Attack path management: Why identity has become the primary security battleground