See how cyberattackers gain access by abusing identity, credentials, sessions, and permissions—and what to fix first.