For years, business leaders have viewed cybersecurity through the lens of the network perimeter. Firewalls, VPNs, and geolocation blocks formed the primary defenses. The thinking was straightforward. If you kept attackers out of your network, your data remained safe. That model is no longer effective.
Kaseya's 2026 SaaS Security Report provides a clear picture of how the threat landscape has changed. The analysis covered more than 27.6 billion security events across over 50,000 small and medium-sized business environments. The findings show that attackers have fundamentally shifted their approach. They are no longer prioritizing the breach of network perimeters. Instead, they are targeting identity trust.
The data reveals a significant imbalance in how SMBs manage access. Unmanaged guest accounts now make up 69% of all monitored accounts. This translates to 4.3 million guest accounts compared to just 1.9 million licensed users. Guest accounts are often created for external collaborators, temporary workers, or vendors. They frequently lack the same oversight and security policies applied to full employees. Attackers have noticed this vulnerability and are actively exploiting it.
The report also found that 56% of accounts lacked active multi-factor authentication. This means more than half of all accounts are protected only by a username and password. Password fatigue, credential reuse, and phishing attacks make this level of protection inadequate. Attackers can compromise these accounts through relatively simple methods.
Attackers are routing their operations through trusted infrastructure and cloud hosts. This approach renders traditional perimeter defenses like geolocation blocking and IP reputation filters largely ineffective. When an attacker uses a legitimate cloud service to launch an attack, the traffic appears to come from a trusted source. Firewalls are not designed to distinguish between legitimate user activity and malicious behavior conducted through compromised accounts.
The shift to hybrid and remote work has accelerated this problem. Employees access company resources from multiple locations and devices. Business applications live in the cloud. The concept of a network boundary has become porous. Security can no longer be defined by what is inside or outside a network. Security must be defined by who is accessing what resources and whether that access is legitimate.
Human accounts are not the only risk. Non-human identities, such as service principal logins, now account for 20% of critical security alerts. These machine identities are used for automated processes, application-to-application communication, and integrations between cloud services. They often have broad permissions and are configured once and then forgotten. Attackers who compromise a service account can move laterally through an environment with minimal detection.
The attack surface has expanded beyond the people in an organization to include every automated connection and integration. Organizations often lack visibility into these machine identities. Without clear visibility, there is no way to audit their permissions or detect unusual behavior.
Attackers are not just exploiting existing weaknesses. They are also using automation and AI to accelerate their attacks. Kaspersky experts have observed that criminals use AI-driven automation to locate and exploit dormant guest accounts. They target guest accounts that have been created but never used or accounts that belong to former external partners. These accounts often have active permissions but are no longer monitored. Attackers can discover and compromise them faster than most SMBs can identify and remove them.
The implications for small and medium-sized businesses are significant. The traditional checklist approach to security, which focused on implementing a firewall and antivirus software, is no longer sufficient. The perimeter has effectively disappeared, and identity has become the new control plane.
Moving to identity-focused governance requires a different approach to security management.
Enforce organization-wide MFA. This should apply to every account, including guest and external user accounts. Conditional access policies can require MFA based on risk signals like location or device type. Exceptions should be minimal and tightly controlled.
Audit all external sharing and guest accounts. Many SMBs do not have a complete inventory of who has access to their systems. Regular audits should identify guest accounts that are no longer needed and remove them. Sharing settings for files and applications should be reviewed to ensure they are not overly permissive.
Implement identity governance. This goes beyond authentication to include lifecycle management. Accounts should be created with appropriate permissions, reviewed regularly, and removed when no longer needed. Automated workflows can help manage this process without requiring dedicated staff.
Monitor machine identities. Service accounts and application integrations should be inventoried and reviewed. Permissions should follow the principle of least privilege. Automated alerts should trigger when machine identities exhibit unusual behavior, such as accessing resources outside their normal scope.
For many SMBs, managing identity security internally is a significant challenge. The expertise required to configure conditional access policies, audit machine identities, and monitor for identity-based threats is not always available in-house. Managed service providers can help businesses implement identity governance frameworks without requiring a dedicated security team. This includes establishing baseline security policies, conducting regular access reviews, and monitoring for suspicious activity across both human and machine identities.
The shift away from perimeter-based security is not a temporary trend. Attackers have proven that identity is the most effective path into business systems. Organizations that adapt their security strategy to focus on identity trust will be better positioned to detect and prevent these attacks. Organizations that continue to rely on outdated perimeter defenses will remain vulnerable to threats that increasingly bypass those defenses entirely.