Identité sécurisée, entreprise protégée.

Mike Berthold, senior solutions architect at Okta, makes the case that identity is now the primary attack surface: over 80 percent of breaches involve identity, detection still takes roughly 292 days on average, and identity-based attacks rose about 200 percent in a year. He walks through four common attack types. Credential stuffing has moved from noisy bursts to slow trickling and password spraying to stay under detection thresholds, fed by an underground economy that validates and resells breached credential lists. Info-stealer malware harvests both passwords and session cookies at scale, which argues for device-bound identity and shorter, risk-scaled session lifetimes. Adversary-in-the-middle phishing kits, sold as a service for roughly 120 to 250 dollars, proxy real bank login pages convincingly, countered by phishing-resistant, domain-bound MFA, brand monitoring and user education. Voice-based social engineering targets help desks and depends entirely on process discipline rather than technology. A long audience Q&A covers passwordless rollout, email as an identifier, passkeys as an emerging standard, and applying the same four-vector framework to non-human and ephemeral identities.