A new incident response report from Palo Alto Networks Unit 42 — drawn from 750 real-world cases — finds that identity-based techniques drove 65 percent of initial intrusions. Identity played a role in nearly 90 percent of all breaches, from initial access through lateral movement and data exfiltration. This is not a technology failure. It is an architecture failure. And it has a precise solution.

Anthropic’s Claude Code Security addresses a real risk. The larger one remains unaddressed. Anthropic recently announced Claude Code Security—an AI system designed to identify vulnerabilities in code, surface potential zero-day exposures, and accelerate remediation before attackers can exploit them. It is a meaningful technical advance. If it performs as described, it will reduce the exploitable software attack surface across the enterprise. That matters. But it does not address the attack surface that is closing the majority of breaches in 2026. Stronger code does not stop an attacker who authenticates with stolen credentials. And that is the primary breach path enterprises face today.

Attackers are accelerating. AI tooling has lowered the cost of sophisticated campaigns to near zero, while the scale of attacks has expanded across every phase of the attack chain — reconnaissance, initial access, lateral movement. The 2025 Tidal Cyber Threat Led Defense Report confirms what security leaders already understand: defenders no longer hold an inherent speed advantage. This is the Red Queen dynamic. Running harder sustains position. It does not advance it. But there is a more precise problem underneath the noise. Phishing and social engineering have changed structurally. Training-based defenses, however disciplined, are now insufficient by design. The architecture of the threat has shifted. The architecture of the response must follow.

Cybercriminals claiming affiliation with the ShinyHunters group have reportedly breached Wynn Resorts, demanding $1.5 million to prevent the release of stolen data. If accurate, the intrusion follows a pattern that has now repeated itself across hospitality, retail, insurance, and aviation. (Read the full article on Casino.org) The method is consistent. The attackers did not defeat network defenses. They authenticated.

What happened at Stryker today isn't a malware story. It's an identity story. And it's one the industry has seen before — the Sony hack, twelve years ago, followed a similar path. A dozen years later, the attack surface has changed. The fundamental failure hasn't.