Attackers bypassed multifactor authentication (MFA) in every business email compromise (BEC) incident where it was enabled among cases investigated by LevelBlue in Q3 2026, highlighting growing identity security risks as cybercriminals increasingly exploit legitimate credentials and trusted IT tools.
According to LevelBlue’s latest threat intelligence briefing, BEC remained the most common incident type, accounting for 32% of cases, while data exfiltration surpassed file access as the leading observed outcome when sensitive information was at risk.
For MSPs and MSSPs, the findings underscore the limitations of traditional authentication and ransomware-focused defenses, as attackers increasingly use compromised sessions, administrative tools, and exposed infrastructure to access and steal customer data.
Data theft increases as ransomware tactics evolve
The prevalence of BEC was down from 45% in Q2, while non-ransomware network intrusions accounted for 22%. Ransomware increased from 13% to 20% of incidents.
The findings suggest that data theft and extortion are becoming increasingly important components of the threat landscape, even as ransomware remains prevalent.
For the first time in LevelBlue’s quarterly observations, data exfiltration surpassed simply viewing or accessing files as the most common outcome when data was at risk.
That distinction matters for MSPs responsible for monitoring customer environments. Detection strategies focused primarily on ransomware encryption may overlook attackers quietly transferring sensitive information to external destinations.
MFA bypass reveals gaps in identity security
Perhaps the report’s most striking finding was that attackers bypassed MFA in every BEC incident where it was enabled during LevelBlue’s sampling.
Rather than defeating authentication outright, attackers increasingly exploited stolen session tokens, malicious OAuth application permissions, and API keys to maintain access without triggering additional authentication challenges.
LevelBlue recommends phishing-resistant MFA alongside continuous session monitoring, conditional access policies, and tighter oversight of third-party application permissions.
For MSPs, these findings reinforce the need to extend identity security services beyond initial login protection to include ongoing monitoring of authenticated sessions and application access.
“The bad guys are no longer coming up to the front door, kicking it in and coming to steal the family jewels,” Cork CEO Dan Candee told Channel Insider in October. “They’re coming in through the dryer vent. They’re crawling through the doggy door.”
Phishing and edge vulnerabilities remain key entry points
Phishing remained the leading initial intrusion vector at 42%, down from 65% in Q2.
Meanwhile, exploited vulnerabilities and external remote services each accounted for 14% of initial access.
LevelBlue identified actively exploited vulnerabilities affecting SonicWall firewalls, Palo Alto Networks GlobalProtect, and internet-facing applications, illustrating the risks associated with unpatched infrastructure.
The findings highlight an opportunity for MSPs to strengthen vulnerability management, prioritize externally exposed systems, and establish faster remediation processes across customer environments.
Four security priorities for MSPs
For MSPs and MSSPs, LevelBlue’s findings suggest that protecting customer environments increasingly requires monitoring what happens after an attacker gains access, rather than relying primarily on preventing initial compromise.
First, reassess identity security beyond MFA. Partners should review how they monitor active sessions, enforce conditional access, and manage third-party application permissions. Phishing-resistant MFA remains important, but the report demonstrates that authentication alone cannot eliminate the risk of account compromise.
Second, expand detection beyond ransomware. With data exfiltration increasingly observed, MSPs should evaluate whether existing monitoring tools can detect unusual data transfers, suspicious account behavior, and unauthorized access to sensitive information before encryption or other disruptive activity occurs.
Third, prioritize exposed infrastructure. The continued exploitation of edge devices and remote access services reinforces the need for accurate asset inventories, risk-based patching, and clearly defined emergency remediation procedures across customer environments.
Finally, review incident response readiness. MSPs should establish clear escalation procedures, validate their ability to contain compromised accounts and sessions, and ensure customers understand their responsibilities when an incident occurs.
“If I’m a partner, I’m designing a BCDR service for a potential catastrophic AI event, and what we would do the day and the day after,” Exclusive Networks North American President Beal told us earlier this month.
Taken together, the findings point to a broader opportunity for channel partners to develop recurring services focused on identity monitoring, exposure management, and incident response readiness. The challenge is not simply adding more security products, but ensuring existing controls can detect and contain attackers operating through trusted systems.
READ MORE: LevelBlue recently expanded its partnership with SentinelOne, becoming the latter’s exclusive global delivery partner for Wayfinder services in October.