Microsoft just killed the phishable second factor. The attackers had already moved on.
Two things happened this week that, taken together, tell you where the identity fight goes next. On Monday, Microsoft announced that passkeys become the default authentication experience in Entra ID from 1 September, with native SMS and voice MFA retired outright in February 2027. A day later, ReliaQuest published research on two phishing kits ( Jalisco and OmegaLord ) that are already engineered around MFA rather than through it. Jalisco doesn’t steal your password at all: it abuses Microsoft’s OAuth device-code flow, generating fresh authorization codes in real time and walking the victim through a legitimate Microsoft login page. The attacker ends up holding OAuth tokens, not credentials.
Read those two events side by side and the passwordless thesis looks both validated and incomplete. Passkeys-by-default is a genuine policy tailwind, it will gut the economics of credential-harvesting kits at Microsoft’s scale, which is most of the enterprise. But the kits ReliaQuest analyzed show the attacker community isn’t waiting for September. Once credentials stop being the prize, tokens and sessions are. That’s where the next defensible product sits, and it’s worth noting almost nobody owns that layer yet.
And in the background, the month-long M&A wave in non-human identity keeps looking less like coincidence and more like a category being born. More on that below.
What moved and why it matters
Non-human identity became an M&A category in the space of a month.
Three deals landed within days of each other in mid-June, and having sat with them for a few weeks I think the pattern matters more than any single transaction. 1Password bought Apono (Calcalist puts it at $250–300M; officially undisclosed), SailPoint bought Entro (~$200M per Calcalist, closed 29 June), and Cisco announced it would fold WideField into Splunk’s Agentic SOC. Add Zscaler’s May purchase of Symmetry Systems (terms undisclosed) and you have four platform incumbents buying the same thing in six weeks: governance for the credentials that humans, machines and AI agents hold in production.
Each deal is a bet on the same pain signal, and it’s one operators have been voicing for months : agents now hold more standing access than the senior engineers who built them, with no scoping, no rotation, no audit trail. Capital caught up with that reality all at once.
For founders: “non-human identity” is no longer a feature bullet inside an IAM roadmap. It’s a standalone category with at least four acquirers already transacted, which means the incumbents have decided to buy the best point solution rather than build one. For investors, the discipline this forces is sequencing. Every one of these was a tuck-in, not a standalone scale-up, so the multiple that matters is the strategic-buyer multiple, not the growth-equity one. The founders who win this window are the ones who can make a platform look inevitable before the next incumbent decides to build instead.
Watch who moves next. Okta and Microsoft have so far chosen to build rather than buy : Entra Agent ID on one side, Okta’s organic agent-identity push on the other. If either of them reverses and writes a check, the window for point solutions starts closing.
The RAG layer is quietly becoming the new enterprise perimeter.
This is the fastest-accelerating theme on our pain radar (+14x in 90 days), and the technical evidence backs the noise. A recent academic study of multitenant retrieval systems found that ungated retrieval leaks cross-tenant data in 98–100% of probes — the core problem being that similarity search has no concept of authorization, so a document can be highly relevant to your query and belong to someone else’s tenant. Retrieval pipelines that don’t re-check document-level permissions before feeding context to a model are, structurally, an access-control bypass.
Capital is already circling. Cyera raised a $300M Series G at $12B in June, on top of a $400M round at $9B in January. Zscaler bought Symmetry Systems precisely for its access graph. Snyk picked up Invariant Labs back in mid-2025 for its agentic-security research bench. And Barcelona’s NeuralTrust closed a €17.2M seed in June — the largest cybersecurity seed ever raised by an EU company — for its AI-agent governance gateway, one layer up from retrieval but attacking the same trust gap. This is the category with no default winner yet. Worth building a position before one emerges.
AI writes code faster than anyone can trust it.
The numbers stopped being anecdotal a while ago; what’s changed is that nobody disputes them anymore. Veracode found 45% of AI-generated code ships with an OWASP Top-10 vulnerability (over 70% for Java). Apiiro’s Fortune-50 study logged 10x more security findings and a 322% jump in privilege-escalation paths in AI-touched repos. GitClear’s 211-million-line analysis found copy-paste overtaking refactoring for the first time on record. The conclusion : batch, human-paced code review is structurally the wrong tool for the job. Review has to move to commit-time and match generation speed, or the debt compounds silently.
570 patches in a single Tuesday means CVSS-based triage is officially dead.
Microsoft’s July Patch Tuesday was the largest on record : 570 flaws (622 by CrowdStrike’s count), three zero-days, two already exploited in the wild, including an AD FS privilege-escalation bug surfaced during real incident response. Here’s the detail most coverage buried: Microsoft attributes part of the volume to an AI-powered vulnerability-discovery system it deployed across the Windows codebase. In other words, this isn’t an anomaly. It’s the new steady state. AI-driven discovery will keep outrunning human triage, permanently, which is exactly why exploitation-first prioritization (CTEM) is the durable category here and another vulnerability scanner is not.
On the radar
MCP / tool security is the next seam to get priced.
Still the quiet cousin of the headline categories , 48 posts in 90 days on our radar, +7x acceleration, well behind RAG’s noise but growing off a lower base. Which is exactly why to track it now, before the first acquisition. The MCPTox benchmark tested tool-poisoning attacks (malicious instructions hidden in a tool’s own metadata, steering agents before a user ever types a prompt) against 45 live MCP servers and 20 agent models: average attack success of 36.5%, rising to 72.8% for the most susceptible models. The uncomfortable finding is that more capable models are more vulnerable, because the attack exploits their superior instruction-following. This is the non-human-identity thesis one layer down the stack , the tool-discovery layer instead of the credential layer.
Shadow AI governance is where CISO budget authority is quietly shifting.
Gartner has called securely embracing shadow AI the most important criterion for CISO performance reviews this cycle, and the 2026 DBIR data explains why: regular AI use on corporate devices tripled in a year, from 15% to 45% of employees, two-thirds of it through personal accounts the enterprise can’t see. Shadow AI is now the third most common non-malicious insider action in the DLP dataset, a fourfold increase year over year, and the number-one data type flowing out is source code. AI-usage-control tooling that plugs into existing proxies and DLP stacks is the near-term wedge. Expect this to be a live funding category within two quarters.
À la semaine prochaine, F.