How to prepare for the next generation of identity-based threats

Digital identity is now a primary target for the next generation of cyberattacks.

Cybersecurity has entered a new era. AI, automation, and sophisticated social engineering have made digital identities a preferred attack vector. Rather than relying on exploiting software vulnerabilities, attackers can exploit trust—impersonating employees, manipulating identity recovery processes, and using legitimate access to bypass traditional defenses.

But organizations are confronting this new generation of threats while operating technology environments that were built for an earlier era. Decades of technical debt incurred by siloed systems, inconsistent architectures, fragmented identity controls, and legacy applications are becoming difficult to ignore. Research shows that 83% of IT leaders believe infrastructure upgrades are needed to support agentic AI systems, underscoring the growing tension between AI ambitions and existing technology environments.

Legacy systems make up a significant amount of critical IT infrastructure. They often support essential workflows and are deeply integrated with other applications, devices, and processes. Replacing them can be costly, complex, and disruptive. Organizations therefore need identity and access management (IAM) that can bridge legacy and modern environments, extending consistent access controls and continuous trust across all digital identities, systems, and devices without requiring infrastructure replacement.

The growing risk of identity-based attacks

AI-powered phishing, deepfakes, and increasingly convincing impersonation techniques are making it easier for attackers to assume trusted identities. Service desks, password recovery processes, privileged accounts, shared devices, and distributed workforces all create opportunities to exploit trust rather than technology vulnerabilities.

Legacy infrastructure can compound the problem. Older applications and systems may rely on outdated or manual authentication methods, standing privileges, shared accounts, or fragmented identity stores. As a result, organizations may struggle to apply the same identity controls and visibility across their entire environment.

Preparing the workforce for a new era of threats

When attackers can log in as someone you trust, potentially through the systems where identity controls are weakest, the challenge is determining whether the identity using them can still be trusted.

Security awareness remains important, but organizations cannot expect employees to consistently distinguish legitimate interactions from ever-convincing AI-generated deception. Technical controls need to reduce that reliance on human judgment.

Agentic AI adds another dimension. Organizations are not only defending against attackers using AI; they are beginning to grant AI agents access to applications, data, and workflows. In environments where permissions and integrations have accumulated over decades, determining who or what should be trusted becomes more complicated. The need for technical controls that establish trust consistently across human and machine-driven interactions is becoming increasingly important.

How to effectively adapt your identity strategy

As the range of identities accessing critical systems expands—from employees and third parties to AI agents—organizations must rethink how they establish and maintain trust. That means adapting to this threat landscape requires thinking beyond authentication at login and developing a continuous process for establishing trust through identity verification.

Organizations should extend identity verification across high-risk workflows such as identity proofing, account recovery, help desk interactions, privileged access requests, remote onboarding, and third-party access. When controls vary across modern and legacy environments, attackers can gravitate toward the weakest link.

But that doesn't mean organizations need to replace decades of infrastructure at once. Instead, they can modernize identity incrementally by reducing shared and static credentials, strengthening controls around high-risk applications, limiting standing privileges, and improving visibility into who or what is accessing critical systems. Interoperability is key to extending consistent trust controls across both legacy and modern environments.

At the same time, stronger security should not create more work for legitimate users. Passwordless and adaptive authentication, risk-based access, and continuous authentication can increase assurance while keeping access simple, particularly for frontline workers who need to move quickly between critical applications.

A resilient strategy must also account for identities beyond the traditional workforce. As agentic AI expands, organizations will need to govern how AI agents and other machine identities are identified, what they can access, which privileges they receive, and how their activity is monitored and audited.

Ultimately, organizations cannot predict every identity-based attack or modernize every legacy system overnight. The goal should be to establish a consistent, adaptable trust model across the technology they have today while building toward the infrastructure they will need tomorrow. Those that continuously verify identities, reduce unnecessary privilege, secure high-risk workflows, and extend modern identity controls across old and new environments will be better positioned to securely modernize and defend against what comes next.

The path forward

In the 2025 Gartner Magic Quadrant for Access Management, Imprivata Enterprise Access Management was recognized with an Honorable Mention highlighting the product’s ability to provide single sign-on and secure authentication across heterogeneous IT environments. That focus can help organizations strengthen their identity foundation for emerging threats without first replacing the complex mix of modern and legacy technology they rely on today. The Imprivata platform can help organizations:

• Extend fast, secure, passwordless access across shared workstations, mobile devices, connected devices, and critical applications
• Strengthen identity verification across high-risk workflows, including onboarding, help desk authentication, credential enrollment, and password reset
• Detect and respond to identity threats with advanced monitoring and analytics that surface risk in real time
• Apply Zero Trust privileged access controls to reduce internal and third-party risk
• Govern agentic AI identities and access to support secure AI adoption at scale

Speak to an Imprivata expert today to learn how you can prepare your identity strategy for the next generation of identity-based threats.