As reported by BleepingComputer, Prophet Security's first quarterly threat report — built on 4.7 million investigation questions across customer environments between May and July 2026 — surfaces a finding that should reframe how defenders think about identity security: the strongest predictor of a successful account takeover wasn't the attacker's sophistication, the victim's industry, or even whether MFA was enabled. It was whether the attacker showed up with a password or with an already-authenticated session.

Key Takeaway: It was whether the attacker showed up with a password or with an already-authenticated session.

The Control Gap Prophet's Data Exposes

The report's headline statistic — identity involved in roughly half of confirmed malicious activity — is consistent with what most SOC teams already suspect. What's more valuable is the mechanism. Password-based attacks, including credential stuffing and adversary-in-the-middle phishing, were largely neutralized by existing conditional access policies: geo-velocity checks, impossible-travel detection, and phishing-resistant MFA all performed as designed. The controls worked.

But session token replay operated in a blind spot. A stolen session cookie or refresh token doesn't traverse the authentication flow — it's already past the gate. Conditional access policies evaluate at sign-in time, not at access time. Until the token is refreshed or revoked, the attacker inherits the victim's posture and bypasses every policy the organization spent years maturing.

The uncomfortable truth: most identity security investments assume the attacker must authenticate. Increasingly, they don't need to.

Why This Matters Beyond the Headline

Prophet's methodology — investigating every alert rather than triaging — is itself notable. The 93% benign / 7% malicious split across a quarter of continuous investigation suggests that even well-resourced SOCs are likely sitting on a non-trivial volume of confirmed malicious activity that alert fatigue never surfaces. The median 35 questions per investigation also implies that meaningful alert context requires more than a simple enrichment call; it requires iterative, environment-aware inquiry that most human analysts can't sustain.

The session-hijacking finding has a second-order implication that the report touches on but deserves emphasis: persistence. The article notes individual accounts with dozens of malicious sign-ins spanning three weeks of continuous email access. That's not opportunism — that's dwell time. Session-based persistence is quieter than OAuth consent grants or malicious inbox rules, and it's harder to detect because the activity looks legitimate from the identity provider's perspective.

What Defenders Should Actually Change

The defensive posture that blocks passwords is necessary but insufficient. Organizations need to assume tokens are a live attack surface and instrument accordingly:

What Defenders Should Actually Change
Continuous Access Evaluation (CAE): If you're on Entra ID, enable CAE to allow real-time policy re-evaluation on active sessions — not just at sign-in. This is the single most impactful control against token replay.
Session anomaly detection: Correlate session activity against baseline behavioral patterns — geo, device fingerprint, resource access patterns — not just sign-in metadata. A session that suddenly starts exporting mail from a new ASN after weeks of dormancy should trigger review even if the token is technically valid.
Aggressive token lifetimes: Shorten refresh token lifetimes and session lifetimes for privileged and email-enabled accounts. The tradeoff between user friction and exposure reduction favors shorter sessions for high-value identities.
Token revocation on risk events: Integrate identity risk signals (impossible travel, suspicious IP, MFA fatigue patterns) with automated session revocation. Don't wait for the next refresh cycle.
Browser isolation and managed device enforcement: Stolen cookies often originate from infostealer infections on unmanaged endpoints. Requiring compliant devices for email access eliminates a large percentage of token theft at the source.
Investigate every alert — or automate to the point where you can: Prophet's data shows that the 7% that matters hides in the noise. If human triage can't scale, AI-driven investigation that asks environment-specific questions is the only viable path to closing the gap.

Shield53 Recommendations

Treat session tokens as credentials. They are. Review your identity provider's session policies, enable continuous evaluation where supported, and pressure-test your detection logic against a session replay scenario — not just a password spray. If your SOC isn't investigating the alerts you're currently ignoring, you don't know what's in the 7%.