83% of Cloud Breaches Start with Identity. AI Agents are About to Make it Worse.

Key Points:

• Identity compromise is the leading cause of cloud breaches, accounting for 83% of incidents in H2 2025, exacerbated by overprovisioning of access rights.
• Affected systems include cloud environments and developer tools, with attackers leveraging compromised credentials and machine identities to escalate privileges rapidly.
• Organizations should implement stricter identity governance, monitor AI tool activities closely, and automate security responses to counteract the accelerated threat landscape.

Technical Details: The report highlights incidents involving North Korean actors exploiting CI/CD service account tokens and a compromised NPM package that facilitated privilege escalation to AWS administrator access. The rapid exploitation of vulnerabilities has reduced the window for response from weeks to days.

MITRE ATT&CK Techniques:

• T1078 - Valid Accounts (Defense Evasion, Initial Access)
• T1190 - Exploit Public-Facing Application (Initial Access)
• T1003.001 - OS Credential Dumping: LSASS Memory (Credential Access)

IOCs Mentioned: None mentioned.