Defending against evolving identity attack techniques