Identity Attack Statistics Guide: Credential Abuse, MFA Bypass and Account Takeover

Identity attack statistics are among the most quoted numbers in security, and among the most often detached from the report, year and population that produced them. This page collects figures on credential abuse, password attacks, MFA adoption and bypass, and account takeover directly from the publishers' own reports: the Verizon Data Breach Investigations Report (DBIR), the Microsoft Digital Defense Report, CISA's Risk and Vulnerability Assessment analysis, the Google Cloud Threat Horizons Report, Okta's Secure Sign-in Trends Report and others. Every figure carries the report name, publisher and edition year in the same sentence or table row, and figures we could not trace to a primary source are left out. It is written for identity and security operations teams, architects and leaders building a case for phishing-resistant MFA, identity threat detection or credential hygiene. Last reviewed: October 2026.

Key takeaways

• Passwords are still the main identity attack. The Microsoft Digital Defense Report 2025 states that more than 97% of identity attacks are password attacks, and that identity-based attacks rose 32% in the first half of 2025.
• MFA works, but adoption lags. Microsoft's 2025 report says MFA can block over 99% of identity-based attacks, yet Okta's Secure Sign-in Trends Report 2025 finds only 70% of workforce users on MFA and 14.0% on phishing-resistant methods.
• Credential abuse dropped in rank, not in importance. The Verizon 2026 DBIR finds credential abuse in 13% of breaches as the initial access vector, now behind vulnerability exploitation at 31%, but credentials are still compromised data in roughly a quarter or more of breaches in most sectors it reports.
• Valid accounts dominate tested and real intrusions. CISA's FY23 Risk and Vulnerability Assessment analysis found Valid Accounts behind 41% of successful initial access in 143 assessments, and Mandiant attributed 21% of H2 2025 cases to stolen human and non-human identities in the Google Cloud Threat Horizons Report H1 2026.
• Attackers now go around MFA. The CrowdStrike 2026 Threat Hunting Report records a 15x spike in monthly device code phishing attempts, and the Google Threat Horizons Report H1 2026 attributes 17% of Mandiant cases in H2 2025 to voice phishing.

Headline statistics

The table gives the identity figures most often requested, each from the latest edition we could read on the publisher's own site in October 2026.

Statistics by theme

Credential abuse and valid accounts

• Breach entry: the Verizon 2026 DBIR describes credential abuse as "the previous leader" among initial access vectors, now at 13% of breaches against 31% for vulnerability exploitation.
• Regional spread: the same 2026 DBIR finds credential abuse as the entry point in 25% of EMEA breaches and 20% in Latin America and the Caribbean, but only 6% in APAC and 5% in Northern America. A global average hides very different regional pictures.
• Assessments: CISA's analysis of its FY23 Risk and Vulnerability Assessments (published September 2024) found Valid Accounts, MITRE ATT&CK T1078, behind 41% of successful initial access attempts, and the same technique in 42% of persistence and 45% of privilege escalation instances. The US Coast Guard assessments in the same report found default passwords at 94.4% of assessed entities.
• Incident response: the Microsoft Digital Defense Report 2025 CISO Executive Summary gives valid accounts as 17% of initial access vectors in Microsoft incident response (DART) engagements.
• Cloud and SaaS: the Google Cloud Threat Horizons Report H1 2026 attributes 21% of Mandiant cases in H2 2025 to stolen human and non-human identities, and in Google Cloud's own data weak or absent credentials gave initial access in 27.2% of H2 2025 incidents (47.1% in H1).

All figures in the table are from the Verizon 2026 DBIR Executive Summary. See the Password Spraying and Credential Stuffing Defence Guide.

Password attacks, infostealers and credential theft

• Password attacks: more than 97% of identity attacks are password attacks, according to the Microsoft Digital Defense Report 2025, which covers July 2024 to June 2025. These include password spraying (T1110.003) and credential stuffing (T1110.004).
• Credential theft after access: the Microsoft Digital Defense Report 2026 finds follow-on credential theft in 52.2% of intrusions that began with a valid account, and that 89% to 95% of email phishing attachments led to a credential theft attempt.
• Infostealers: the IBM X-Force Threat Intelligence Index 2026 reports that infostealer malware exposed more than 300,000 ChatGPT credentials in 2025, which shows AI platforms now carry the same credential risk as other SaaS. See the Infostealer Threat Guide.

The 23andMe breach shows how this plays out: credential stuffing over about five months in 2023 reached more than 18,000 accounts directly and data on almost 7 million people, with MFA optional and enabled by fewer than 22% of customers.

MFA adoption and effectiveness

Okta's Secure Sign-in Trends Report 2025, published 9 December 2025 and based on anonymised Okta Workforce Identity data as of January 2025, is the most detailed recurring adoption source we could read.

• Effectiveness: the Microsoft Digital Defense Report 2025 states that MFA can block over 99% of identity-based attacks and that phishing-resistant MFA can stop over 99% of these attacks even when attackers hold valid credentials.
• Size effect: Okta's 2025 report finds an inverse relationship between company size and MFA adoption, with organisations of 1,250 to 3,999 employees at 77% and 4,000 to 19,999 at 71%.
• Third parties: the Verizon 2026 DBIR finds that only 23% of third-party organisations fully remediated missing or improperly secured MFA on their cloud accounts.

See the Phishing-Resistant MFA Guide and the Top 10 MFA Mistakes.

MFA bypass, social engineering and session theft

• Voice phishing: the Google Cloud Threat Horizons Report H1 2026 attributes 17% of Mandiant cases in H2 2025 to voice phishing (T1566.004) and 12% to email phishing. The Microsoft Digital Defense Report 2026 says 93% of voice phishing attacks kept the victim on the line long enough to begin social engineering. See the Account Recovery and Help Desk Security Guide.
• Device code phishing: the CrowdStrike 2026 Threat Hunting Report (July 2025 to June 2026) records a 15x spike in monthly device code phishing attempts, a technique that ends with the attacker holding valid tokens (T1528, Steal Application Access Token).
• Adversary-in-the-middle kits: the Microsoft Digital Defense Report 2026 reports that Tycoon2FA activity fell 95% from its November 2025 peak after a March 2026 disruption, with its share of CAPTCHA-gated phishing falling from 76% to 12%. These kits steal session cookies (T1539) to get past MFA.
• Speed: the CrowdStrike 2026 Global Threat Report gives 27 seconds as the fastest eCrime breakout time in 2025, which leaves little room for manual response once an identity is taken.

The Uber breach of September 2022 combined a contractor password bought on the dark web with repeated MFA push requests (T1621) until one was accepted. See the MFA Fatigue and Bypass Guide and the Session Hijacking and Cookie Theft Guide.

Business impact of identity incidents

• Impact: the Identity Defined Security Alliance's 2024 Trends in Securing Digital Identities research found that 84% of identity stakeholders said identity-related incidents directly affected their business, up from 68% in 2023.
• Data theft: the Microsoft Digital Defense Report 2026 finds data theft in 63% of intrusions, and the Google Threat Horizons Report H1 2026 finds data targeted in 73% of cloud-related incidents.

What the numbers mean for defenders

The figures agree on one point: attackers prefer to log in rather than break in, and the defences that stop them are known but unevenly deployed. Microsoft's over-99% blocking figure and Okta's 14.0% phishing-resistant adoption figure, read side by side, describe the size of the gap.

In NIST CSF 2.0 these sit under PR.AA (Identity Management, Authentication, and Access Control) and DE.CM (Continuous Monitoring). See the ITDR Guide.

Turning the statistics into a programme

1. Measure your own coverage: report MFA and phishing-resistant MFA coverage by user population (staff, administrators, contractors, third parties) from your identity provider, so you can compare with the Okta figures.
2. Close the password path: block legacy authentication, enable banned-password and leaked-credential checks, and alert on spraying patterns. Run conditional access policies in report-only mode for two weeks before enforcing.
3. Move privileged users first: require FIDO2 security keys or passkeys for administrators, help desk staff and break-glass accounts, then extend in pilot rings.
4. Harden recovery: require strong verification for MFA resets and password changes requested by phone, and log every reset.
5. Restrict token flows: block device code flow where no device needs it, shorten session lifetimes for sensitive apps and revoke sessions on risk.
6. Keep a rollback: hold an exclusion group and documented break-glass accounts so a mis-scoped policy can be reverted within minutes.

Small and large organisations

Okta's 2025 data suggests larger organisations lag on MFA adoption, usually because of legacy applications and varied user groups. A small organisation can often move straight to passkeys through its identity provider. A large one should start with administrators and remote access, use an ISPM tool to find accounts outside policy, and add identity threat detection for the remainder. See the ISPM Guide.

Metrics worth tracking

• Phishing-resistant coverage: percentage of users and of privileged users on FIDO2, passkeys or smart cards.
• Legacy authentication: sign-ins using protocols that cannot do MFA, trending to zero.
• Password attack volume: blocked spraying and stuffing attempts per week, and successful sign-ins from leaked credentials.
• Recovery abuse: MFA resets per month and the share verified by a strong method.
• Response: median time from a high-risk sign-in to session revocation.

Common failure patterns when using identity statistics

• Quoting "99% blocked" as a guarantee: Microsoft's figure is about attacks blocked by MFA in its telemetry; it does not cover voice phishing of the help desk or stolen session tokens.
• Reading the DBIR fall as good news: credential abuse fell to 13% of breach entry in the 2026 DBIR because exploitation rose, not because credentials became safe. The Snowflake breach was driven by infostealer credentials on accounts without MFA.
• Mixing tests and attacks: CISA's 41% is from authorised assessments in FY23, Mandiant's 21% from incident response in H2 2025. Both are valid; they are not the same measure.
• Counting MFA as one thing: Okta's 70% MFA figure includes SMS, which 15.3% of users still rely on. Report phishing-resistant coverage separately.
• Forgetting non-human identities: Mandiant's stolen-identity figure covers human and non-human identities together. Service accounts and tokens need their own inventory. See the Non-Human Identity and Secrets Statistics Guide.

Methodology notes and caveats

When a new edition appears, replace the whole row and year rather than mixing editions in one comparison. See the Account Takeover Prevention Guide for the controls behind these figures.

Practitioner checklist

• Quote each figure with its report, publisher and edition year, and say whose users or cases it describes.
• Report MFA and phishing-resistant MFA coverage separately for staff, administrators, contractors and third parties.
• Block legacy authentication and enable leaked-credential and banned-password checks.
• Require phishing-resistant MFA for administrators, help desk staff and remote access first.
• Require strong identity verification for every MFA reset and password change requested by phone.
• Block device code flow where it is not needed and shorten session lifetimes for sensitive applications.
• Remove default credentials and disable dormant accounts, human and non-human.
• Alert on spraying, impossible travel, new MFA methods and token reuse, and rehearse session revocation.
• Recheck this page's figures after each annual release before reusing them.

Standards and references

• CISA: Analysis of Fiscal Year 2023 Risk and Vulnerability Assessments
• Verizon: 2026 Data Breach Investigations Report Executive Summary
• Microsoft On the Issues: Microsoft Digital Defense Report 2025
• Microsoft: Digital Defense Report 2026
• Google Cloud: Cloud Threat Horizons Report H1 2026
• Okta: The Secure Sign-in Trends Report 2025
• CrowdStrike: 2026 Threat Hunting Report
• IBM: 2026 X-Force Threat Intelligence Index

Related NHI Mgmt Group resources: Cloud Security Statistics Guide · Phishing Statistics Guide · MFA Guide · Account Takeover Prevention Guide · ITDR Guide