine and sends them to the attackers. It spread through phishing, ClickFix lures, fake software updates, and compromised cloud services. Infostealers capture not just passwords but also browser data, MFA tokens, and session cookies, so attackers can take over accounts without ever entering a second factor.

Leaked chats from the ransomware group Black Basta show how credentials from infostealer infections and access brokers fueled ransomware attacks and made lateral movement through networks possible. Credentials, VPN access, and RDP access are also sold on underground forums.

The more privileges a stolen account has, the more it is worth. Orphaned accounts and permissions nobody needs anymore make it easier for attackers to move deeper into the network.

3. Vishing and SaaS

ENISA finds the financially motivated cybercrime group ShinyHunters especially instructive, because its methods are documented across the entire kill chain, the series of phases that make up a cyberattack. The group combined phishing, vishing (short for “voice phishing”), MFA abuse, and stolen OAuth tokens to compromise cloud environments. Salesforce, Microsoft 365, SharePoint, Slack, and Google BigQuery were all affected. The attackers often posed as IT staff on the phone to get SSO credentials and MFA codes.

The lesson: through SSO and token links, a single compromised account can open the door to many applications. What an attacker can reach there depends on the permissions that have been granted.

4. Insiders and Planted Employees

ENISA sees a growing share of insider threats. For state-linked attacks it stands at 5% and is rated a particular risk. The main driver is believed to be the North Korean group Famous Chollima, which applies for jobs at Western companies, including in the EU, using false identities, AI-generated LinkedIn profiles, and in some cases fictitious companies. According to ENISA, the group has targeted digital service providers, government and defense organizations, and the financial sector.

This is a core Identity Governance problem: the identity is created legitimately, given access, and approved, yet it is hostile.

5. Abusing Trust Through App Passwords and Tokens

According to the report, state-linked actors manipulated researchers and policy experts into creating app-specific passwords, and used phishing in collaboration tools to exfiltrate Office 365 tokens. From a governance standpoint, this kind of access is especially problematic: it often bypasses regular authentication policies and rarely shows up in standard permission overviews.

6. AI as an Accelerator and as a Target

AI appears in the ENISA report in two roles that governance should treat separately.

• AI as an accelerator for attackers: AI is increasingly used for phishing, fraud, and malware development. According to the report, an AI-assisted cloud intrusion obtained administrator privileges within 8 minutes. For 2026, ENISA considers it likely that AI will directly support more phases of the kill chain and that the barrier to entry for attackers will keep falling.

• AI as a target inside your own organization: Separately, AI applications and their ecosystems are themselves under attack, especially when they can access files, credentials, browser sessions, or development environments. ENISA expects the adoption of new models to widen the attack surface of EU organizations, through both accidental and malicious activity.

For Identity Governance, this means faster attacks call for time-limited permissions and quicker revocation rather than annual reviews. And AI agents with broad access are privileged identities: they need an owner, a purpose, minimal permissions, and a limited lifespan.

What Identity Governance Contributes in Practice

Identity Governance can’t stop phishing. But it limits the damage and the window for abuse, and it provides evidence. The following table maps the ENISA findings to governance responses:

The Practical Checklist

• Automate Joiner-Mover-Leaver. Permissions follow the role. When someone changes roles, old permissions are removed. When someone leaves, all access is revoked immediately.

• Run risk-based access reviews. Review privileged permissions and access to sensitive SaaS data more often than standard permissions.

• Handle privileged access separately. Grant admin rights only on request, for a limited time, and with logging.

• Roll out phishing-resistant authentication. Use FIDO2/passkeys for administrators and high-risk roles, since AiTM kits defeat conventional MFA methods. Also limit sessions (short lifetimes, re-authentication for critical actions), because FIDO2 doesn’t protect against stolen session cookies either.

• Inventory non-human identities. Every service account, API key, and AI agent needs a responsible owner and an expiration date.

• Secure support processes. Reset passwords and MFA only after strong verification, and require four-eyes approval for privileged accounts. Employees should know that IT never asks for codes over the phone.

• Feed anomalies back into governance. Suspicious logins or privilege escalations should be able to trigger reviews and revocations.

• Review app integrations and tokens. Inventory OAuth grants and app passwords, and recertify them regularly.

NIS-2: Why Governance Is Also a Compliance Issue

In Germany, the NIS-2 Implementation Act has been in effect since December 2025. The risk management measures under Section 30 of the BSI Act (Act on the Federal Office for Information Security) require, among other things, access control concepts and the use of multi-factor or continuous authentication.

Organizations must also be able to prove that their measures work, not just that they exist. This is where automated recertifications, traceable approvals, and audit-proof logs help. Whether your company is in scope is something to clarify with the NIS-2 applicability check. Even for unregulated companies, though, these measures are a sensible benchmark.

Conclusion

The “ENISA Threat Landscape 2026” report describes a threat landscape in which the methods of cybercriminals, hacktivists, and state actors are growing more alike. A common path leads through trusted identities, sessions, and permissions.

Organizations that manage identities across their entire lifecycle, limit permissions to what is necessary, and review access regularly take away one of attackers’ biggest levers. That makes it not an add-on to cyber defense, but a core building block.

Next Step

Do you know how many privileged accounts, orphaned accounts, and non-human identities exist in your environment? And when were their permissions last reviewed? That picture is the best starting point for your governance roadmap.

Sources:

• ENISA: ENISA Threat Landscape 2026, European Union Agency for Cybersecurity, September 2026.

• Verizon: 2026 Data Breach Investigations Report, Verizon Business, May 2026.

• NIS-2 Implementation Act / Section 30 BSI Act