Identity as the primary attack surface: What modern breaches are really exploiting