Identity attacks dominated 2025 incidents in Expel’s annual report

At a glance

What this is: Expel’s 2026 Annual Threat Report says identity attacks dominated 2025 incident handling, with stolen credentials driving nearly half of identity incidents to successful account access.

Why it matters: That matters because IAM, PAM, and NHI programmes still fail when credential theft, conditional access gaps, and weak identity governance leave attackers with the easiest route into the environment.

By the numbers:

• In 2025, nearly half 47.7% of all identity incidents resulted in attackers successfully gaining account access using stolen credentials.

Context

Identity attacks are not just a phishing problem. They are a governance problem that shows where authentication, conditional access, and account lifecycle controls still leave room for abuse, especially when stolen credentials are the easiest path to successful access.

Expel’s report frames 2025 as another year in which defenders saw familiar attack patterns outperform flashy ones. That makes the identity control stack, including human access governance, privileged access, and machine identity oversight, the practical boundary between noisy telemetry and real compromise.

Key questions

Q: Why do stolen credentials still matter in environments with MFA?

A: Stolen credentials matter because they are often the first step in a chain that ends with social engineering or MFA fatigue. Once the attacker has a valid username and password, they only need one weak factor or one confused user. MFA reduces risk, but it does not remove the value of credential theft as an entry method.

Q: How should security teams prioritize identity controls when identity attacks become the dominant incident type?

A: Security teams should treat identity as a primary control plane, not a supporting layer. The practical response is to harden MFA, conditional access, credential hygiene, and continuous monitoring for anomalous access. When identity incidents outpace endpoint incidents, the program needs stronger detection around authentication, privilege use, and account abuse across cloud and SaaS environments.

Q: What does low-volume cloud activity tell you about security risk?

A: Low-volume activity can still indicate high risk when it involves privileged identities, exposed management surfaces, or service accounts that should not be active in the first place. Attackers often stay quiet once they have access. The question is not how much activity occurred, but whether the identity behind it should have been able to act at all.

Q: How do teams know whether incident data is improving identity governance?

A: They should look for fewer repeat incidents tied to access, provisioning, or service account failures, and for faster closure when a control gap is found. If incident volume stays flat while the same identity-related issues recur, the process is recording work rather than improving governance.

Technical breakdown

Why stolen credentials still beat stronger security layers

Stolen credentials remain effective because identity systems often accept a valid secret as sufficient proof of legitimacy unless additional context is enforced. MFA reduces this risk, but it does not eliminate it when attackers can phish session tokens, abuse reused passwords, or exploit weak recovery and conditional access logic. The deeper issue is that identity systems frequently authenticate the credential rather than the intent, device state, or session risk. That gap is visible across human accounts and non-human identities alike, where long-lived access and poor lifecycle control make compromise durable.

Practical implication: tighten authentication conditions so a valid credential alone is never enough to complete access.

How low-volume cloud activity can still signal high risk

Cloud threats often look quiet because attackers do not need to generate much noise once they have access. A miner, exposed management plane, or lightly used service account can be a symptom of broader control gaps, not the end goal. In practice, low-volume activity matters because it may indicate mis-scoped permissions, weak alerting, or credentials that were never meant to be reusable outside a narrow workflow. For identity teams, that means cloud access telemetry and workload identity governance cannot be separated from the rest of the access model.

Practical implication: treat low-volume cloud anomalies as governance signals, not just operational nuisance.

MITRE ATT&CK mapping turns incident data into control priorities

Mapping detections to MITRE ATT&CK helps convert case-by-case incident handling into a repeatable view of adversary behaviour. It shows which tactics appear most often, where defenders see patterns across customers, and which controls consistently absorb attacker pressure. For identity-heavy incidents, that often means credential access, valid accounts, and lateral movement deserve more attention than isolated alert counts suggest. The value is not the framework label itself. The value is the ability to translate observed attack paths into durable control investments across IAM, PAM, endpoint, and cloud response workflows.

Practical implication: use ATT&CK coverage to prioritise the identity attack paths your monitoring and response actually see.

NHI Mgmt Group analysis

Identity attacks remain the most efficient compromise path because organisations still over-trust successful authentication. Expel’s data shows that stolen credentials continue to convert into account access at scale, which means authentication success is being treated too often as security success. MFA and conditional access help, but they are only decisive when they are enforced consistently and tied to real risk signals. For IAM teams, the lesson is that identity governance fails when it assumes a login event proves trust.

Low-volume cloud threats are governance failures in disguise. A miner or other low-noise cloud incident is rarely the real story. The more important issue is that weak cloud identity scope, exposed management surfaces, and poor detection coverage let trivial activity persist long enough to matter. This is where cloud security and identity governance intersect directly: access boundaries are only as strong as the identities behind them.

MITRE ATT&CK mapping is most useful when it changes control investment, not reporting aesthetics. Expel’s decision to map detections to ATT&CK suggests a maturing view of incident data as a control prioritisation input. The practical value for practitioners is to use observed tactics to decide which authentication, authorisation, and monitoring gaps deserve budget and engineering focus. That is how incident data becomes a governance tool rather than a retrospective chart.

Credential resilience is now a first-line identity architecture requirement, not an afterthought. When nearly half of identity incidents end in successful account access, the operational question is no longer whether attackers will test credentials, but which identities can survive that test. Human access, privileged access, and workload access all need lifecycle discipline that assumes compromise pressure, not benign use. Practitioners should manage identities as active attack surfaces.

What this signals

Credential resilience is becoming the practical test of identity maturity. Expel’s report points to a familiar pattern: if attackers can still turn stolen credentials into usable access, the organisation has a lifecycle problem as much as an authentication problem. That shifts the programme focus from simply proving identity to making replay, reuse, and recovery harder at every stage.

Cloud security and identity governance are converging around the same failure modes. Low-volume cloud incidents often reveal over-permissioned access, weak detection around management activity, and unclear ownership of service identities. That means cloud teams and IAM teams should share the same risk language when deciding what to monitor, what to revoke, and what to classify as abnormal.

For practitioners

• Harden conditional access for every critical identity Require device, location, and session risk checks for accounts that can reach sensitive systems, and do not allow password validity alone to satisfy access decisions.
• Reduce the lifetime of reusable credentials Shorten the window in which passwords, tokens, and service credentials can be replayed by enforcing rotation, revocation, and reauthentication where the workflow allows it.
• Separate cloud anomaly triage from simple volume thresholds Escalate low-volume cloud activity when it touches privileged identities, management planes, or unusual service accounts, even if the activity appears operationally small.
• Use ATT&CK patterns to set identity detection priorities Align alert engineering to the tactics that actually show up in incident handling, especially credential access, valid account use, and lateral movement.

Key takeaways

• Identity attacks dominated Expel’s 2025 incident handling because stolen credentials kept turning into real account access.
• The report shows that familiar controls such as MFA and conditional access still matter, but only when they are consistently enforced and paired with stronger identity governance.
• Practitioners should focus on credential lifecycle, privilege scope, and identity-aware monitoring because attackers continue to choose the easiest route into the environment.

Key terms

• Conditional Access: Conditional access is a policy model that decides whether an action should proceed based on context such as posture, resource sensitivity, timing, and scope. For AI agents, it must be evaluated at request time so a valid credential does not automatically equal permitted behaviour.
• Credential replay: Credential replay is the reuse of stolen authentication material to impersonate a legitimate user or system. In human identity programmes, replay risk grows when passwords, OTPs, or weak recovery flows can be captured and used from a separate device or session.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps identity, cloud, and security teams build controls that stand up to real compromise pressure.