Attackers have stopped hunting for vulnerabilities and started hunting for relationships

In one case, BeyondTrust's research team worked through this year; an AI agent running on AWS Bedrock AgentCore had been deployed according to the platform's own guidance. The sandbox behaved as designed, and no configuration error existed to point to. The permissions the agent inherited could still be escalated into far broader access across the account, because the exposure originated in what the platform granted the agent at creation.

That case appears in the Phantom Labs Research Index, published on Monday and announced by BeyondTrust on Tuesday, which accounts for more than 400 research projects the team pursued during its first year. Of the investigations it completed, 75% traced back to identity or privilege exposure. The work spanned cloud providers, SaaS platforms, developer tooling, detection engineering, graph analytics and identity management, and it kept arriving in the same territory.

Jonathan Johnson, Senior Manager, Research at BeyondTrust, said that as organisations connect human, machine and AI agent identities across dispersed environments, “attackers don't need to find a new vulnerability.” He added that they are “looking for the next identity relationship that leads to privileged access.”

The root causes cluster tightly. Credential and secret exposure accounted for 18% of findings, identity relationships and graph exposure 11%, excessive or standing privilege 11%, identity misconfiguration 10%, and lateral movement 6%, with six categories covering more than half of everything the team uncovered. Almost none of them appeared alone. Credential exposure proved the condition most likely to compound with something else.

Fixing findings one at a time leaves the chain intact

Because root causes travel in pairs, the ticket-and-close model most security programmes run on retires far less risk than the raw numbers suggest. An organisation that rotates an exposed secret removes one link from a chain that survives otherwise complete, since the standing privilege attached to the account holding that secret goes untouched by the rotation. Nearly every project that flagged one root cause flagged a second.

“Three out of four projects traced back to identity or privilege in some form, and standing privilege and privilege escalation showed up together more often than any other combination we tracked,” said Johnson.

The technologies that surfaced most often show how little of this belongs to any single vendor. AWS appeared 85 times across the research, Microsoft Entra ID and Azure 57 times, GitHub 40 times, and Okta and Salesforce 33 times each, a spread running across cloud infrastructure, identity providers, developer tooling and business applications. Enterprises consolidating identity onto one provider in the belief that consolidation shrinks exposure are working against evidence that every platform in their stack reproduces the same assumptions about trust and inherited access independently.

AI agents became enterprise identities before anyone decided to govern them as such

Half the team's first-year output went into AI security, with 180 of the 400-plus research ideas pursued there, divided across cloud AI platforms at 58%, AI agents at 42%, model and data security at 12%, prompt injection and jailbreak techniques at 9%, and privilege escalation specific to AI systems at 6%. Agents authenticate to systems, invoke tools, access data and inherit permissions much like any other enterprise identity, while attracting a fraction of the oversight applied to a human account or a service account.

Johnson said that “figuring out where those relationships create real exposure has become one of the harder problems in enterprise security today.”

The AgentCore case shows what follows from that. Governance programmes built around joiners, movers and leavers have no mechanism for an entity a developer creates in an afternoon, whose permissions come from platform defaults, and which enters no entitlement review cycle. Most organisations cannot yet produce a list of the agents operating inside their environment, and revoking standing access requires knowing that the access exists.

Phantom Labs published 31 articles and findings during the year and completed two coordinated vulnerability disclosures, both against AI platforms. One covered a command injection weakness in OpenAI Codex capable of exposing GitHub tokens, and the other addressed sandbox and privilege escalation problems in AWS Bedrock AgentCore code interpreters. The team indicated that further disclosures remain in the pipeline awaiting vendor coordination.

Both disclosures describe infrastructure built at speed on foundations the security industry spent a decade arguing over. Every hardening lesson about token scope, sandbox escape, service account permissions and delegated trust is being learned again inside platforms that reached general availability faster than the governance around them could be built. The index describes the attacker's view of all this in a single line, saying that “it's all about hunting for privilege.”

Detection work reaches defenders in ways disclosure counts never do

Alongside the offensive research, the team explored 94 detection and remediation ideas, and 79 of them fed directly into BeyondTrust product development, including Identity Security Insights. Most identity risk an offensive team uncovers never becomes a vulnerability with a CVE number and a patch cycle behind it. Excessive entitlements and misconfigurations generate no vendor advisory, no urgency and no remediation deadline, and they persist quietly until somebody goes looking for them.

Research volume therefore makes a weak evaluation criterion for identity security buyers. What determines whether an enterprise is protected is the speed at which offensive findings become detections running against live environments. Beyondtrust has made its assessment layer available free through the Identity Security Risk Assessment, which allows organisations to begin monitoring human, machine and agent identity risk ahead of any purchase decision.

Phantom Labs was founded in 2025 by Marc Maiffret and Kinnaird McQuade, and the index was co-authored by David van Heerden, Senior Product Marketing Manager at BeyondTrust, with the research team. A narrative version of the findings is due to run as part of the Phantom Labs Year One Collection on Dark Reading.

The wider value of the index lies in proportion. Identity vendors have spent two years asserting that privilege is the real perimeter, and this is among the first datasets to attach numbers to that claim from the attacker's side of the problem. If credential exposure and standing privilege together account for close to a third of everything a dedicated offensive team finds in a year, and if those two conditions reinforce each other more reliably than any other pair, the sequence of enterprise security investment follows from the evidence.