Credential misuse at scale is now the default identity risk

At a glance

What this is: Delinea’s monthly outlook argues that credential misuse, not exploitation, is now the default route into production systems, and that identity abuse often remains invisible until impact.

Why it matters: IAM, PAM, and NHI teams need to treat visibility, lifecycle governance, and authorization monitoring as the controls that determine how far valid access can spread before it is contained.

By the numbers:

• Of the 1,870 CVEs reported industry-wide, 360 were identity-related, with 16 directly impacting identity providers, access management platforms, and authentication services.

Context

Credential misuse at scale describes attacks that succeed by using legitimate access such as passwords, OAuth tokens, service accounts, and other credentials already trusted by the environment. In this article, Delinea frames that pattern as the dominant identity risk, because attackers are increasingly bypassing traditional exploitation and moving directly into authenticated activity.

The governance gap is not only exposure. It is the delay between credential compromise, token reuse, and detection, which lets attackers move laterally or persist without triggering user-centric controls. For IAM and NHI programmes, that shifts the control question from initial login to lifecycle containment and authorization visibility.

January 2026 is presented as a typical month rather than an outlier, which makes the article more useful: it reflects a routine operating condition in which identity misuse can blend into normal access activity before defenders notice the damage.

Key questions

Q: What breaks when stolen credentials are the main entry point for breaches?

A: When stolen credentials become the primary entry point, traditional perimeter and exploit-focused controls lose much of their value because the attacker is already authenticated. Defenders then need stronger context checks, tighter privilege boundaries and faster revocation. The real failure is assuming authentication success means legitimate access, which is no longer true in credential-heavy breach patterns.

Q: Why do service accounts and OAuth tokens increase breach impact in cloud environments?

A: Because they often carry standing access to more than one system and are trusted by the platforms they connect. That makes them ideal for lateral movement after compromise. In cloud and SaaS environments, the issue is not only that these identities exist, but that their scope is usually broader and their monitoring weaker than human access.

Q: How can teams tell whether identity misuse is being missed?

A: Look for access that is technically valid but operationally odd, such as automation using credentials outside expected workflows, credentials reused long after issuance, or authentication events that do not match the subject’s normal business purpose. Those patterns usually indicate that monitoring is too user-centric and not broad enough for machine access.

Q: What should organisations do when credential misuse happens before impact?

A: Containment has to start with revocation, scope reduction, and review of all dependent access paths. If the same credential can be reused across SaaS, cloud, or automation workflows, the incident is bigger than one account. Teams should assume connected permissions may also be compromised and validate them in sequence.

Technical breakdown

Why valid credentials now beat exploitation

Attackers prefer valid credentials because they inherit the target’s trust relationships. Once a service account, OAuth token, or password is accepted, the attacker can operate through normal authentication paths instead of noisy exploit chains. That changes the security problem from blocking entry to constraining what trusted access can do once used. It also explains why identity-centric attacks can remain invisible in logs until a downstream action, such as data theft or encryption, creates an obvious signal. The article’s core mechanism is not that exploitation disappeared, but that credentialed access is now more reliable, scalable, and harder to distinguish from legitimate use.

Practical implication: Treat authenticated access paths as primary attack surfaces, not secondary evidence of compromise.

How automation identities become identity brokers

The article’s n8n example shows how an automation platform can become a broker of trust across connected systems. Malicious community nodes harvested OAuth tokens and embedded secrets, then used those credentials to pivot laterally across SaaS environments without touching individual user accounts. That pattern matters because the platform itself sits inside approved business workflows, which means abuse can inherit both technical permissions and operational legitimacy. For defenders, the risk is not just the stolen secret. It is the ability of trusted automation to move access across systems while staying inside expected workflow behaviour.

Practical implication: Inventory automation surfaces that can exchange tokens or secrets across SaaS and cloud services.

Why identity-related vulnerabilities amplify blast radius

The article notes 360 identity-related CVEs out of 1,870 total, including flaws in token validation, trust relationships, and authentication logic. These vulnerabilities are dangerous because they do not merely expose a system component. They alter how far an attacker can extend already obtained access. A pre-authentication workflow takeover, JWT signature bypass, or privilege escalation flaw can turn one credential into many reachable systems. In identity security terms, the issue is blast radius expansion. Once access exists, the quality of validation and authorization logic determines whether compromise stays local or spreads across tenants and connected services.

Practical implication: Prioritise identity infrastructure flaws that widen trust boundaries or let one credential fan out into multiple systems.

Threat narrative

Attacker objective: The attacker aims to obtain durable authenticated access that can be reused later for lateral movement, persistence, and extortion without triggering traditional exploit alarms.

1. Entry occurs through valid credentials, OAuth tokens, or compromised service accounts rather than through exploit-heavy initial access.
2. Credential misuse is then amplified when automation platforms or identity systems accept the stolen trust material and permit authenticated use.
3. Escalation follows when the attacker reuses collected credentials weeks or months later, or when identity logic flaws expand the blast radius of the original access.
4. Impact is delayed detection, lateral movement across connected services, ransomware enablement, and data theft after the access has already blended into normal activity.

Breaches seen in the wild

• JADEPUFFER agentic ransomware 2026: The first documented agentic ransomware used harvested keys, default MinIO credentials and a default Nacos signing key to wipe a database.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential misuse has replaced exploitation as the default identity risk: the article shows that attackers increasingly prefer trusted access paths over noisy technical break-ins. That matters because the first security failure is no longer login prevention, it is the environment’s willingness to trust credentials long after they have been exposed. Practitioners should read this as a signal that identity governance is now a frontline security control, not a back-office hygiene function.

Automation identities are now part of the primary attack path, not a side case: when a workflow platform can hold OAuth tokens, embedded secrets, and cross-service permissions, it becomes an identity broker. The governance problem is that many organisations still treat automation as operational plumbing rather than as an access-bearing subject. The implication is simple: every workflow that can move credentials is already participating in privilege distribution.

Identity-related CVEs create blast-radius problems, not just patching problems: the article’s 360 identity-related disclosures matter because flaws in validation, trust, and authorization determine how far valid access can spread. That is a different risk model from ordinary vulnerability management. The field should think in terms of identity blast radius, where one weakness can convert a single credential into broad tenant or service exposure.

Lifecycle governance now determines whether credential misuse becomes chronic: Delinea’s observations on delayed reuse show that stolen credentials are often operationally active long after the original event. That means offboarding, rotation, and revocation are not only cleanup tasks, they are containment mechanisms. For IAM and NHI teams, the real question is how quickly stale access stops being reusable at scale.

Access reviews alone are not enough when misuse happens between review cycles: the article reinforces a hard truth for governance programmes. If identity abuse is authenticated, automated, and delayed, periodic review cannot be the only detection layer. The practical conclusion is that identity monitoring must move closer to issuance, token use, and unusual authorization behaviour, or the review process will always arrive after the compromise window has closed.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
• Read next: Guide to the Secret Sprawl Challenge

What this signals

Identity blast radius: the next governance problem is not simply whether a credential is stolen, but how many systems that credential can still reach before revocation. Programmes that centralise authentication but leave authorization scope broad will keep seeing delayed misuse because the access model, not just the secret, determines exploitability.

Visibility has become a control dependency, not a reporting nice-to-have. With only 5.7% of organisations having full visibility into their service accounts, identity teams cannot rely on periodic reviews alone to spot reuse, lateral movement, or stale access before attackers do.

For practitioners

• Strengthen continuous identity telemetry Correlate logins, token use, service-account activity, and automation events so misuse is visible before impact, not after a breach response begins.
• Review automation platforms as identity brokers Map which workflow tools can mint, store, or forward OAuth tokens and embedded secrets, then remove unnecessary cross-service access paths.
• Prioritise identity infrastructure vulnerabilities Triage flaws in token validation, trust relationships, and authentication logic ahead of lower-risk application bugs because they expand blast radius once access exists.
• Tighten lifecycle governance for machine access Set explicit expiry, ownership, and revocation triggers for service accounts and other non-human identities so old credentials cannot be reused weeks later.
• Reduce standing privilege in connected systems Limit the scope of credentials that can reach multiple SaaS or cloud services, especially where one credential can move through automation workflows.

Key takeaways

• Credential misuse now matters more than initial exploitation because authenticated access can look legitimate until the attacker has already moved.
• The article’s examples show that automation platforms and identity logic flaws can expand blast radius far beyond the first stolen credential.
• Containment depends on lifecycle governance, scoped authorization, and continuous visibility into service accounts, tokens, and other non-human identities.

Key terms

• Credential misuse: Credential misuse is the abuse of valid authentication material by an attacker who does not need to break a login flow. In practice, it includes stolen tokens, reused secrets, and compromised service accounts that allow the attacker to operate as trusted identity traffic.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Automation Identity: A non-human identity used by a workflow, script, or orchestration platform to perform actions in other systems. It is not the automation tool itself. The identity needs ownership, scoping, rotation, and retirement because its permissions define the real blast radius.
• Lifecycle Governance: Lifecycle governance is the set of controls that cover creation, assignment, review, rotation, and retirement of identities and credentials. For NHIs, it is the difference between a temporary automation asset and a persistent access risk. Strong lifecycle governance keeps ownership and expiry tied to actual business use.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.