The threat model for customer identity changed faster in the last eighteen months than in the decade before it. Two things moved at once. Attackers got better at finding the flaw nobody patched, and they kept reaching for stolen credentials once they were inside. Artificial intelligence made both cheaper to do at scale.

For any security leader still running customer login on home-grown or lightly maintained single sign-on, that combination is the problem. Custom identity code was defensible when the attack surface moved slowly. It is a harder position to hold when the offence is automated and improving weekly, and when your defence depends on how fast your own team can patch.

Where the attacks are now

Verizon’s 2026 Data Breach Investigations Report, covering incidents from November 2024 to October 2025, records the clearest shift in the report’s nineteen-year history.

Exploited vulnerabilities are now the most common way in. They accounted for 31 per cent of breaches as the initial access vector, up from 20 per cent the year before, displacing credential theft from the top spot for the first time since the report began. The cause is on the defending side. Only 26 per cent of vulnerabilities in CISA’s Known Exploited Vulnerabilities catalogue were fully remediated, down from 38 per cent, and the median time to full remediation rose from 32 days to 43 days. Verizon attributes the deterioration to sheer volume, and expects AI-assisted vulnerability discovery to add to the burden rather than relieve it.

Credentials remain what attackers reach for once inside. Counted at any point in the breach progression rather than only the first step, credential abuse appears in 39 per cent of breaches, more than any other vector. Stolen credentials are still the leading action in attacks on basic web applications, where credentials make up 52 per cent of the data taken. Infostealer malware keeps the supply constant: 73 per cent of ransomware victims had an associated credential leak in the preceding year, and half of those saw it within 95 days of the attack.

Multi-factor authentication is being stepped around rather than broken. Adversary-in-the-middle proxy kits intercept the authenticated session after MFA has completed and lift the session token directly. Prompt-bombing floods a user whose credentials the attacker already holds until one approval is accepted. The second factor did its job in both cases. The attacker went around it. Where MFA is missing altogether it tends to stay missing: only 23 per cent of third-party organisations fully remediated known MFA gaps on their cloud accounts, and 37 per cent had an administrator account with MFA disabled on an infrastructure service.

Synthetic identity has become a commodity. Deepfake audio and video moved from proof of concept to operational tool. Arup confirmed a loss of around 25 million US dollars after attackers used a deepfake video call to impersonate its chief financial officer and colleagues, assembled from publicly available recordings. Voice cloning now needs only seconds of source audio. Any authentication flow that leans on voice biometrics or human verification is contestable.

Why custom SSO struggles to keep pace

None of these attacks is exotic. Defending against them is a sustained engineering commitment, and that is where home-grown identity tends to fall behind.

Patch cadence. This is now the leading route in, and it is the one a self-maintained stack is least equipped to handle. Authentication components ship security fixes on their own schedule, and the exploitation window is short. Even actively maintained open-source identity platforms carry a steady stream of authentication-bypass advisories that demand prompt upgrades, sometimes several in a single release. A custom stack is only as current as the last time someone had time to maintain it.

Adaptive response. Defending against prompt-bombing and session hijacking requires risk-based step-up authentication, phishing-resistant factors, and session controls that react to anomalies. These are difficult to build well and expensive to keep current. Static MFA bolted onto a custom login does not provide them.

Concentration of knowledge. Home-grown identity usually lives in the heads of one or two engineers who have other primary work demanding their attention. Identity maintenance is rarely anyone’s job description, and it slips when the sprint gets tight. When identity is a security-critical, always-on system facing an automated adversary, a two-person dependency is an operational risk in its own right.

Opportunity cost. Every sprint spent hardening login is a sprint the business does not get for the things it sells. The maintenance burden compounds, and it competes directly with what the business has asked the team to deliver.

What a current defence looks like

The organisations holding up best have moved customer identity onto a managed, standards-based platform where keeping pace with the threat is the vendor’s full-time job rather than a side task. In practice that means continuous patching of the authentication layer, risk-based and step-up authentication as a native capability, phishing-resistant and verified electronic identity options, and session and token controls designed for adversary-in-the-middle conditions. For European organisations it also means keeping customer identity data in-jurisdiction, under the data-residency and sovereignty requirements that increasingly apply.

This is the case for Ubisecure’s approach to customer identity and access management: one platform for the full external identity lifecycle, built on OpenID Connect, OAuth 2.0, CIBA and SAML 2.0, with strong authentication and European data residency, deployable in cloud, on-premises, or hybrid.

Start with an honest audit

Before you weigh any platform, it is worth knowing exactly where your current login stands. Which authentication CVEs are you carrying unpatched, and how many releases behind are you? Can your MFA adapt to risk, or only prompt? Are your session controls current? How exposed are you to AI-driven credential and impersonation attacks? And what happens to your patch cadence when the one engineer who understands it is unavailable?

We have put those questions into a structured self-assessment for security leaders.

Download the in-house identity risk audit: a practical guide for CISOs.

Sources verified for this article