Two outages on the same day in September made one thing clear: when the cloud goes dark, identity security goes with it — and that’s the part attackers wait for.
Google DriveOpens a new window ‘s 39-minute disruption, caused by a capacity test, produced login timeouts and connection failures.
For lean IT teams, the takeaway is simple: plan for the identity risk, not just the downtime.
Understanding how cloud downtime exposes identity security vulnerabilities reveals why token-based attacks pose such a critical threat while systems are offline.
“Cached credentials, existing sessions, and authentication tokens may keep users or applications running temporarily, but eventually those sessions or tokens expire and need to be validated or refreshed,” he adds.
Two outages on the same day in September made one thing clear: when the cloud goes dark, identity security goes with it — and that’s the part attackers wait for.
On September 16, 2026, Salesforce went down for seven hours. The same day, Google Drive went dark for 39 minutes.
Both outages carried the same fingerprint: authentication failures, broken sessions, and blocked access. And that’s the part that should worry IT teams long after the service comes back. An outage doesn’t have to cause a breach, but it can hand attackers the opening they need.
READ MORE: Six steps to operationalize AI governance
The Salesforce outageOpens a new window , triggered by an external dependency failure that hit its legacy login server, forced the company to block an API endpoint to limit the damage — ThousandEyes Opens a new window called it an application-layer problem. Google DriveOpens a new window ‘s 39-minute disruption, caused by a capacity test, produced login timeouts and connection failures.
For lean IT teams, the takeaway is simple: plan for the identity risk, not just the downtime. Understanding how cloud downtime exposes identity security vulnerabilities reveals why token-based attacks pose such a critical threat while systems are offline.
What an outage really exposes
An outage by itself doesn’t lead to a breach. The chaos around it does — it creates the conditions for session hijacking and adversary-in-the-middle (AiTM) phishing, where an attacker sits between the user and the service they’re logging into.
Obsidian Security’s findingsOpens a new window show AiTM phishing attacks grew 146% in the past year, with nearly 40,000 token theft incidents reported daily across Microsoft environments. A token keeps an employee logged in until it expires or is revoked—and tokens leak constantly through browser exploits, phishing kits, malware, and supply chain breaches.
MFA is one of the most trusted ways to verify identity, but it only protects the login, not the session that follows. Once an attacker holds a stolen token, they can reach SaaS apps, APIs, and cloud platforms without triggering a fresh MFA prompt.
Victor Garcia, senior global solution engineer at Sophos, told Spiceworks that the authentication mechanisms most exposed during a long outage depend on real-time access to centralized identity services — SSO, OAuth, API authentication, and some MFA workflows.
READ MORE: How to manage cybersecurity vendors without losing internal control
“The Salesforce outage illustrates this risk: problems with an internal login service affected not only users trying to sign in, but also APIs and applications that depended on that authentication infrastructure,” he adds.
Andrew Hartnett, Bitwarden’s CTO, agrees that when a primary identity provider goes down, the most vulnerable processes are new logins, session token renewals, and MFA prompts. “Automated systems, software build pipelines, and connected applications often rely on short-lived digital tokens, and they can fail the moment those tokens cannot be renewed,” he told Spiceworks.
There’s a fallback problem too. When tokens expire, systems lean on cached passwords or emergency bypass accounts — which can be compromised just like tokens through malware, phishing, and memory dumping. LastPass’ State of AI and SaaS Security 2026 reportOpens a new window found that 21.2% of employees are actively logging in to SaaS and AI tools with compromised credentials. And because logging and monitoring often go down during an outage, IT may not be able to tell which tools are being accessed with those credentials—which slows breach response.
Garcia notes that fallback mechanisms help, but only so far. “Cached credentials, existing sessions, and authentication tokens may keep users or applications running temporarily, but eventually those sessions or tokens expire and need to be validated or refreshed,” he adds.
Why outages attract attackers
Outages are prime conditions for phishing and social engineering. Users are already expecting password resets and unusual login methods — so a fake one doesn’t stand out.
Hartnett warns that the urgency, confusion, and anxiety of a cloud outage are precisely the opportunity attackers want. “When a major service goes down, cybercriminals step in with fake ‘access restored’ notifications, fraudulent password reset prompts, or impersonations of IT help desk staff offering quick workarounds,” he adds.
There’s a structural problem underneath it, too. Most enterprises now rely on a single identity provider for email, VPN, and CRM logins. That simplifies password management and policy — but it concentrates risk, because one IdP failure can expose every application connected to it.
Recovery is its own risk window, Hartnett warns. “In a rush to restore access, temporary workarounds might grant overly broad privileges, expose credentials, or bypass established security controls. If these temporary changes are not carefully tracked and removed after normal service returns, they can leave lasting security gaps in your environment that attackers can exploit later,” he adds.
How to get ahead of the next outage
Security experts say phishing-resistant MFA is the key foundation. It replaces SMS and push notifications with cryptographic origin binding, such as passkeys.
According to Adaptive Security, a US-based firm, it’s the only authentication categoryOpens a new window CISA and NIST consider effective against modern account hijacking. Hartnett explains why: phishing-resistant methods like passkeys are cryptographically bound to a specific, legitimate website domain. “They simply will not work on a fake phishing page, even if an attacker builds a convincing copy of your login screen,” he adds.
Garcia recommends setting up trusted communication channels for outages so employees know exactly where legitimate recovery instructions will come from — and where they won’t. He also urges security teams to raise monitoring during and right after an outage, so the wave of legitimate logins during recovery doesn’t become a cover for malicious ones.
For lean IT teams, the priorities scale down cleanly: get phishing-resistant MFA in place, decide in advance how you’ll communicate during an outage, and watch the recovery window as closely as the outage itself.
The numbers make the case. According to Proofpoint’s 2026 reportOpens a new window , of the 67% of organizations that suffered a successful cloud account takeover, 59% had MFA enabled on the compromised accounts. Proofpoint also warns that post-takeover risk grows with the sprawl of AI-enabled apps — the number of AI-enabled consented apps jumped 2,100% in under a year, from 11,290 to 258,033.
For IT teams, the key takeaway is straightforward: even a well-established identity and access management system can fail. True strength comes from planning for failure by using phishing-proof multi-factor authentication, communicating clearly when systems go down, and staying alert while fixing problems — instead of hoping the next failure will be different.
