Identity Attacks Surge in 2025 What Lean Teams Must Monitor Monthly
Attackers do not need to break the firewall if they can sign in with a valid account. That is why identity attacks have become one of the most practical threats for small and mid-sized organisations in 2025. The target is not only a server or an application. It is the sign-in process, the password reset flow, the administrator account, and the tired person approving prompts at the end of a long day.
Microsoft’s Digital Defense Report 2025 points to the same direction many security teams already feel: identity-based attacks are increasing, and attackers are using scale to their advantage. They test huge numbers of usernames and passwords, look for accounts without multi-factor authentication, and abuse legitimate access once they get in.
For lean teams, the answer is not to monitor everything all the time. That is rarely realistic. The better starting point is a short monthly review of the identity signals most likely to show early compromise.
Identity is now a primary attack path
Identity attacks are attractive because they hide inside normal business activity. A successful sign-in does not always look like an intrusion. It can look like a user checking email, opening a cloud file, or joining a remote access session.
That makes identity different from older security problems. Malware often leaves clear signs, such as blocked files, suspicious processes, or alerts from endpoint tools. Stolen or abused accounts are harder to spot because the system may see a valid username, a valid password, and sometimes even a valid multi-factor approval.
This is why identity threat detection matters, even in smaller environments. It helps separate normal sign-ins from patterns that deserve review.
Common targets include:
Email accounts with access to invoices, contracts, or customer messages
Administrator accounts that can create users or change permissions
Cloud storage accounts with sensitive files
Remote access accounts used by staff, suppliers, or support providers
Accounts that have not been used recently but still have access
The Microsoft report is useful because it frames the issue as a broad shift, not a niche problem. Attackers are not only going after large enterprises. Smaller organisations are often easier to test at scale because they have fewer staff watching logs, weaker password controls, and less time for regular access reviews.
Password spray attacks work because they are quiet and patient
A password spray attack is different from a traditional brute-force attack. Instead of trying thousands of passwords against one account, the attacker tries a small number of common passwords across many accounts.
For example, an attacker might try a common seasonal password against every user in a company. If that fails, they wait and try another one later. This approach avoids obvious lockouts and can blend into normal failed sign-in noise.
At scale, this becomes a numbers game. Attackers can test many organisations, many usernames, and many cloud services. They do not need a high success rate. One weak password on one useful account can be enough.
Password spray attacks are prevalent because they are cheap to run and easy to repeat. They often rely on information that is not hard to find:
Public staff names from company websites
Email formats such as firstname.lastname@company
Old passwords from earlier data breaches
Common password patterns based on months, seasons, or company names
Lean teams should watch for failed sign-ins spread across many accounts, especially when those attempts come from unfamiliar locations or systems. One failed sign-in is normal. A pattern across many users over several days deserves attention.
A monthly review should answer a few basic questions:
Signal to review | Why it matters | What to check |
Many failed sign-ins across many users | This can indicate password spraying | Source location, time pattern, affected accounts |
Repeated failures followed by one success | This may show a guessed password | Account activity after the successful sign-in |
Attempts against old or disabled users | Attackers often use stale username lists | Whether unused accounts still exist |
Attempts outside normal working regions | This may indicate automated testing | Location, device, and service used |
A small team does not need a perfect investigation for every failed login. The first goal is to separate background noise from repeated, organised activity.
Three identity signals deserve a monthly review
Identity alerts can become noisy. If every failed login has the same priority, nothing has priority. A monthly review should focus on signals that combine risk with practical value.
The following three are a strong starting point.
Impossible travel
Impossible travel means an account appears to sign in from two distant locations in a time window that would not allow real travel.
A simple example:
A user signs in from Madrid at 09:10, then from Singapore at 09:45. That does not fit normal behaviour unless there is a technical explanation, such as a virtual private network, cloud proxy, or shared service.
This signal is useful because it can catch stolen credentials quickly. Still, it needs context. Some services route traffic through different regions. Some staff travel. Some users connect through privacy tools. The monthly review should not treat every impossible travel alert as proof of compromise.
Check:
Whether the user normally works from those regions
Whether the device is known
Whether the sign-in used multi-factor authentication
What the account did after signing in
Whether similar alerts affected other users
The strongest case for concern is impossible travel followed by sensitive activity, such as mailbox access, file downloads, or permission changes.
MFA fatigue prompts
Multi-factor authentication, often called MFA, asks users to confirm a sign-in with a second step, such as an app prompt, code, or security key. It is one of the most useful protections against stolen passwords.
Attackers now try to wear it down. In an MFA fatigue attack, they trigger repeated approval prompts and hope the user accepts one by mistake, frustration, or habit.
This is not a theory. Security teams have seen attacks where repeated prompts led to a valid approval. Once that happens, the attacker may look like a legitimate user.
Monthly review should focus on unusual prompt patterns, not normal single approvals. Look for:
Many prompts sent to one user in a short period
Prompts at unusual hours
Denied prompts followed by an approved prompt
Prompts from locations the user does not recognise
Users who report “random approval requests”
A good control is number matching, where the user must type a number shown on the sign-in screen into the authenticator app. It reduces accidental approvals because the user must see the original login page. Stronger options, such as hardware security keys, reduce this risk further for administrator accounts.
If the team cannot review MFA data weekly, a monthly check is still valuable. It can find users under repeated attack and accounts that need stronger controls.
New admin grants
New administrator access is one of the most important identity events to review. An attacker who gains user access will often try to expand privileges. A well-meaning internal change can also create risk if admin rights remain in place after a task is complete.
The monthly review should list every new admin grant and answer:
Who received the access
Who approved it
Why it was needed
Whether it was temporary or permanent
What the account changed after receiving access
This review matters because administrator accounts can reset passwords, create new users, change security settings, and access sensitive systems. A single admin grant can change the risk level of the whole environment.
Small organisations often give broad rights because it is faster. That may be understandable during setup or urgent support, but it should not become permanent by default.
Use a simple rule: admin access should be rare, named, approved, and reviewed. Shared admin accounts should be removed where possible because they make it difficult to know who did what.
The skills gap makes simple monitoring more important
The ISC2 2025 workforce reporting continues to highlight a cybersecurity skills gap. The practical effect is clear: many organisations have more security work than people available to do it.
For small and mid-sized businesses, that gap shows up in predictable ways:
Alerts wait too long before review
Identity settings are checked only after an incident
Administrator rights build up over time
Departed users keep access longer than they should
Security tools are bought but not fully used
This is not only a staffing problem. It is an operating problem. If the team is small, the monitoring plan must be realistic enough to survive busy weeks, holidays, supplier issues, and project work.
That is where identity security monitoring can be kept simple. A monthly review is not a full security programme, but it creates a regular habit around the accounts most likely to cause damage.
A reasonable monthly identity review can take less than a day if the data is available. The aim is not to read every log line. The aim is to pull the right reports, spot changes, and follow up on the few events that look wrong.
A practical monthly review for lean teams
Security monitoring for small teams works best when it has a fixed rhythm. If the review depends on spare time, it will slip. Put it on the calendar, assign an owner, and use the same checklist each month.
A basic monthly workflow can look like this.
1. Review risky sign-ins
Start with sign-ins marked as unusual or high risk by the identity platform. Focus on:
Impossible travel
Unfamiliar locations
New devices
Sign-ins from anonymising services
Successful sign-ins after many failures
Record the accounts reviewed and any action taken. This creates a trail for future audits and helps spot repeated patterns.
2. Check password spray indicators
Look for failed sign-ins spread across many users. Pay attention to attempts against senior staff, finance users, administrators, and older accounts.
If password spray activity appears, take practical steps:
Confirm affected users have multi-factor authentication
Disable unused accounts
Reset passwords for accounts with suspicious successful sign-ins
Block repeated sources where appropriate
Review whether common passwords are being rejected
Strong password rules do not need to be complex. Long passwords, blocked common passwords, and multi-factor authentication usually help more than forced frequent changes.
3. Review MFA prompt activity
Check repeated prompts, denied prompts, and approvals at odd times. Follow up with users when needed. A short message can be enough:
“Did you try to sign in at 22:30 from a new device?”
If the answer is no, treat the account as potentially compromised. Reset the password, revoke active sessions, and review recent activity.
4. Audit new admin access
Export or list all administrator changes from the month. Confirm each one has a reason and an owner. Remove rights that are no longer needed.
Pay close attention to:
New global administrators
New mailbox administrators
New security administrators
New application owners
New service accounts with broad rights
Administrator access should not be a convenience setting. It should match a real support need.
5. Close stale accounts and stale sessions
Unused accounts are easy targets. They may have weak passwords, missing multi-factor authentication, or no active owner.
Review accounts that have not signed in recently. Disable those that are no longer needed. For accounts that must remain, confirm ownership and access level.
Also consider revoking old sessions for high-risk users. This forces a fresh sign-in and can remove access from a stolen session token.
What good monthly evidence looks like
A good review creates evidence. That does not mean long reports. It means enough record keeping to show what was checked and what changed.
A simple monthly record can include:
Review area | Evidence to keep |
Risky sign-ins | Export of reviewed alerts and notes on follow-up |
Password spray patterns | Summary of affected accounts and source patterns |
MFA prompts | List of unusual prompt activity and user confirmations |
Admin grants | List of new grants, approvals, and removals |
Stale accounts | Accounts disabled or confirmed as still needed |
This evidence helps during audits, insurance reviews, and incident response. More importantly, it helps the next monthly review go faster because the team can compare patterns over time.
The right goal is consistency, not perfection
Identity attacks will keep growing because the economics favour attackers. Password spraying, stolen credentials, and prompt abuse are cheap to run. Defenders need repeatable habits that catch the most useful warning signs before damage spreads.
For a lean team, the monthly identity review should start with three signals:
Impossible travel
MFA fatigue prompts
New admin grants
Add password spray patterns and stale account checks, and the team has a practical baseline. It will not catch every attack, but it will reduce blind spots in the part of the environment attackers most often exploit.
For a practical way to structure this work, use these security operations oversight resources to support regular reviews and clearer ownership.
The strongest security habit is not a bigger dashboard. It is a review that actually happens every month, with clear notes, clear follow-up, and fewer risky accounts left unchecked.
