Credentials still drive most breaches, but verification is the real gap

At a glance

What this is: This is an analysis of Verizon DBIR findings showing that stolen credentials and the human element still dominate breach access patterns, with 44.7% of breaches tied to stolen credentials.

Why it matters: IAM and security teams need to treat credential possession as an insufficient control signal and focus on stronger verification, because login remains the easiest path into many environments.

By the numbers:

• The human element appears in 74% of breaches, including error, privilege misuse, stolen credentials, and social engineering.
• Stolen credentials account for 44.7% of breaches.

Context

Credentials remain a primary breach entry path because possession can be copied, shared, or stolen, while many identity controls still assume the person presenting a secret is the right person. That gap matters most in IAM, where access decisions are often still anchored to username and password verification rather than stronger identity assurance.

The article uses Verizon's latest DBIR findings to argue that the security problem is not authentication alone, but the weak link between authentication and verified identity. For practitioners, that shifts the question from how to issue credentials to how to prove the user is the same person at every access request.

Key questions

Q: What breaks when stolen credentials are reused but not correlated across systems?

A: Teams lose the ability to prove that a login was part of an intrusion rather than ordinary user activity. Without correlation between exposure, authentication, and action, identity abuse looks legitimate and endpoint tools may see nothing unusual. That creates forensic blind spots, delayed containment, and weak root-cause analysis across IAM, NHI, and incident response.

Q: Why do stolen or phished credentials create such outsized risk in modern breaches?

A: Stolen credentials are powerful because they often bypass the hardest part of an attack, getting in without triggering obvious malware defenses. Once inside, attackers can authenticate as legitimate users, move laterally, persist, and reuse the same access for more theft or resale. Cloud adoption amplifies the problem because login abuse is easier to scale than dropping malware.

Q: How can IAM teams tell whether fraud controls are actually working?

A: Look for fewer unverified high-risk requests, better challenge rates on abnormal approvals, and stronger separation between routine identity events and exceptional transactions. If users still complete sensitive actions based only on message urgency or apparent authority, the control is not working.

Q: What should organisations do when passkeys are not enough on their own?

A: Add session and authorization controls that limit damage after login. Bind sessions to devices where possible, shorten token lifetimes for sensitive actions, and monitor consent grants, endpoint compromise, and unusual recovery events. Passkeys protect authentication, but they do not prevent OAuth abuse or post-login session theft.

Technical breakdown

Why stolen credentials still bypass identity controls

Stolen credentials succeed because many access stacks treat possession as proof. If an attacker can reuse a password, token, or MFA-derived session in a context the system accepts, the control has verified an item of evidence rather than the identity behind it. That is why credential theft remains durable across environments: the attack does not need to defeat the system, only to satisfy its trust condition. In practice, this is an assurance problem, not just an authentication problem. Practical implication: move scrutiny from credential validity alone to the trust signal behind the login event.

Practical implication: review where your controls still accept possession as sufficient proof of identity.

Why verification matters more than passwordless branding

Passwordless reduces dependence on remembered secrets, but it does not automatically prove who is at the keyboard. If a device stores multiple biometric factors or a session is created without a strong identity check at enrollment, the organisation may have removed the password while leaving the underlying trust model intact. The key distinction is between reducing friction and increasing assurance. Identity verification, especially when tied to enrollment and re-verification, changes the trust baseline more than a password replacement does. Practical implication: evaluate whether your authentication model actually verifies identity or only avoids passwords.

Practical implication: separate password removal from identity assurance in your control review.

How human error and social engineering keep credentials exploitable

The DBIR data in the article shows that people remain part of the breach path through error, misuse, phishing, and credential theft. That means the attack surface is not just technical compromise, but user behaviour under pressure, urgency, or deception. Controls that depend on perfect user judgment will continue to fail at scale because the attacker can target the weakest moment rather than the strongest system. In identity terms, the user and the credential are both attack surfaces. Practical implication: build controls that remain effective even when the user makes a mistake or is tricked.

Practical implication: design access controls to withstand user error and social engineering, not just enforce policy.

Threat narrative

Attacker objective: The attacker wants to log in as a trusted user, bypass stronger scrutiny, and turn valid access into data theft or operational compromise.

1. Entry occurs when attackers obtain or reuse stolen credentials, then present them to systems that accept possession as sufficient authentication.
2. Escalation follows when the valid login is used to reach applications, data, or higher-value accounts without a stronger verification step.
3. Impact is achieved by converting legitimate access into breach activity, often without the initial login looking malicious to basic controls.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential possession is no longer a sufficient trust signal: The article reinforces a basic governance failure in many identity programmes. A system that treats a reusable secret as proof of personhood is making an assumption that attackers can exploit with stolen logins. Practitioners should treat possession-based login as an incomplete security decision, not a finished control.

Verification is the missing control layer between authentication and access: The problem is not that authentication exists, but that many programmes stop at proving a secret and never prove the human behind it. Identity assurance has to sit closer to each access request, especially where credentials can be copied, shared, or stolen. That shifts IAM from credential administration toward identity confidence.

Passwordless by itself is not the same as stronger identity assurance: Removing passwords can reduce one attack path, but it does not automatically solve the verification gap. If enrollment is weak or the system only checks device-held factors, the organisation may simply trade one reusable secret for another trust shortcut. The practitioner lesson is to separate convenience from assurance.

Credential trust debt: The longer an organisation depends on inherited trust in usernames, passwords, and session artefacts, the more attack surface it accumulates. This article shows that the debt is already visible in breach statistics, not just in theory. The governance response is to stop treating login success as the end of assurance and start treating it as the beginning of verification.

Human identity and NHI governance are converging on the same lesson: Whether the actor is a person or a machine, possession of a credential does not prove intent, legitimacy, or current trustworthiness. The more identity systems rely on static proof, the more they invite abuse across both human and non-human access paths. Practitioners should align identity assurance models across both domains rather than manage them as separate problems.

From our research library:

• Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.

What this signals

Credential possession is a weak governance anchor: When the same secret can be shared, stolen, or replayed, the control plane is only proving that something was presented, not that the right person is acting. That is why identity assurance has to move closer to enrollment and high-risk access decisions.

The article's core lesson is that verification must become a first-class control objective in IAM, not a branding layer on top of authentication. Programmes that reduce password dependence without strengthening identity proof simply narrow one symptom while leaving the trust gap intact.

For practitioners

• Reassess credential possession as a trust signal Map where your IAM programme still treats password or token possession as sufficient proof of the right user, then flag those flows for stronger verification.
• Add identity verification at enrollment and access Require a verified identity step at onboarding and re-check it at higher-risk access requests so the user can be distinguished from a copied credential.
• Reduce reliance on reusable credentials Prioritise access paths where passwords or shared secrets still gate sensitive systems, and move them toward stronger assurance methods that do not depend on memorised secrets.
• Harden controls against human error and deception Assume phishing, misuse, and rushed approvals will continue, then design access decisions so one mistaken action does not create broad compromise.

Key takeaways

• Stolen credentials remain a dominant breach path because many identity programmes still equate possession with trust.
• The article's figures show that people remain embedded in breach paths through error, misuse, phishing, and credential theft.
• Identity teams need stronger verification at enrollment and access time if they want to reduce the breach value of reused or stolen secrets.

Key terms

• Identity Assurance: The confidence an organisation has that a person or system is truly who it claims to be before access or action is granted. In modern IAM, assurance depends on evidence quality, channel trust, and the strength of verification around high-risk decisions.
• Possession-Based Authentication: An authentication method that relies on something the user has, such as a security key or registered device. It improves assurance by linking access to a physical or managed object, but the security outcome depends on enrolment, revocation, loss handling, and whether the possession factor can be cloned or bypassed.
• Credential replay: Credential replay is the reuse of stolen authentication material to impersonate a legitimate user or system. In human identity programmes, replay risk grows when passwords, OTPs, or weak recovery flows can be captured and used from a separate device or session.
• Identity verification: Identity verification is the process of confirming that a user, workload, or agent is the entity it claims to be before access is granted. In AI-heavy environments, that verification must include the requester, the system acting on its behalf, and the sensitivity of the action.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.