Why Identity and Access Still Represent the Weakest Link

[embedded content]

Idan Dardikman, co-founder and CTO of Koi Security, discusses the company’s emergence from stealth and its mission to address one of cybersecurity’s most persistent challenges: securing identity.
Dardikman explains that while the industry has poured resources into endpoint, network, and cloud defenses, identity and access continue to represent the weakest link in the chain. Credential theft and misuse remain top attack vectors, and adversaries have only grown more sophisticated in exploiting them. From phishing and credential stuffing to abusing session tokens, attackers understand that if they can compromise identity, they can bypass most traditional defenses.

That reality is what Koi Security was founded to confront. Rather than layering more controls on top of brittle authentication systems, the company is focused on rethinking how identities are validated and how access is managed in dynamic environments. Dardikman describes the approach as shifting from static, perimeter-based trust to continuous, context-aware validation that adapts in real time.
The conversation also touches on the pressures facing CISOs as identity attacks accelerate. Security leaders must balance user experience with strong authentication, meet compliance mandates, and defend against adversaries who can scale attacks with automation and AI. Dardikman emphasizes that solving the identity problem requires innovation that reduces friction for legitimate users while closing off avenues of abuse for attackers.

For practitioners, the takeaway is clear: identity is no longer just an IT problem—it’s the front line of modern cybersecurity. As attackers evolve, organizations need to evolve faster, adopting models that assume credentials will be targeted and designing defenses that remain resilient when they are.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts