Identity is now the largest attack surface, as attackers shift from targeting zero-days to valid credentials for undetected access.