Why is There a Rise in Identity-Based Attacks?

BetaNews recently asked this question in a detailed Q&A. The answers should concern every enterprise leader. The rise of identity-based attacks isn’t just a trend; it’s now the primary way cybercriminals get in. Attackers are no longer brute-forcing firewalls or cracking encryption. They’re simply logging in as you.

The article highlights a stark reality. Stolen credentials, phishing, social engineering, MFA fatigue, and session hijacking are now standard playbooks for attackers. Generative AI has supercharged this, making phishing sites and fake login pages virtually indistinguishable from the real thing. Once inside, attackers move laterally, escalate privileges, and stay hidden for weeks or months.

This is why legacy MFA and authenticator apps are failing. BetaNews points out that identity is now the real attack surface, and traditional methods of confirming identity—passwords, SMS codes, push approvals—are exactly what attackers target. The more we rely on these outdated methods, the easier we make it for threat actors to succeed.

This is where Token BioStick and Token Ring are the direct answer to what BetaNews describes. Token products are built for the world of identity-based attacks. Here’s why:

1. They make stolen credentials worthless. Even if a username and password are stolen or reset through social engineering, Token won’t authenticate without the registered fingerprint.
2. They stop phishing and spoofing completely. Token cryptographically binds every login to the legitimate domain. If a fake site tries to request authentication, Token rejects it automatically.
3. They eliminate human error. There is no code to relay, no push notification to approve, no judgment call for the user to make.
4. They neutralize man-in-the-middle relay attacks. Even sophisticated real-time phishing kits can’t relay a Token-authenticated session because the device will only sign for the legitimate site.

The BetaNews article is right: attackers are focusing on identity because it is the weakest link. But it doesn’t have to be. Identity can be made phishing-proof, spoof-proof, and resistant to social engineering.

Detection after compromise is important, but prevention at the authentication layer is what will actually change the game. Token closes the identity attack vector completely—exactly what is needed to stop the rise of these attacks for good.