TL;DR: Credential misuse remains one of the most common breach paths, with 61% of breaches involving compromised credentials, while phishing and push-bombing continue to defeat weak identity controls according to Silverfort. The decisive issue is not awareness but whether IAM programmes can enforce universal MFA, Zero Trust access checks, privileged account hardening, hygiene, and monitoring before valid credentials become an attacker foothold.
At a glance
What this is: This is a practitioner analysis of why stolen credentials still drive breaches and why layered identity controls, especially MFA and monitoring, remain uneven in real environments.
Why it matters: It matters because IAM, PAM and NHI programmes fail when valid credentials are still enough to cross trust boundaries, escalate access or remain undetected for weeks.
By the numbers:
- 61% of all breaches involve the misuse of credentials.
Context
Credential abuse is still one of the most reliable ways into enterprise environments because a valid login looks normal until it is used in the wrong way. The governance problem is not just theft, but the persistence of trust once a credential is accepted.
For IAM and PAM teams, the core failure is that access decisions often stop at authentication while attackers use phishing, push-bombing and dormant accounts to turn that single success into broader reach. The article’s own examples point to a control stack problem, not a single missing product.
Key questions
Q: What breaks when MFA is not enforced on every remote access path?
A: When MFA is inconsistent, a stolen password can still function as a valid enterprise login, which gives attackers a low-friction entry point into critical systems. That failure is especially dangerous in legacy portals and hybrid environments, where exceptions often persist longest and are hardest to audit.
Q: Why do stolen credentials remain such an effective attack path?
A: Stolen credentials work because many systems still treat a successful login as enough evidence of legitimacy. Once an attacker has valid access, they inherit the subject’s trust context and can often blend in with normal activity. That makes credential theft far more efficient than direct exploitation in many environments.
Q: What are the signs that access governance is failing to stop credential abuse?
A: Common warning signs include repeated failed logins, unusual access outside normal hours, excessive permissions, stale accounts, weak separation of duties, and privileged activity that is not reviewed or recorded. If access reviews are irregular or approvals are treated as a formality, governance is probably drifting out of control. Those gaps often appear before a breach becomes visible.
Q: How should teams respond when a privileged account is suspected of misuse?
A: Contain the account first by removing access, reviewing recent authentication trails and checking for other identities that share the same privileges or trust relationships. Privileged accounts can amplify one compromise into broad access, so containment has to focus on the blast radius, not just the single login event. Offboarding and revalidation should follow immediately.
Technical breakdown
Why stolen credentials remain an effective entry path
Stolen credentials work because they bypass many perimeter assumptions and arrive as legitimate authentication events. Once an attacker has a password, token or approved MFA prompt, the system may treat the session as genuine unless additional context is checked. Phishing and push-bombing exploit human response, while legacy systems and inconsistent MFA coverage create pockets where a single credential is enough. In identity terms, the weakness is not login volume but trust granted too early, before the access path is evaluated against device, location, role and session risk.
Practical implication: treat credential acceptance as the start of control enforcement, not the end of it.
How MFA fails when it is not universal or phishing resistant
MFA reduces risk only when it is enforced everywhere and when the second factor cannot be easily coerced. Push fatigue attacks exploit repeated prompts until a user approves one, turning MFA into a consent mechanism rather than a proof mechanism. That is why phishing-resistant methods matter more for high-risk access, especially admins and sensitive systems. Coverage gaps also matter: if web apps are protected but databases, command-line tools or on-premises systems are not, attackers simply move to the weaker path.
Practical implication: extend phishing-resistant MFA to every feasible access path, not just the obvious SaaS entry points.
Why privileged and stale accounts change the blast radius
Privileged accounts, service accounts and abandoned user accounts concentrate risk because they combine reach with low scrutiny. A former admin account or a dormant login can preserve access long after the original business relationship has changed. In practice, that means credential abuse becomes a blast-radius problem as much as an authentication problem. If admin policies, offboarding and account hygiene are weak, attackers do not need sophisticated lateral movement to cause damage; they only need a credential that was never retired or constrained.
Practical implication: inventory privileged and stale identities continuously, then remove standing access before it can be reused.
Threat narrative
Attacker objective: The attacker wants durable, low-noise access that looks legitimate long enough to steal data, expand reach and avoid early detection.
- Entry occurs when attackers obtain valid credentials through phishing, push-bombing or reuse of compromised passwords.
- Credential use succeeds because the login appears legitimate and the target environment lacks sufficient MFA coverage, contextual checks or prompt verification.
- Escalation happens when the attacker reaches privileged, legacy or stale accounts that were not hardened or removed.
- Impact follows as the intruder accesses sensitive systems for extended periods, causing downtime, compliance issues and broader compromise.
Breaches seen in the wild
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
- Cisco Yanluowang breach 2022: A password synced to a personal Google account plus vishing and MFA fatigue opened Cisco's VPN; the attacker then abused machine accounts.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Credential abuse is now a governance failure, not just an authentication failure. Once a stolen password or approved MFA prompt is accepted, the programme has already lost the first decision point. The real question is whether identity controls continue to challenge the session after login, because that is where modern attacks gain persistence and reach. Practitioners should treat access acceptance as a monitored event, not a trust handoff.
Universal MFA is a baseline only when it reaches every resource and protocol. The article makes clear that partial deployment leaves attackers a path through legacy systems, service interfaces and privileged workflows. MFA coverage gaps are no longer edge cases, they are attack routes. Identity governance teams need to think in terms of coverage completeness, not policy existence.
Ephemeral trust debt: temporary approval and short-lived authentication events can still create long-lived compromise when detection lags. The concept matters because push fatigue, stale accounts and delayed monitoring all convert a brief access decision into extended exposure. The implication for the field is that identity security has to measure how long trust survives after issuance, not just how strong the initial factor was.
Privileged access hardening and identity hygiene are now inseparable from breach prevention. Admin accounts, service accounts and abandoned user accounts create the highest-value reuse opportunities for attackers. That means lifecycle governance and privileged access governance are one operating model, not separate workstreams. Practitioners should prioritise the identities whose compromise would change the blast radius the fastest.
Identity monitoring must be designed to catch legitimate credentials behaving illegitimately. Traditional detection that waits for malware or noisy exploitation will miss quiet misuse of valid accounts. The article’s emphasis on continuous monitoring reflects a broader shift: identity telemetry is now the primary signal for compromise detection in environments where the attacker logs in rather than breaks in. Teams should build response around authentication anomalies, not only endpoint alerts.
What this signals
Credential abuse is now best understood as a lifecycle problem. Accounts that are created, approved and left in place without continuous challenge become reusable attack assets. That is why identity programmes need tighter issuance, shorter trust windows and better offboarding discipline across both human and machine identities.
The practical shift for security teams is away from isolated login protection and toward continuous identity assurance. MFA still matters, but it only works as part of a broader model that watches for unusual use, stale access and privilege misuse after authentication.
For practitioners
- Enforce universal MFA coverage Close all remaining gaps across cloud, on-premises, admin and legacy access paths so a single password cannot authenticate on its own.
- Prioritise phishing-resistant factors for privileged access Use FIDO2 keys or number-matching prompts where approval fatigue is likely, especially for administrators and high-impact systems.
- Harden and separate privileged accounts Require dedicated admin accounts, limit where they can be used and apply stronger policy checks before any elevated session is granted.
- Eliminate stale and offboarded identities quickly Continuously inventory human and non-human accounts, then disable dormant or departed-user access before it can be reused.
- Monitor authentication behaviour continuously Correlate login logs, location changes, unusual resource access and repeated prompts so suspicious credential use is detected while the session is still active.
Key takeaways
- Credential abuse continues to work because attackers can turn legitimate logins into trusted sessions before defenders detect the misuse.
- The article cites 61% of breaches involving compromised credentials, which shows how common the attack path remains even when awareness is high.
- The strongest countermeasure is layered identity governance that combines universal MFA, privileged account hardening, hygiene and continuous monitoring.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centres on stolen credentials, phishing and push-bombing as authentication failures. |
| NHI-05 — Overprivileged NHI | Privileged and high-risk accounts expand the blast radius of credential abuse. | |
| NHI-07 — Long-Lived Secrets | Dormant credentials and unrevised passwords stay usable long after compromise or departure. | |
| Recommendation — Strengthen authentication paths so valid credentials alone cannot establish trusted access. Reduce standing privilege on high-impact accounts and constrain where elevated access can be used. Rotate or retire stale credentials before they remain reusable in attacker hands. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article focuses on credential issuance, MFA coverage and lifecycle management. |
| Recommendation — Apply authenticator lifecycle controls to enforce MFA, rotation and revocation consistently. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post emphasises access control, privileged accounts and context-aware authorization decisions. |
| Recommendation — Review access entitlements continuously so authentication is followed by contextual authorization. | ||
| MITRE ATT&CK | TA0006;TA0004 — Credential Access; Privilege Escalation | The attacker path described begins with credential theft and can progress into elevated access. |
| Recommendation — Map credential abuse patterns to access and escalation tactics to improve detection and containment. | ||
Key terms
- Credential Abuse: Credential abuse is the use of valid secrets or accounts by an unauthorised party or for unauthorised purposes. In practice, it often looks like normal authentication unless teams correlate context, privilege, and behaviour. It is one of the most persistent ways identity failures become breaches.
- Push Bombing: Push bombing is an MFA bypass technique that overwhelms a user with repeated authentication prompts until one approval is granted. The attack depends on fatigue, distraction, or confusion, not on breaking the underlying cryptography. It is effective because many organisations still treat user approval as a trustworthy security signal.
- Shared Privileged Account: An administrative identity used by more than one operator or system process. These accounts are common in infrastructure and cloud operations, but they create accountability and lifecycle challenges because access must be tightly controlled, rotated and audited.
- Identity monitoring: Identity monitoring is the continuous observation of login behaviour, privilege use, and account activity to detect abnormal patterns. In practice, it is most valuable when tied to ownership, role expectations, and adjacent telemetry so teams can tell normal administration from suspicious use.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org