TL;DR

• Attackers are shifting away from noisy, traditional attack methods  
• Identity abuse is now one of the most common entry points  
• Supply chain and third-party access create significant risk  
• Cloud and SaaS environments introduce new attack surfaces  
• UK and New Zealand organisations face the same evolving threats  

Why Cyber Attacks Are Changing 

When most organisations think about cyber attacks, the focus is still on phishing, ransomware, and exploiting vulnerabilities in infrastructure. 

While those risks remain, the reality is that attackers are evolving. Once you move beyond social-led attacks and traditional web or infrastructure vulnerabilities, the threat landscape becomes far more subtle, operational, and difficult to detect. 

Across both the UK and New Zealand, we are seeing a consistent shift towards attacks that rely less on breaking in, and more on logging in, blending in, and staying unnoticed. 

This is an important market insight. The attack surface has not just expanded, it has changed in nature. 

Identity Abuse As A Primary Attack Vector 

One of the most significant developments is the rise of identity-based attacks, where attackers do not exploit systems, they exploit access. 

Common techniques include: 

• Credential stuffing using breached passwords  

• MFA fatigue and push-notification abuse  

• OAuth token abuse in SaaS environments  

• Session hijacking using stolen cookies  

These attacks are effective because they: 

• Bypass traditional perimeter controls  

• Appear as legitimate user activity  

• Require behavioural detection rather than signature-based tools  

Key takeaway: Identity is now the primary control plane in cyber security. 

Supply Chain And Third-Party Risk 

Another growing vector is the exploitation of trusted third parties. 

Attackers are increasingly targeting: 

• Managed service providers (MSPs)  

• Software update mechanisms  

• Partner API integrations  

• Vendor credentials reused across environments  

The impact can be significant: 

• A single compromise can affect multiple organisations  

• Access often comes with elevated privileges  

• Responsibility for monitoring is often unclear  

This is particularly relevant in sectors such as education, healthcare, and local government, where ecosystems are highly interconnected. 

Living Off The Land: Abuse Of Legitimate Tools 

Not all attacks involve malware. 

In many cases, attackers use legitimate tools already present in the environment, a technique often referred to as “living off the land”. 

Commonly abused tools include: 

• PowerShell  

• WMI  

• PsExec  

• Remote monitoring and management (RMM) platforms  

• Backup and recovery systems  

These attacks are difficult to detect because: 

• The tools are trusted  

• Activity resembles normal administrative behaviour  

• Traditional antivirus solutions often see nothing suspicious  

Key takeaway: Detection relies on behaviour, not signatures. 

Data Exfiltration Without Ransomware 

Not every attack ends with disruption or encryption. 

Increasingly, attackers focus on data exfiltration, often without triggering immediate alarms. 

This includes: 

• Silent data harvesting  

• Exploiting cloud misconfigurations  

• Data leakage through shadow IT  

• Large-scale API scraping  

This trend is growing because: 

• Monetising data is often easier than disrupting systems  

• Organisations may not detect the breach immediately  

• Regulatory and reputational consequences appear later  

This is especially relevant for SaaS-heavy organisations across both the UK and New Zealand. 

Insider And Privilege-Based Threats 

Not all risks come from external attackers. 

Insider-adjacent threats, whether intentional or accidental, continue to play a significant role. 

Common patterns include: 

• Over-privileged user accounts  

• Contractors retaining access longer than required  

• Weak joiner, mover, leaver processes  

• Credential sharing under operational pressure  

These risks are attractive to attackers because: 

• Privilege already exists  

• Monitoring is often limited  

• Investigations can be sensitive and slow  

Key takeaway: Even strong security controls can fail if privilege management is weak. 

Cloud Control-Plane Attacks 

One of the fastest-growing areas globally is cloud control-plane attacks. 

Rather than targeting workloads, attackers target the systems that control them. 

Examples include: 

• IAM roles and permissions  

• API keys and tokens  

• Automation accounts  

• CI/CD pipelines  

The potential impact is significant: 

• Full environment compromise  

• Persistent access without malware  

• Ability to manipulate or delete logs  

As organisations across the UK and New Zealand continue to adopt cloud-first models, this becomes an increasingly critical area. 

What This Means for UK and New Zealand Organisations 

Across both regions, the pattern is clear. 

Attackers are optimising for: 

• Speed  

• Stealth  

• Legitimacy  

This means: 

• Less reliance on malware  

• Greater focus on identity and access  

• Increased abuse of trusted systems  

Many organisations are still heavily focused on: 

• Network security  

• Email security  

• Perimeter controls  

While these remain important, they are no longer sufficient on their own. 

The Bigger Picture 

The cyber threat landscape is not just expanding, it is becoming more sophisticated in how it operates. 

If organisations are not actively monitoring: 

• Identity behaviour  

• SaaS access patterns  

• Privilege usage  

• Data movement  

They risk missing a significant portion of modern attack activity. 

This is not about replacing existing controls, but about recognising where the real risks are now emerging. 

👉 Contact us to explore how your identity and access approach aligns with today’s cloud-first environments 

📞 UK +44 (0) 113 341 0123

📞 NZ +64 (0)9 802 2444

📧 hello@itogether.com

FAQs

What are the most common cyber attack vectors today? 
Beyond phishing and vulnerabilities, common vectors include identity abuse, supply chain attacks, and cloud control-plane exploitation. 

Why are identify-based attacks increasing?

Because they allow attackers to access systems using legitimate credentials, making detection more difficult. 

What is a supply chain cyber attack?

It involves compromising a trusted third party to gain access to multiple organisations

How do cloud environments change cyber risk? 
They introduce new attack surfaces such as identity management systems, APIs, and automation tools.