Credential theft and partial SSO gaps are exposing modern identity controls

At a glance

What this is: Unixi argues that credential theft keeps succeeding because partial SSO, unmanaged SaaS, and shared credentials leave modern identity controls with blind spots attackers can exploit.

Why it matters: IAM teams need to treat identity perimeter coverage as a control objective across human, NHI, and delegated access paths, not assume MFA or central login coverage closes the gap.

By the numbers:

• 85% of data breaches will involve social engineering by 2026, according to Gartner predictions cited by Unixi.

Context

Credential theft remains effective when the identity perimeter is incomplete. Modern IAM programmes often assume that MFA, SSO, or a managed identity provider covers the relevant access path, but the article argues that unmanaged SaaS, legacy portals, vendor accounts, and shared credentials can sit outside that boundary.

In Unixi's framing, the issue is not password use alone. The failure mode is partial coverage, where controls look broad on paper but do not extend across every login surface, leaving room for social engineering, credential reuse, and lateral movement through overlooked systems.

Key questions

Q: What breaks when only part of the environment uses SSO?

A: Partial SSO creates two security models at once: governed access for federated apps and ad hoc access for everything else. Attackers look for the unauthorised side of that split, where logging, policy enforcement, and step-up controls are weaker. The practical failure is not SSO itself, but the unmanaged exceptions that stay outside it.

Q: Why do social engineering attacks still succeed against identity support teams?

A: They succeed because many support processes still depend on discretionary human judgment, static knowledge questions, and urgency-based exception handling. Attackers exploit the gap between what staff believe is normal and what a real policy-enforced recovery process should allow. The weakness is procedural, not technical.

Q: What signs show that identity coverage is incomplete?

A: The clearest signs are separate review processes, missing activity timelines, and systems that cannot be governed without opening network paths to the control plane. When teams have partial visibility, the programme can no longer prove who had access or when it changed.

Q: When should teams replace shared credentials with named access?

A: They should do it whenever a credential is used by more than one person, team, or vendor, or when it grants administrative access to a business-critical system. Shared credentials destroy attribution, complicate offboarding, and widen blast radius, so the default should be individually attributable access unless a technical exception is unavoidable.

Technical breakdown

Why partial SSO creates an identity perimeter gap

Partial SSO means some applications authenticate through the identity provider while others remain on local credentials, shared accounts, or legacy login flows. That split creates an identity perimeter gap because policy, logging, and step-up controls are no longer uniformly enforced. Attackers do not need to defeat the strongest path if a weaker path still exists. For identity teams, the architectural issue is not whether SSO is deployed, but whether every meaningful access path is actually governed by it.

Practical implication: inventory all non-federated access paths and treat them as exceptions until they are brought under governance.

How social engineering defeats password-centric controls

Password-centric controls assume the human user is the reliable decision point, but vishing, help desk impersonation, and MFA fatigue shift that decision into the attacker’s favour. Once an operator approves or resets access on bad grounds, the control set often grants a legitimate session to the adversary. This is not a pure authentication failure. It is a process failure across identity verification, support workflows, and recovery paths, which is why incident narratives frequently include both credential theft and help desk abuse.

Practical implication: harden recovery and support workflows as privileged identity paths, not as back-office administration.

Shared and default credentials as a governance problem

Shared and default credentials persist where identity ownership is unclear, where vendor admin access is treated as a utility account, or where legacy systems cannot support per-user federation. These accounts blur accountability, prevent meaningful recertification, and expand blast radius when exposed. The technical risk is less about the credential format and more about governance drift: if multiple people or systems depend on the same secret, access reviews cannot tell who actually used it or whether it should still exist.

Practical implication: replace shared administrative access with individually attributable access paths and enforce lifecycle ownership for every exception.

Threat narrative

Attacker objective: The attacker wants legitimate-looking access that bypasses the strongest authentication layer and opens a path to privileged systems or wider compromise.

1. Entry begins with social engineering, credential theft, or support-channel abuse that gets the attacker a valid session or reset path.
2. Credential access persists because the targeted environment includes unmanaged SaaS, legacy portals, or shared admin credentials outside full identity coverage.
3. Escalation follows when the attacker uses that access to move through connected systems or privileged support functions without triggering perimeter controls.
4. Impact lands in broader account compromise, operational disruption, and the exposure of identity gaps that should have been treated as attack surface.

Breaches seen in the wild

• Okta support system breach 2023: A support service account credential saved in a personal Google profile let attackers take HAR files and hijack five Okta customers' sessions.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Partial SSO is an identity governance gap, not a convenience trade-off: When some access paths remain outside federation, security policy becomes conditional rather than universal. That breaks the assumption that a central control plane actually governs all access. The practical conclusion is that coverage, not just control quality, defines the true identity perimeter.

Credential theft succeeds where support and recovery workflows remain identity blind: Help desk reset paths, vendor admin access, and exception handling often sit outside the same assurance model as primary sign-in. Social engineering exploits that separation because the attacker targets the weakest identity verification point, not the strongest login screen. The implication is that recovery flows are part of the attack surface, not administrative back office.

Shared credentials create identity blast radius: Once one secret supports multiple users, vendors, or systems, accountability and revocation both weaken. That is why shared or default credentials are not just hygiene issues but governance defects that prevent clean offboarding and recertification. Practitioners should treat every shared secret as unowned blast radius until proven otherwise.

Identity perimeter coverage now matters more than point controls: The article's incidents point to a recurring pattern where single controls appear present while the surrounding access estate remains fragmented. This is where programmes should shift from control counting to coverage mapping across human, third-party, and machine-access paths. The right question is whether any meaningful login surface still sits outside governed identity flows.

Shadow SaaS is where modern identity control assumptions break down: Unmanaged applications can bypass SSO, logging, and conditional access even when the core IdP is well designed. That creates a governance gap that is invisible in dashboard metrics but obvious to attackers. Practitioners need to assume every unmanaged app is a potential exception path until inventory and control ownership are complete.

What this signals

Identity coverage is the real control metric: Security teams should stop treating MFA adoption as proof of identity maturity. The harder question is whether every meaningful access path, including unmanaged SaaS and support recovery, is governed by the same assurance model.

Support workflows need the same scrutiny as sign-in flows: Many credential theft incidents succeed because recovery and help desk actions can mint legitimate access for the wrong person. That means reset processes belong in the identity perimeter, not in an administrative exception bucket.

For practitioners

• Map every non-federated access path Identify SaaS, legacy portals, vendor systems, and admin consoles that still authenticate outside the IdP, then assign owners and remediation dates to each exception.
• Treat help desk resets as privileged workflows Require strong identity verification, audited approval, and escalation thresholds for password resets, MFA resets, and account recovery requests that can create valid access for attackers.
• Eliminate shared and default administrative credentials Replace common admin logins with individually attributable access, and offboard any shared secret that cannot be tied to a named owner or a specific system purpose.
• Close Shadow SaaS visibility gaps Continuously discover unmanaged applications and remote access portals, then either federate them into the identity plane or formally retire them.

Key takeaways

• Credential theft keeps succeeding where identity coverage is partial, especially when unmanaged SaaS, legacy portals, and shared accounts remain outside the governed perimeter.
• The article ties the pattern to five high-profile incidents and to Gartner's prediction that 85% of data breaches will involve social engineering by 2026.
• The practical response is to inventory every access path, harden recovery workflows, and remove shared credentials that prevent attribution and clean offboarding.

Key terms

• Identity Perimeter: The identity perimeter is the access boundary defined by who or what is requesting entry, not by where the request comes from. In zero trust, it is the point where authentication, authorization, and risk context decide whether a caller can proceed.
• Partial SSO Coverage: Partial SSO coverage means some applications and workflows are federated while others still use local or manual authentication paths. In practice, it creates a split control environment where policy, logging, and lifecycle management do not apply evenly to the whole estate.
• Support-Channel Abuse: Support-channel abuse is the use of help desk, recovery, or account reset processes to obtain legitimate access without defeating the primary login flow. It is an identity attack pattern because the adversary targets verification and recovery controls rather than the password itself.
• Shared Credential Blast Radius: Shared credential blast radius is the scope of damage created when one password, token, or admin login is used by multiple people or systems. It weakens attribution, complicates offboarding, and turns a single compromise into a multi-system governance problem.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.