In 2026 stolen credentials and unmanaged machine identities drive breaches—small buys, phone scams, and weak IAM make ...

The directive targets firewalls, routers, and VPNs that are no longer receiving vendor patches, as nation-state actors shift their tactics from endpoints to infrastructure.