Identity.

Stolen passwords, phished one-time codes, push attacks that spam approval requests until someone taps yes, help desk calls that talk an agent into a reset. Once an attacker holds a valid account, every tool trusts them.

AI makes this cheap. It runs password spraying across thousands of accounts, writes convincing reset requests and tries leaked passwords on every sign-in, from payroll to payments. Session tokens stolen from browsers skip multi-factor checks entirely. And service accounts or API keys with too much power are the quietest way in.