RSA 2025: Identity Is the New Threat Vector

Cloud-era intrusions now revolve around identity. Initial access, lateral movement, and privilege escalation all run through identity. The mechanisms are user identities, IDPs, and service accounts. That replaces the old chain of a phishing dropper followed by a beacon and a RAT. Kikta says identity has become the centerpiece of attacker tooling and technique.

RSA 2025 put heavier emphasis on identity, which Kikta calls encouraging and about five years overdue. Identity is where prevention, detection, and response most often matter in cloud environments.

Cybersecurity remains much heavier on finding problems than on fixing them. Kikta has flagged this detection-over-remediation imbalance across the past few RSA conferences.

Two risk methodologies are competing. One catalogs every possible weakness. The other is threat-informed and prioritizes the core technologies and choke points where an attacker could cause meaningful business damage.

The major security conferences are trending toward homogenization, with RSA and Black Hat increasingly merging. Kikta says that makes each individual show less valuable.