← Exposures · one of nine layers
Identity exposure
Identity is an exposure class you can analyze with the same rigor as CVEs — here is who attacks identity, which weaknesses admit them, and which controls actually cover it.
19 of the 246 victim-carrying actors we track used an identity technique — that is 19 of the 22 whose ATT&CK TTPs are mapped.
12,399 identity-weakness CVEs · 129 identity-using actors · 830 IA/AC control mappings (449 IA, 381 AC).
Last updated: 23 August 2026 00:24 UTC . This is identity exposure analysis from public data — not an identity posture product; we never see your IdP.
Who attacks identity
Of the 129 tracked actors with at least 10 mapped ATT&CK techniques and at least one identity technique, these lean hardest on the identity layer — ranked by the share of their toolkit that is credential access or identity abuse.
| Actor | Identity techniques | Share of toolkit |
|---|---|---|
| ShinyHunterscriminal | 2 of 6 | 33% |
| scattered lapsus$ hunterscriminal | 2 of 6 | 33% |
| UNC6040unknown | 1 of 5 | 20% |
| Leafminerunknown | 5 of 26 | 19% |
| 2016 Ukraine Electric Power Attackstate | 4 of 28 | 14% |
| Salt Typhoonstate | 3 of 23 | 13% |
| Indrik Spiderstate | 6 of 47 | 13% |
| LAPSUS$criminal | 8 of 63 | 13% |
| Leviathan Australian Intrusionsstate | 4 of 32 | 12% |
| FIN5unknown | 2 of 16 | 12% |
| Storm-0501unknown | 7 of 62 | 11% |
| Fox Kittenstate | 6 of 54 | 11% |
Identity techniques = ATT&CK Credential Access (TA0006) plus Valid Accounts, Account Manipulation, and Create Account. How actor data is built.
Which weaknesses admit them
12,399 CVEs cite an identity-weakness CWE (broken/missing authentication, unprotected or hard-coded credentials, session flaws, weak recovery) — 3,050 published in the last year, and 114 confirmed exploited in CISA KEV. The highest composite-risk entries:
| CVE | Identity CWE | CVSS | Peak EPSS | Risk |
|---|---|---|---|---|
| CVE-2025-32433 KEVHigh EPSS | CWE-306 | 10.0 | 0.9859 | 100 |
| CVE-2025-34028 KEVHigh EPSS | CWE-306 | 10.0 | 0.9766 | 100 |
| CVE-2020-6287 KEVHigh EPSS | CWE-306 | 10.0 | 0.9752 | 100 |
| CVE-2021-22893 KEVHigh EPSS | CWE-287 | 10.0 | 0.9700 | 100 |
| CVE-2024-51567 KEVHigh EPSS | CWE-306 | 10.0 | 0.9431 | 100 |
| CVE-2021-30116 KEVHigh EPSS | CWE-522 | 10.0 | 0.9355 | 100 |
| CVE-2026-20182 KEVHigh EPSS | CWE-287 | 10.0 | 0.9152 | 100 |
| CVE-2024-46506 High EPSS | CWE-306 | 10.0 | 0.9149 | 100 |
| CVE-2023-27482 High EPSS | CWE-287 | 10.0 | 0.9061 | 100 |
| CVE-2026-20127 KEVHigh EPSS | CWE-287 | 10.0 | 0.8824 | 100 |
Cohort = CVEs whose NVD weaknesses include CWE-287, CWE-306, CWE-522, CWE-798, CWE-384, CWE-613, CWE-640, CWE-1390, CWE-1391, CWE-259, CWE-521. Risk is the site-wide composite — how it works.
Which controls cover it
How the cross-walk corpus grades the two NIST 800-53 families that own the identity layer. Graded mappings carry a human-QA'd extent verdict; "none" means the pair was assessed and found not to cover — reported, not hidden. STIG-derived rows come from DISA's CCI mapping and carry no grade.
| Family | Full | Mostly | Partial | None | STIG-derived | Total |
|---|---|---|---|---|---|---|
| IA — Identification & Authentication19 controls mapped | 18 | 27 | 215 | 189 | 0 | 449 |
| AC — Access Control26 controls mapped | 17 | 12 | 154 | 198 | 0 | 381 |
Browse the controls at /controls/ and every graded mapping at /xwalks/.
What it costs when it fails
- SEC 8-KSTRYKER CORP — material cybersecurity incidentG1055Apr 2026
- SEC 8-KMICROSOFT CORP — material cybersecurity incidentG1004Mar 2024
- SEC 8-KMICROSOFT CORP — material cybersecurity incidentG1004Jan 2024
Classification is precision-over-recall: a filing is flagged only when its stored text matches a credential/identity keyword (0 today) or its attributed actor's ATT&CK toolkit includes an identity technique (3 today). Most 8-K filings disclose no vector at all, so identity-vector breaches are undercounted here — never overcounted. All tracked filings: /breaches.html.