What if the most dangerous identity in your organisation isn’t a person? What if it’s a machine, a service account, an API key or, increasingly, an AI agent; with more access than any employee could ever have?

As Director of the KPMG Ethical Hacking team, I spend my time thinking like an attacker: finding the paths into organisations that defenders hope don’t exist. Increasingly, those paths lead through identity.

In this presentation, I’ll take you behind the scenes of modern cyber attacks, using examples of our work and case studies; showing how hackers exploit both human and non-human identities to “get in, move around, escalate privileges” and ultimately achieve their objectives.

We’ll explore the techniques behind compromising human identity, from phishing and social engineering to deep fakes and session hijacking. We’ll also look at the rapidly expanding world of machine identities: service accounts, secrets, APIs, workloads, bots and AI agents; and why these can become an attacker’s most valuable asset.

The uncomfortable reality is that attackers don’t always need to break security controls and find vulnerabilities. Often we simply become an identity you already trust.