At 2:13 a.m., nobody wants a login alert.
That is not because security people are lazy. It is because a login alert at 2:13 a.m. is rarely considerate enough to arrive with useful context. It just appears. Usually a username, IP address, a location that may or may not mean anything, and even a device fingerprint if you are lucky. The kind of detail that looks complete and harmless unless you actually bother to care that late at night.
So there you are, staring at a screen in the blue light of a late shift, trying to decide whether this is one of those harmless oddities modern systems produce in bulk or the beginning of a bad day that has simply arrived way before dawn.
The user is in Nairobi. The login came from somewhere else. The password was valid. MFA did not scream ‘sus’. The cloud apps opened without objection. There’s no crazy explosions, no ransom note and no dramatic malware artifact with a villainous filename. Just a quiet and very normal looking access.
Unfortunately…that is exactly why it is dangerous.
Security teams have been trained for years to look for irregularities, noisy patterns, big alerts, malicious binaries, beaconing or privilege escalation. The sort of evidence that is immediately flagged. However, identity-led intrusions are much more annoying than that. They seem and act normal just long enough to buy time for the attacker.
Mandiant Inc., a cybersecurity Google subsidiary, says stolen credentials rose to the second most common initial infection vector in its 2025 findings, accounting for 16% of investigations. IBM reported an 84% increase in emails delivering infostealers in 2024. Verizon’s 2025 DBIR says credential abuse remains the most common initial access vector. That is a very elegant way of saying that, despite advanced detection and offensive techniques today, attackers are still choosing to come in through the front door, not the upstairs cyber window.
That is why identity-led intrusions are so irritating. They exploit the part of modern security that depends on trust operating at scale. We trust the login, then the token, then the session, then the cloud application, then the familiar pattern of behavior. By the time someone notices that the pattern is off, the attacker may already be browsing folders, exporting mail, registering persistence, or quietly setting up the kind of headache that only becomes visible in a retrospective document titled something like lessons learned.
Which is corporate language for “we should have taken that weird little thing more seriously.”
This is also where a lot of organizations flatter themselves. They buy MFA, run awareness training, and add a flurry of detection rules. They tell themselves the basics are covered, which is fine, as far as it goes. But the real test is not whether the organization owns controls. The real test is whether the team can tell the difference between a valid login and a hostile one using valid access.
That is a harder problem, that requires context, speed and people who know how identity actually behaves in the environment, not just what the policy says should happen. And it requires the confidence to challenge the very seductive assumption that normal-looking means safe.
This is where cyber drills become efficient and incredibly useful or absolutely useless.
A bad exercise asks whether the team knows what credential theft is. Wonderful. Gold star. A better exercise starts with a simple login and makes the telemetry annoyingly incomplete and most importantly, accurate. The user is half awake. The analyst is unsure. The SOC manager wants evidence. The attacker is already moving. Now what?
That is the moment worth testing.
Can the SOC connect the signal fast enough? Can identity and endpoint teams coordinate without turning Slack into a he-said she-said pissing contest? Can leadership make a decision before the event changes shape and escalates? Can somebody say, with a straight face and enough authority to matter, “No, this is not a harmless anomaly. Contain it”?
That is where real readiness begins. Its not about knowing the theory. Its about making the call while the facts are still blurry.
And that, frankly, is why a quiet login at 2:13 a.m. is so much worse than dramatic malware.
Malware has the decency to at least look suspicious. A stolen identity usually arrives dressed in legitimacy.