FAQ: The CISO's Guide to a Proactive National Cybersecurity Awareness Month
In recognition of National Cybersecurity Awareness Month, this comprehensive guide addresses the critical identity and authentication security challenges facing organizations.
Published October 4, 2025
Securing your organization's digital identity and authentication processes is more critical than ever as cyber adversaries evolve their tactics.
This guide provides clear, actionable answers on the most pressing credential and authentication risks, and outlines the essential strategies—from prevention to incident response—to fortify your defenses. Let's explore the core questions shaping identity security today.
» Skip to the solution: Try KELA's cyber threat intelligence for free
FAQs: Identity & Access Security
What Emerging TTPs Threaten Credentials?
Emerging tactics, techniques, and procedures (TTPs) considerably increase credential and authentication risks, building on identity-based attacks that dominated in 2024.
Threats to authentication and access:
AI-driven brute force: Attackers increasingly use AI to automate password spraying attempts and to bypass basic defenses with speed and scale.
Infostealer epidemic: Malware like infostealers are fueling initial access attacks at an unprecedented rate. KELA tracked over 4.3 million machines infected by infostealers in 2024, resulting in more than 330 million compromised credentials.
MFA fatigue attacks: Adversaries exploit gaps in MFA protocols to bombard users with requests until they approve access just to stop the notification spam.
Did you know? 60% of Cisco Talos Incident Response cases in 2024 involved identity-specific attacks, making identity, authentication, and access control management the top security priority.
» Learn how to reduce damage from info-stealing malware
What Preventive Measures Should CISOs Prioritize?
CISOs must make Identity Intelligence a major focus, as robust digital identity and access control are the top priority. This involves adopting Zero Trust principles and strengthening authentication.
Key priorities:
Stronger MFA enforcement: CISOs must enforce MFA for all applications and enhance the strength of methods used, such as biometrics, to combat advanced bypass techniques.
Passwordless adoption: Moving toward password-less environments, such as implementing passkeys, prevents unauthorized access resulting from easily compromised credentials.
Phishing-resistant strategies: These are crucial, as 42% of organizations suffered a successful social engineering attack in the past year. Implementing phishing-resistant MFA is necessary to close this gap.
» Discover how implementing Identity Guard strategies can immediately reduce risk and secure your digital identities
If Identity Defenses Are Compromised, What Incident Response Strategies Are Most Effective?
When identity defenses fall short, incident response must focus on rapid detection, containment, and recovery.
Effective detection: Continuous monitoring is vital, particularly using User and Entity Behavior Analytics (UEBA) to spot suspicious actions. These include recurring login failures, access from unusual locations, or privilege escalations.
Containment and remediation: Immediate actions include system isolation or account disablement. If a credential is confirmed compromised, remediation requires quick password resets for those accounts.
Adaptive authentication: Implemented within a Zero Trust Architecture (ZTA), this dynamically varies access controls based on real-time risk (e.g., location, device health, behavior patterns). This continuous verification limits the attacker's ability for lateral movement.
» Make sure you understand the difference between leaked credentials and compromised accounts
What Lesser-Known Practices Can Strengthen Identity Security?
These practices tend toward proactive risk identification and the dynamic controls envisaged by the ZTA.
Dark web monitoring: A crucial proactive measure is monitoring dark web forums for organization-specific activity. Organizations should check if credentials have been seen in a data breach when users create or change their passwords to discourage reuse.
Layered adaptive authentication: Access requirements are adjusted dynamically based on contextual information (behavior, location, device health). This is often augmented by UEBA to spot anomalies indicative of compromised credentials or insider threats.
Privileged access governance: Implementing Just-in-Time (JIT) access ensures permissions are granted only when necessary and for a limited time. Active review and management of high-privilege service accounts are also essential to mitigate risks.
» Learn more: Darknet markets explained
Secure Credentials
Reduce risk from phishing, AI attacks, and stolen passwords with stronger identity controls.
FAQs: Human Risk and Social Engineering
What New Attacker TTPs Amplify Human Risk?
The greatest cyber risk remains the human element. AI-enhanced tools are significantly increasing the scope and sophistication of social engineering attacks, intensifying the challenge for CISOs.
Emerging attack techniques to watch:
AI-driven impersonation: Attackers are leveraging AI to automate highly personalized spear phishing and Business Email Compromise (BEC) campaigns. KELA observed a 200% increase in mentions of malicious AI tools in 2024 on cybercrime forums.
Deepfake scams: The trade of deepfake tools on dark web forums is rapidly growing, with criminals using them to trick victims through highly realistic voice, video, or written impersonations.
Subject AI attacks: This emerging threat vector uses AI-generated content to target individuals associated with an organization, making the organization the subject of the attack, though not the direct network target.
Example: On January 7, 2025, someone on the Russian-speaking cybercrime forum Exploit shared a guide on using AI to clone a CEO’s voice. They used it to call an employee and request an urgent wire transfer.
These transformations require immediate action from CISOs to integrate AI attack strategies into security awareness programs, as identity and access control remain the top priority.
» Did you know? Cybercriminals now exploit generative AI
What Preventive Approaches Help CISOs Reduce the Risk of Social Engineering?
Security awareness training is the core defense against social engineering risks. While general training on low-tech techniques can reduce successful attacks, job-function-specific training offers better alignment with corporate goals.
Key preventive strategies:
- Email filtering: Email is the number-one attack vector, making robust filtering essential. AI-powered security tools provide real-time visibility and augment detection capabilities to catch sophisticated phishing attempts.
- Gamified training: CISOs should build a security culture using tools and gamification, engaging users through awarding points, creating leaderboards, and simulating attacks for better knowledge retention.
- Continuous education: Education must be the strongest support for CISOs in the ongoing battle against phishing and social engineering.
» Find out how agentic AI is transforming cybersecurity
When an Employee Falls Victim, What are the Response Strategies?
Once an employee is victimized, the CISO must immediately enact the Incident Response Plan (IRP) to control the crisis and start the investigation.
Steps for effective incident response:
- Isolate and disable: The immediate effort must aim to control the crisis by isolating any affected systems and disabling compromised accounts to halt the attack's progress.
- Evidence collection: Forensic evidence must be preserved, and the investigation will try to ascertain the primary known cause of the incident.
Long-term recovery and resilience:
- System remediation: Recovery involves restoring normalcy post-incident, which may include system rebuilds and the reset of compromised accounts.
- Post-incident review: The CISO should establish a review mechanism to identify lessons learned, which leads to iterative improvements of existing defenses.
- No-blame culture: The organization should maintain a no-retaliation policy for reporting incidents and develop a review culture that embraces not blaming the victim, which builds confidence.
FAQs: Technology & Operations
How Do Attacker TTPs Complicate Patch Management?
New attacker TTPs are undermining traditional protective methods and increasing the difficulty of infrastructure defense and patch management. This necessitates a shift from reactive patching to a proactive, risk-based approach through Continuous Threat Exposure Management (CTEM).
Key TTPs undermining defense:
Supply chain poisoning: Attackers insert malicious code directly into software components during development. Since the vulnerability is foundational, this can render traditional patching ineffective.
Legacy system technical debt: Obsolete operating systems running critical infrastructure (OT) and legacy systems are costly to manage and fundamentally prevent effective patching.
» Learn how supply chain threat intelligence strengthens your security posture
What Preventive Measures Reduce Exposure?
CISOs must modernize their security architecture with quantitative risk management to minimize infrastructure exposure. The foundational strategy involves adopting ZTA, which shifts defense from the perimeter to total verification of identity and access at the point of data.
Most effective preventive measures:
Implement network segmentation: Segmentation and microsegmentation are vital. They help control traffic, contain malicious software, and significantly limit lateral movement to reduce the blast radius of an attack.
Prioritize risk for patching: CISOs must prioritize assets for protection. Threat and Vulnerability Management (VTM) should use risk-based prioritization frameworks, focusing efforts against high-risk findings and critical IP ranges instead of attempting to patch every known vulnerability.
Automate security operations: Automation is critical for efficiency and accuracy. Automating security tasks streamlines processes and minimizes human error in monitoring, data collection, and response processes.
» Not convinced? Here are the reasons you need cyber threat intelligence
If Vulnerabilities Are Exploited Before Patching, How Should CISOs Respond?
When an unpatched flaw is exploited, the CISO's primary focus must be on quick containment and intense investigation to stop the spread of the attack.
Key Response Steps:
Containment and forensics: Immediately isolate affected systems and deactivate any compromised accounts. Conduct a thorough forensics exercise to determine the "true root cause."
Vendor coordination: Coordination with major third-party suppliers is essential, especially if third-party components were involved.
Regulatory reporting: Legal counsel must be engaged immediately to navigate complex regulatory reporting obligations, such as the SEC requirements mandating disclosure of material cyber incidents within four business days of their determination.
» Make sure you know the difference between a vulnerability, a threat, and a risk
Respond Faster with KELA
When vulnerabilities are exploited, KELA provides real-time threat intelligence and actionable guidance to contain attacks quickly.
How KELA Cyber Addresses These Threats
Securing your business's digital identity and authentication processes is more critical than ever as cyber adversaries evolve their tactics. As this guide shows, the modern CISO is fighting a battle fueled by stolen credentials, AI-driven scams, and lightning-fast exploitation of unpatched flaws.
To stay ahead, a reactive, perimeter-focused approach is no longer sufficient. You need proactive Cyber Threat Intelligence (CTI) that provides real-time visibility into the dark web where your credentials and vulnerabilities are being traded and weaponized. We at KELA specialize in transforming raw cybercrime chatter into actionable intelligence that directly addresses these risks.
» Ready to get started? Contact us to learn more about our cyber threat intelligence services
FAQs
How quickly should we respond to credentials appearing on the dark web?
You need to reset compromised credentials within 24 hours of detection. Cybercriminals typically attempt to use stolen credentials within hours of obtaining them, making rapid detection and response critical for breach prevention
How do we protect against AI-powered social engineering?
Implement phishing-resistant MFA and conduct role-specific security training that includes deepfake scenarios. Traditional security awareness training isn't enough when attackers use AI to create convincing impersonations of executives and vendors.
Why are infostealers more dangerous than traditional malware?
Infostealers silently harvest stored credentials, session tokens, and browser data without triggering typical malware alerts. With 4.3 million machines infected in 2024, they're fueling a massive underground economy of compromised access.
How often should we run dark web monitoring scans?
Continuous real-time monitoring is essential, not periodic scans. Credentials are weaponized within hours of exposure, making weekly or monthly checks practically useless for prevention.
