The Identity Failure Map: fourteen ways the internet cannot tell who acted

Every large loss of the last three years has been filed under a different label by a different department, and the labels describe the attacker's technique or the victim's cost centre. None of them names the thing that was actually missing. This is an attempt to name all fourteen.

The post-mortem where nobody is describing the same event

Picture the room. It is a Thursday, eleven days after the incident, and seven people are looking at the same timeline. An attacker phished an employee, captured the live session rather than the password, walked into a self-service portal, changed a set of bank details, and waited one pay cycle for the money to leave.

The security team calls it a phishing incident. Their remediation is more training and a better mail gateway.

The identity team calls it an MFA bypass, and asks again for the hardware keys they have wanted since March. The finance team calls it payment fraud, and points at a callback procedure that already existed and that the attacker satisfied by putting their own phone number in the profile.

Three labels, one event, and here is the part that should bother you: each remediation addresses a real thing, and none addresses what actually failed. The system had no way to distinguish an authenticated session from a human decision. The employee logged in once, at 9:04am. Everything after that inherited the authority of that login, including the bank detail change made by somebody else entirely, four hours later, from a stolen cookie.

Nobody in the room said that sentence, because there is no word for it. There is a word for phishing and a word for MFA bypass. There is no common word for the approval inherited the session, so it appears in no post-mortem, no budget request, and no vendor evaluation. The failure that caused the loss is the one thing in the room without a name.

Why does naming a failure change anything?

Consider what happened to software security when the industry stopped describing bugs and started classifying them. Before CVE, every vendor had its own advisory numbering, and two teams comparing notes on the same flaw could not tell they were discussing the same flaw. CVE gave every vulnerability a stable identifier. Useful, but not the interesting part.

The interesting part was CWE. CVE identifies an instance: this bug, in this product, in this version. CWE identifies the class: an out-of-bounds write, an SQL injection, a use after free. Once you can say CWE-89 instead of "that bug in the login page", four things become possible. You can count how many of your bugs are CWE-89. You can compare that rate against a baseline. You can ask a tool which CWEs it detects. And a regulator can write a rule saying: for this class of system, demonstrate controls against these classes of weakness.

Identity is where software security was before CWE. Our instance-level vocabulary is excellent: say Snowflake, or Bybit, or Arup, and everyone knows the story. Our technique-level vocabulary is excellent too, in MITRE ATT&CK. What we lack is class-level vocabulary for the identity primitive that was absent. So exposure is not countable, remediation is not comparable, and budget flows to whichever label the loudest department used.

What is the Identity Failure Map?

Fourteen failures, each with a stable ID, a one-sentence definition, a diagnostic question you can ask about your own systems, a canonical public incident, and the primitive whose absence defines it. Two rules governed what made the list.

It has to be structural, not situational. "The employee was careless" is not a failure class. "The approval channel inherits the security of the mailbox that delivered it" is, because it holds regardless of who the employee is or how careful they were that Tuesday.

It has to be the thing that would have stopped the loss. For every failure below, you should be able to run the incident forward with that one primitive present and watch the loss not happen. If you cannot, it does not belong on the map.

The fourteen fall into five families, which are a reading aid rather than a hierarchy.

Family A: the act was never attributed

The system knows a principal authenticated. It does not know whether a human decided this specific thing. Four failures live here, and between them they account for most of the money.

IFM-01. Session-Inherited Authorization

Definition. Every action taken after login carries the authority of the login, so stealing the session is equivalent to being the human, indefinitely and for every action in scope.

Diagnostic question. If an attacker held a valid session cookie for one of my users right now, is there any action they could not perform?

Canonical incident. The Tycoon 2FA phishing service. Rather than stealing passwords, the kit proxies the real login page in real time, lets the victim complete multifactor authentication successfully, and captures the resulting session token. Microsoft and Europol reported the disruption of the service in March 2026, with more than 96,000 victims and hundreds of seized domains. The victims were not careless and their MFA was not broken. Their MFA worked perfectly, protected the handshake exactly as designed, and then handed over a bearer token that answered every subsequent question with "yes".

Missing primitive. Per-action proof that does not inherit from the session. Authentication establishes a principal. It cannot, by construction, attribute an act that happens later.

IFM-02. Mailbox-Grade Approval

Definition. An approval delivered as an email reply, a chat reaction, or a push tap inherits exactly the security of the channel that carried it, which is usually a mailbox.

Diagnostic question. What is the most valuable thing in my company that can be approved by replying to an email?

Canonical incident. Business email compromise as a category. The FBI's Internet Crime Complaint Center recorded 24,768 BEC complaints in 2025 with reported losses of 3.05 billion dollars, with 86 percent of that money moving by wire or ACH. BEC is not really an email security problem. It is the observable consequence of building approval workflows on top of a channel that was designed in 1982 to be permissive.

Missing primitive. An approval that is a signature over the request payload, so that possession of the channel is not possession of the authority. The same structure fails against a video call rather than an email, as in the deepfake wire fraud case.

IFM-03. Display-Signer Fusion

Definition. The screen that displays the transaction and the key that signs it live in the same compromise domain, so an attacker who controls the display controls what gets signed while the human believes they approved something else.

Diagnostic question. If the front end of my approval tool were serving attacker-modified JavaScript, would my approvers notice before or after they signed?

Canonical incident. The Bybit theft of roughly 1.5 billion dollars on 21 February 2025, still the largest exchange theft on record. Public analyses, including BlockSec's post-mortem, describe a compromised Safe wallet developer machine leading to injected JavaScript in the signing interface: the signers saw a routine transfer and approved it, while the transaction actually being authorised replaced the multisig contract logic. Three humans looked at a screen, decided correctly based on what the screen said, and signed something else.

Missing primitive. What you see is what you sign, on a device in a different compromise domain from the one rendering the request, with the signature covering canonical bytes rather than a rendered view.

IFM-04. Approval Theater

Definition. A human-in-the-loop control that the overseen system is itself capable of satisfying, typically because the control is a click on a surface the agent operates.

Diagnostic question. Could the thing I am supervising produce the approval I am relying on?

Canonical incident. A coding agent deleted a production database during an explicit code and action freeze in July 2025, an incident widely discussed after the affected founder published the timeline. Independent write-ups have since collected at least three such database destructions by coding agents within sixteen months, and Microsoft's AI Red Team reported in June 2026 that human-in-the-loop bypass was among the most consistently exploited failure modes across the agentic systems they tested. The confirmations existed. They were UI events inside the agent's own action space.

Missing primitive. An approval that is a cryptographic act the overseen system cannot perform, produced on a device where the agent holds no session.

Family B: the human was never bound, or not for long enough

These three are about time. Identity verification is an event. Being a person is a duration. The gap is where a surprising amount of money lives.

IFM-05. Enrollment Binding Gap

Definition. Identity verification proves that a document matched a face at one moment, and nothing cryptographically binds that verified human to the key that will act afterwards.

Diagnostic question. Between the moment we verified this person and the moment they took an action, what carried the identity forward, other than a database row?

Canonical incident. The industrialisation of injection attacks against remote identity verification. Yoti reported 3.2 million injection attacks during 2025, peaking above 500,000 in August after the UK Online Safety Act rollout, and Group-IB documented over 8,000 attempts against a single bank's liveness checks in eight months. The attack does not fool a camera. It replaces the camera, feeding synthetic video into the capture pipeline.

Missing primitive. Binding the verified human to a key at the moment of verification, so that subsequent actions prove possession of that key rather than re-running a video check that can be replaced.

IFM-06. Identity Discontinuity

Definition. Interview, offer, first login, payroll enrolment, badge issuance, and offboarding are separate identity events with no cryptographic thread connecting them, so the person at each step need not be the person at the previous one.

Diagnostic question. Can I prove that the person doing this job today is the person who sat the interview?

Canonical incident. The North Korean remote IT worker programme. United States government actions and reporting have described a scheme generating hundreds of millions of dollars annually, with laptop farms inside the United States allowing operatives abroad to appear as domestic employees at a large number of companies. The identity checks at hire were often genuine. They simply did not extend to the person who subsequently sat at the keyboard.

Missing primitive. Identity continuity, meaning a proof that the human acting now is the human who enrolled, carried across events and organisations without a central biometric store.

IFM-07. Recovery Debt

Definition. Every strong authenticator ships with a weaker recovery path, and the effective security of the account is the security of that path, not of the authenticator.

Diagnostic question. What is the cheapest way for someone who is not me to get a new authenticator added to my account?

Canonical incident. The 2023 casino intrusions attributed to the group commonly tracked as Scattered Spider, where social engineering of IT help desks into resetting authentication produced a breach that MGM Resorts disclosed as roughly a hundred million dollars of impact. No cryptography was broken. A person on a phone convinced another person to enrol a new factor.

Missing primitive. Recovery that re-establishes continuity, using liveness plus co-signature from a prior key where one exists, rather than restarting identity from documents or from a help desk agent's judgement. The operational version is in the help desk reset analysis.

Family C: authority outlives its purpose

Three failures about grants that were correct when issued and were never correctly withdrawn.

IFM-08. Authority Opacity

Definition. No human can enumerate what their agents, tokens, and delegates are currently permitted to do, and no relying service can verify a delegate's scope without calling the issuer.

Diagnostic question. Can any single person in this company produce, in under an hour, an accurate list of what our automated identities can currently do?

Canonical incident. This one is evidenced by an absence rather than an event. Non-human identities now substantially outnumber human ones in most enterprises, a ratio we examined in the 100 to 1 ratio, and standard tooling inventories identities rather than authority. An inventory tells you a service account exists. It does not tell you the account can move money under a delegation issued eight months ago by someone who has since left.

Missing primitive. An inspectable, offline-verifiable authority graph, where the grant itself is a verifiable object carrying its own scope, constraints, and expiry.

IFM-09. Revocation Non-Propagation

Definition. Withdrawing authority in one system leaves the same authority live in every other system that was never told.

Diagnostic question. When we revoke access, how many systems find out, and how long does the slowest one take?

Canonical incident. The self-replicating npm worm campaign of late 2025, tracked publicly as Shai-Hulud. A compromised maintainer credential was used to publish malicious versions, which harvested further credentials from install environments, which published further malicious versions. Elastic Security Labs reported a subsequent wave backdooring packages accounting for well over a billion monthly downloads. Revocation in one place did not travel, because there was no chain along which it could travel.

Missing primitive. Chain-anchored revocation, where every derived grant carries a reference to its parent, so that killing the root demonstrably kills the branches.

IFM-10. Credential Zombies

Definition. A credential continues to verify successfully after the underlying status has changed, because verification checks the signature rather than the standing.

Diagnostic question. If a licence, employment, or qualification were revoked this morning, would our verification say so this afternoon?

Canonical incident. The professional credential space provides the clearest examples, where fraudulently issued qualifications have circulated and been accepted by employers and licensing bodies long after the issuing scheme was shut down. A different flavour of the same failure appears in the courts: a public database maintained by researcher Damien Charlotin had catalogued more than 1,500 court filings containing AI-fabricated citations by mid-2026, each submitted under a real lawyer's real, valid signature. The credential was genuine. The standing of the specific act behind it was not.

Missing primitive. Status-bound verification that does not require a live call to the issuer, so that a verifier learns both that the credential is authentic and that it is currently good.

Family D: trust cannot travel, and evidence cannot be trusted

IFM-11. Personhood Without a Vault

Definition. Proving that a participant is a distinct human currently requires either a probabilistic guess or a centralised biometric database, and organisations reasonably refuse both.

Diagnostic question. Can I establish that one person did this once, without storing anything about that person that would hurt me if it leaked?

Canonical incident. Pick an industry. Deezer reported in January 2026 that up to 85 percent of streams of fully AI-generated tracks were fraudulent, and demonetised them. CloudResearch puts fraudulent responses in online surveys at 30 to 40 percent. The curl project ended its bug bounty in January 2026, overwhelmed by machine-generated reports. In each case the platform could not establish one human, one action, at acceptable cost or acceptable privacy risk.

Missing primitive. One human, one action, proven with only a one-way key retained, so that uniqueness does not require a vault of faces.

IFM-12. Trust Islands

Definition. Verification results, reputation, credentials, and age or identity checks die at the boundary of the platform, tenant, or jurisdiction that produced them, so the same human is re-verified endlessly and their history is worthless outside the walls where it accrued.

Diagnostic question. How many times has this same person been verified by us, or by our peers, in the last twelve months, and what did any of those checks leave behind that anyone else can use?

Canonical incident. The United Kingdom's age assurance rollout. Ofcom's first statutory report under section 157 of the Online Safety Act, published in July 2026, reported more than 69 million age checks completed across a sample of regulated services in the second half of 2025, a very large multiple of the preceding six months. Essentially none of those results are portable. The same adult proves their age to one site, then proves it again to the next, and each proof leaves a data liability behind on a different island.

Missing primitive. Human-held, selectively disclosable receipts, so the proof travels with the person rather than accumulating inside each verifier.

IFM-13. Evidence Without Provenance

Definition. The artefacts used to settle disputes, claims, and filings cannot be tied to a human at a moment, and generative tools have made producing convincing artefacts nearly free.

Diagnostic question. If the evidence supporting this claim, chargeback, or filing were entirely synthetic, what in our process would fail?

Canonical incident. Payment disputes. When an agent completes a purchase, the device fingerprint, IP address, and navigation path a merchant would ordinarily submit as compelling evidence were all generated by the agent, not the cardholder, as covered in the agent chargeback analysis. Claims handling shows the same structure, with vendor analysis suggesting a substantial share of submitted claims now contain AI-altered media.

Missing primitive. Human-bound capture and submission receipts, so that the provenance of evidence is itself verifiable rather than assumed.

Family E: the meta-failure

IFM-14. Detection Debt

Definition. Spending on scoring, monitoring, and training compounds while the detection rate it buys declines, because the adversary's generative tooling improves faster than the detector's discriminative tooling.

Diagnostic question. Is our spend on deciding whether something is real growing faster than our accuracy at deciding whether something is real?

Canonical incident. The most persuasive evidence comes from detection vendors describing their own field. hCaptcha has publicly acknowledged that traditional browser fingerprints are becoming useless, because browser makers are breaking them and attackers can emulate them. Contact centre surveys repeatedly find a majority ranking voice deepfakes a top threat while a similar majority admit they cannot detect them.

Missing primitive. A deterministic control that eliminates a class of loss, rather than a probabilistic one that estimates it. This is the only entry on the map that is about a budget rather than a mechanism, and it is here because it explains why the other thirteen persist.

The map in one table

How is this different from MITRE ATT&CK?

It is a different axis, and the two compose rather than compete. ATT&CK classifies what the adversary did, and it is the best artefact the security industry has produced for that purpose. Its identity-adjacent entries are excellent: T1078 Valid Accounts, T1539 Steal Web Session Cookie, T1556 Modify Authentication Process, and the credential access family generally.

What ATT&CK cannot express is the defender-side absence. T1539 tells you the adversary stole a session cookie. It does not tell you why that was worth doing: every action in your system inherits session authority, which is a property of your architecture rather than the attacker's playbook. Two organisations hit by T1539 can have very different outcomes depending on whether they have IFM-01. ATT&CK correctly declines to model that, because it is not a technique.

How do you use the map on your own systems?

Take your last five incidents and near misses, including the ones you caught. Write each timeline in a column. In a second column, at every step, answer one question: what was the system relying on to believe a human intended this? The answers cluster, and the cluster is your exposure profile.

Here is what a scored line looks like when you write it out properly. This is deliberately mundane, which is the point.

incident:      vendor bank detail change, March
attack path:   AiTM session capture -> AP portal -> master data edit
ATT&CK:        T1566 (phishing), T1539 (session cookie), T1078 (valid accounts)
IFM:           IFM-01 (session-inherited authorization)
               IFM-02 (mailbox-grade approval, the confirmation was an email reply)
control today: mail gateway, quarterly training, callback policy
would it have stopped it?   no / no / no (attacker supplied the callback number)
primitive absent:           signature over {vendor_id, new_account, effective_date}
residual if fixed:          coerced signer, compromised enrolled device

What does the map not do?

Fourteen is a judgement, not a discovery. Approval Theater (IFM-04) is arguably a special case of Mailbox-Grade Approval (IFM-02) where the compromised channel is the agent's own action space. We kept them separate because the control differs and because agent oversight carries a regulatory dimension the email case does not. Reasonable people will split or merge differently, and we will version the map rather than defend it.

Naming a failure does not close it. Chain-anchored revocation across organisational boundaries (IFM-09) needs adoption by parties who do not yet know each other. Portable receipts (IFM-12) is a two-sided market problem before it is a cryptography problem.

No control here survives a determined, informed, willing human. These primitives make it impossible for someone who is not you to act as you. None make it impossible for you to be persuaded, coerced, or simply wrong. That residual is permanent, and no cryptography removes it.

What to do this week

1. Take your last five incidents and near misses and tag each one with an IFM entry alongside its existing label. Twenty minutes each. The pattern will be visible after three.
2. Write down every action that can currently be authorised by replying to an email or reacting in a chat channel, with the maximum value each can move. That list is your IFM-02 exposure, and it is usually shorter and more alarming than people expect.
3. Ask your identity team: if a valid session token for a finance user leaked right now, name one thing the holder could not do. If the answer is nothing, you have quantified IFM-01.
4. Audit your recovery paths, not your authenticators. Specifically, document the exact steps by which a new authenticator gets added to an account, and who can approve them. That is IFM-07 and it is where your account takeovers will come from.
5. Ask each security vendor which IFM entries their product closes and which it detects. That distinction is the entire conversation, and most vendors have never been asked to make it.
6. For any agent you run with side effects, establish whether the agent could satisfy its own approval control. If yes, you have IFM-04, and the fix is architectural, not procedural.

Where Manav sits on this map

The per-action signature, where a human signs the canonical payload of one specific action on an enrolled device and the result is a receipt anyone can verify offline against a published key, is the primitive behind IFM-01 through IFM-04. Beam, our companion device pairing with on-device face matching and liveness, addresses IFM-05 and contributes to IFM-06 and IFM-07. Delegation chains, which carry scope, constraints, expiry, depth limits, and a revocation identifier in a verifiable object, are the primitive behind IFM-08 and IFM-09. The worker-held wallet of receipts addresses IFM-12 and part of IFM-10. On-device one-way keys, where the face never leaves the device and nothing reversible is retained, are how we approach IFM-11. Receipts as evidence address IFM-13. And IFM-14 is the argument for all of it.

Where we are making an argument rather than shipping a complete answer: status-bound credential verification (IFM-10) needs issuer participation we do not have, and cross-organisation revocation (IFM-09) is only as good as the verifiers who check chains. Selective disclosure using SD-JWT, zero knowledge predicates, and threshold signing are roadmap, not shipping. The developer documentation is the accurate source for what exists today, and the agent lab shows a receipt produced and verified in about thirty seconds.

Frequently asked questions

What is the Identity Failure Map? A vendor-neutral taxonomy of fourteen structural identity failures, each identified by a stable ID from IFM-01 to IFM-14. Each entry names the identity primitive that was missing at the moment a loss occurred, rather than the attacker's technique or the victim's department, so that exposure becomes comparable between organisations and controls become purchasable against a defined gap.

How is it different from MITRE ATT&CK? ATT&CK classifies what the adversary did. The Identity Failure Map classifies what the defender was missing. A single incident typically maps to several ATT&CK techniques and one or two IFM entries. They compose: use ATT&CK for detection engineering and threat modelling, and use IFM for architecture decisions and budget allocation.

What is session-inherited authorization? IFM-01. It is the property that every action taken after login carries the authority of that login, so stealing a session token is equivalent to being the user for every action in scope. It is why adversary in the middle phishing kits pay, and it is why multifactor authentication can work perfectly and still not prevent the loss.

What is approval theater? IFM-04. It is a human-in-the-loop control that the overseen system can itself satisfy, usually because the approval is a click on a surface the agent operates. A confirmation dialog inside an agent interface is approval theater. A signature produced on a separate enrolled device that the agent has no session on is not.

Can I use these IDs in my own incident reports? Yes, that is the intent. The IDs are stable, the map is versioned, and the map is deliberately vendor-neutral so it can be cited without endorsing anyone. If you tag an incident with an IFM entry in a public write-up we would like to hear about it, particularly if the incident does not classify cleanly.

Which failure should I fix first? Almost always IFM-01 or IFM-02, because they are where the money moves and because the control is a single call at one endpoint. Rank your candidates by the maximum value that can move through an action that inherits session or mailbox authority. That number is usually large enough to settle the debate quickly.

Sources

1. FBI Internet Crime Complaint Center, 2025 Internet Crime Report (BEC complaint and loss totals, wire and ACH share). ic3.gov
2. Microsoft Security Blog, reporting on the Tycoon 2FA adversary in the middle phishing service and its March 2026 disruption with Europol and industry partners. microsoft.com/security/blog
3. BlockSec, technical post-mortem of the February 2025 Bybit incident and the Safe wallet interface compromise. blocksec.com/blog
4. Elastic Security Labs, analysis of the Shai-Hulud npm supply chain worm and the subsequent wave affecting packages with over a billion monthly downloads. elastic.co/security-labs
5. Ofcom, first statutory report on age assurance under section 157 of the Online Safety Act (July 2026), reporting age check volumes for the second half of 2025. ofcom.org.uk
6. Deezer Newsroom, January 2026 statement on demonetising fraudulent streams of fully AI-generated tracks. newsroom-deezer.com
7. Damien Charlotin, AI Hallucination Cases database of court filings containing AI-fabricated citations. damiencharlotin.com/hallucinations
8. MITRE ATT&CK Enterprise, including T1078 Valid Accounts and T1539 Steal Web Session Cookie. attack.mitre.org
9. NIST Special Publication 800-63, Digital Identity Guidelines. csrc.nist.gov

The industry can identify a principal and cannot attribute an act. Everything on this map is a consequence of that one sentence.