Credential theft and phishing expose identity gaps in digital security

At a glance

What this is: This is a conference recap about the identity and communications risks that dominate digital security, with phishing, credential theft, and unsafe information exchange identified as the main exposure points.

Why it matters: It matters because human identity controls, email trust, and web transport protections still form the front line for both IAM programmes and broader security operations.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts.
• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.

👉 Read GlobalSign's discussion of phishing, authentication, and secure communications

Context

Human identity remains the easiest target when organisations rely on passwords, shared inboxes, and unencrypted communications. In this case, the problem is not only phishing itself but the trust model behind it: credentials are treated as durable proof of identity even when users reuse them, write them down, or expose them in transit.

For IAM teams, the real issue is that authentication, email integrity, and transport security are often handled as separate concerns even though attackers chain them together. A weak login becomes a phishing success, which becomes unauthorized access, which becomes data exposure if email and web traffic are not protected end to end.

Key questions

Q: How should security teams reduce account takeover risk from phishing sites?

A: Security teams should combine phishing-resistant authentication, domain monitoring, redirect analysis, and post-login session inspection. The goal is to detect when a user authenticated through a spoofed path or when a valid session behaves unlike the user’s normal pattern. Authentication alone is not enough if the attacker can steal cookies, tokens, or reused credentials.

Q: Why do signed emails matter when phishing is still the main threat?

A: Signed emails matter because phishing succeeds by impersonating trusted senders, not just by delivering malicious content. A signature helps the recipient verify that the message came from the expected identity and was not altered in transit, which is essential for approvals, finance, and sensitive internal communication.

Q: What breaks when organisations rely on TLS but weak passwords remain in use?

A: TLS protects the channel, but it does not stop a user from handing over a password to an attacker or reusing that password elsewhere. In practice, that means the attacker can still log in through legitimate systems, making transport encryption necessary but insufficient for identity security.

Q: Who is accountable when phishing leads to account compromise?

A: Accountability is shared, but security leadership owns the control environment that made impersonation succeed. Email authentication, browser trust configuration, access scoping, and incident reporting are governance responsibilities, not just end-user habits. If phishing can repeatedly turn into compromise, the control model is failing at the organisational level.

Technical breakdown

Why password reuse turns phishing into account takeover

Password reuse converts a single stolen credential into a broader identity compromise because the attacker already has a valid username and secret pair. Phishing works well in this model because the attacker does not need to defeat the authentication system technically, only persuade the user to hand over a reusable secret. Once the password is obtained, the attacker can test it across corporate and personal services, often starting with the email account that reveals the rest of the identity footprint. This is a human identity failure mode, not a tooling problem.

Practical implication: enforce phishing-resistant authentication and remove reusable passwords where possible.

How S/MIME changes email trust and message integrity

S/MIME adds message signing and encryption to email so recipients can verify who sent the message and whether the content changed in transit. That matters because phishing often succeeds by impersonating a trusted sender, and encrypted channels alone do not establish message authenticity. In governance terms, S/MIME shifts email from an unauthenticated transport to a verifiable identity channel, which is especially relevant where email is used for approvals, payment instructions, or sensitive exchanges. It does not stop all phishing, but it raises the cost of impersonation.

Practical implication: prioritise signed email for high-risk workflows and sensitive internal communications.

Why SSL/TLS is necessary but not sufficient for secure web identity

SSL/TLS protects data in transit and helps confirm that the browser is talking to the intended site, but it does not validate whether the user is legitimate or whether the endpoint is trustworthy. That distinction matters because encryption alone cannot stop credential phishing, session theft, or fake login pages that mimic real services. The operational takeaway is that web encryption is a baseline control, while authentication quality and domain trust still determine whether the identity interaction is secure. Strong transport without strong identity remains an incomplete control plane.

Practical implication: treat TLS as the transport baseline, then layer stronger authentication and domain verification on top.

Threat narrative

Attacker objective: The attacker aims to steal identity, impersonate trusted communication channels, and extract sensitive corporate information without raising immediate suspicion.

1. Entry begins with a convincing phishing email or a reused password exposed through poor user handling, giving the attacker a foothold in the human identity layer.
2. Escalation follows when the attacker leverages valid credentials to access email, internal systems, or identity-linked services that trust the account without additional proof.
3. Impact occurs when the attacker intercepts sensitive information, impersonates trusted senders, or triggers downstream malware and data loss across corporate communications.

Breaches seen in the wild

• Cisco Active Directory credentials breach — Kraken ransomware group leaked Cisco Active Directory credentials.
• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential reuse is the hidden multiplier in phishing-driven identity compromise. When users reuse passwords across personal and corporate accounts, a single theft becomes multi-system exposure rather than a one-off event. That is why phishing remains effective even when organisations believe they have basic authentication in place. The governance conclusion is simple: shared secrets turn human identity into a reusable attack surface.

Email authenticity, not just email encryption, is what determines trust. S/MIME matters because phishing succeeds by impersonation before it succeeds by malware or exfiltration. If recipients cannot verify who sent a message, transport security alone is only protecting the envelope, not the sender. IAM and security teams should treat signed mail as a control for trust-bound workflows, not as an optional add-on.

Transport encryption does not compensate for weak identity proofing. SSL/TLS protects data in motion, but it does not stop the attacker from logging in with stolen credentials or luring users into fraudulent sites. That is why human IAM, secure email, and web trust controls need to be designed together instead of separately. Practitioners should think in terms of identity assurance across the full communication path.

Phishing readiness is a lifecycle problem, not a single-control problem. Users who share passwords, reuse them, or keep accepting suspicious messages are operating inside a governance gap that spans onboarding, training, and account recovery. The right frame is not only technical enforcement but persistent identity hygiene. Teams should measure whether identity assurance survives ordinary user behaviour, not idealised policy.

Identity trust has to be explicit at every handoff point. The article points to a wider pattern that now affects humans, service accounts, and AI-driven workflows alike: trust breaks where one channel is assumed to prove another. That makes authentication strength, message signing, and secure transport part of one governance system. Practitioners should align these controls before attackers do it for them.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• From our research: 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to the Ultimate Guide to NHIs.
• For a broader breach context, the 52 NHI breaches Report shows how exposed credentials and weak lifecycle controls repeatedly turn access into compromise.

What this signals

The practical signal here is that identity assurance cannot be treated as a single login problem. As phishing gets more localised and credential theft becomes easier to operationalise, the organisations that fare better will be the ones that can prove who is trusted at the message, account, and transport layers at the same time.

Identity trust debt: when passwords, email authenticity, and web trust are managed as separate programmes, attackers exploit the gaps between them. That is now relevant to human IAM, NHI governance, and agentic access models because every identity type depends on the same assumption that the channel itself can be trusted.

With only 5.7% of organisations having full visibility into their service accounts, per the Ultimate Guide to NHIs, the same visibility gap that weakens human identity controls is already present in machine identity programmes. Teams should expect convergence pressure on IAM and NHI governance, not separate remediation tracks.

For practitioners

• Remove password reuse risk at the source Prioritise phishing-resistant authentication for employees, contractors, and administrators, then block or step up access when reused credentials are detected across enterprise and personal accounts.
• Deploy signed email for sensitive workflows Use S/MIME for approvals, payment instructions, and other high-trust message flows so recipients can verify sender identity and message integrity before acting.
• Treat TLS as a baseline, not a complete control Keep web encryption in place, but pair it with domain validation, MFA, and browser-side anti-phishing controls because encrypted traffic can still carry fraudulent identity interactions.
• Review identity recovery and offboarding paths Check whether password resets, mailbox recovery, and account recovery steps can be abused after a phishing event, then tighten those paths for high-risk users and privileged roles.

Key takeaways

• Phishing remains effective because reused passwords and weak identity assurance make human accounts easier to impersonate.
• Only 5.7% of organisations have full visibility into their service accounts, which shows how limited identity oversight often is across both human and non-human programmes.
• Teams should combine strong authentication, signed email, and transport encryption because no single control stops every stage of the attack chain.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Email signing: A method that attaches a verifiable cryptographic signature to a message so the recipient can confirm the sender and detect tampering. It is a trust control for communication, especially where approvals, instructions, or sensitive information move by email.
• Transport encryption: Protection applied to data while it moves across a network, usually through TLS. It prevents easy interception of contents in transit, but it does not prove the user is legitimate or guarantee the message itself is trustworthy.
• Credential Reuse: Credential reuse happens when the same password, token, or secret can unlock multiple systems or sessions. It increases breach impact because one stolen credential can become a wide-ranging access path. The control problem is not only theft, but the amount of trust packed into each reusable secret.

What's in the full article

GlobalSign's full post covers the practical detail this summary intentionally leaves at a higher level:

• Examples of how certificate-based authentication reduces exposure from password reuse and weak login habits
• A closer look at S/MIME for message signing and encryption in high-trust email workflows
• Specific explanations of SSL/TLS validation and why transport encryption alone does not stop phishing
• The event discussion themes that prompted the original presentation in a government and enterprise audience

👉 The full GlobalSign post covers the authentication, email protection, and SSL/TLS detail behind the presentation.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or IAM maturity in your organisation, it is worth exploring.