IN Groupe Outlines Workforce Identity Risks as Credential Attacks Rise

Why It Matters

Unmanaged workforce identities and siloed applications expose critical attack surfaces, jeopardizing data security and regulatory compliance across the enterprise.

Key Takeaways

• Credential attacks drive need for passwordless authentication
• 77% of firms face incidents from disconnected apps
• Enterprises use 284 apps; ~80 lack identity coverage
• Adopt eIDAS 2.0‑compliant onboarding for global hires
• Shift to post‑quantum cryptography for long‑term resilience

Pulse Analysis

The shift to digital onboarding, remote workforces, and hybrid environments has elevated workforce identity to a top security priority. As employees access corporate resources from varied devices and locations, credential theft becomes the primary entry point for attackers. IN Groupe’s trend analysis highlights the necessity of a full identity lifecycle—verification, issuance, and continuous validation—to safeguard the expanding attack surface.

To meet this challenge, the report advises aligning onboarding processes with emerging regulations such as eIDAS 2.0, GDPR, and AML directives, leveraging ICAO‑compliant documents like ePassports and national eIDs for global hires. Deploying password‑less methods—FIDO2, PKI, and mobile IDs—combined with robust multi‑factor authentication and Zero‑Trust controls reduces reliance on vulnerable passwords. Enterprises are also urged to introduce mobile identities alongside smartcards and to begin transitioning to post‑quantum cryptography, ensuring cryptographic resilience against future threats.

A parallel Cerby study underscores the danger of disconnected applications, which leave nearly a third of an organization’s software ecosystem outside centralized identity governance. With an average enterprise running 284 apps and 80 of them unmanaged, incidents rise sharply, especially as AI, GenAI, and social platforms proliferate. Integrating these apps into a federated IAM framework, enforcing least‑privilege access, and applying continuous verification are essential steps to close the gap between perceived and actual security.