This graphic from the Mandiant M-Trends 2026 report has stuck with me since I first saw it. It shows the breakdown, for cloud intrusions that they investigated, of the initial access vectors attackers used. Do you notice a pattern?
Almost all these access vectors are attacks on human weaknesses. Email- and especially Voice Phishing are social engineering attacks. Third-Party Compromise just kicks the can somewhere else, where the set of access vectors probably looks the same. Stolen Credentials point to either mishandled credentials (like committing them to a public repo), credential reuse, or (best case) an intrusion somewhere else that had the credential stored. Insider Threat is either someone who either turned against the organization, or was induced or forced to. Only 6% Exploit!
This strongly implies that technology will not (fully) solve the problem of Initial Access into production environments. Requiring strong MFA? Sure, it can prevent phishing, but there are a lot of workarounds to deal with the inconvenience (and requirement for human interaction) of MFA, in particular API keys that don't have an MFA in the loop.
More to the point: why didn't MFA (which is ubiquitous at this point) prevent access in these cases? Was SIM cloning involved? Were MFA codes socially engineered out of the user? What if the user is fully executing the malicious actions under the direction of the attacker?
I'm speculating a lot here since I don't have access to the raw data that went into this visualization. But I am reasonably confident that it's not just a matter of closing technical gaps. We're dealing with human frailty here.
One talk I saw at Security BSides Las Vegas this year was by the Cognitive Security Institute, who are doing great work using Threat Modeling and Vulnerability Management techniques to map out the human mind's attack surface in a Cognitive Attack Taxonomy.
They have also extended the OSI model (Layers 1-7) to account for the human on top:
Layer 8: The human layer at which heuristics, biases, and other psychological influence techniques operate. Social engineering or influence operations function at this layer.
Layer 9: The organizational layer, manipulation techniques at this layer operate through policy functions.
Layer 10: The legal layer, manipulation at this layer occurs through legislative processes or court cases.
I have been incorporating human, policy and legal factors in my system-oriented threat modeling for years, which I originally based on Nancy Leveson's work on Safety Engineering. She documented a methodology in her book "Engineering a Safer World" that encourages us to think holistically about systems, including the constraints imposed by corporate leadership, company culture, laws and regulatory systems, etc. These factors can improve or degrade security, and can represent important controls that are not captured in the technical systems themselves. (She also wrote the more recent "Introduction to System Safety Engineering" which I haven't read yet, and might supersede the earlier book). More recently I've adopted the PASTA method, which is certainly broad enough building a control architecture based on Leveson's method.
Taking human factors into account is clearly important, and when every technical control is in place, humans remain as the attack surface of choice for attackers.
What does this have to do with File Integrity Monitoring (the current focus of our company)? As I've argued before, Persistence is the next defensible stage after Initial Access. And FIM is (or should be) the primary means of detecting system-level Persistence in cloud environments, which is why we're working on it. If we're depending on humans to be the front line of Initial Access defense, we will (sometimes) be disappointed, so we need to beef up our technical controls at the Persistence stage. By relying on an AI analyst for initial triage, we avoid alert fatigue issues and forward only the useful alerts to humans.