ITDR authentication security is falling behind identity attacks in 2025

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Permiso Security's blog post: ITDR and authentication monitoring are missing modern identity attacks, with breach data showing that compromise and impersonation now dominate.

Why it matters: It matters because identity teams cannot treat authentication as a static control when attackers can make suspicious logins look individually plausible and still evade timely detection.

By the numbers:

• credential compromise and impersonation attacks now account for 53.0% and 54.3% of security breaches respectively, according to Permiso Security.

Context

Authentication has effectively become the new perimeter for identity security, but perimeter-era monitoring does not cope well with timing, location, device, and behaviour signals that only make sense in context. In ITDR terms, the gap is not that teams lack logs, but that they lack a model that can correlate identity events quickly enough to matter.

Permiso Security argues that this gap is widening as attacks become more patient and more context-aware. The article's core claim is that organisations are increasingly trying to detect identity abuse with controls that were designed for simpler, threshold-based alerting, and that mismatch is now visible in both breach patterns and detection speed.

For IAM, PAM, and identity operations teams, the practical question is no longer whether authentication events are logged, but whether they are interpreted fast enough to stop account abuse before lateral movement or data access begins.

Key questions

Q: What breaks when authentication monitoring relies on static thresholds?

A: Static thresholds break because attackers can pace credential stuffing, password spraying, and impossible-travel activity to stay below alert levels. The result is that suspicious logins are treated as individually plausible events instead of part of a coordinated compromise pattern. Identity teams need correlation across time, device, geography, and role to make the signal actionable.

Q: Why do compromised identities increase business interruption risk?

A: Because valid credentials let attackers act like authorised users, which means they can disable systems, alter workflows, or interrupt vendor-dependent processes without immediately triggering obvious alarms. Once identity abuse reaches operational systems, the loss is no longer only data theft. It becomes downtime, recovery cost, and customer impact.

Q: How do security teams decide whether ITDR is working?

A: ITDR is working when responders can move from alert to containment without a long investigative detour. Look for shorter triage times, fewer unresolved identity alerts, and better visibility into who owns each credential or account. If the team still needs multiple tools to explain one identity event, the programme is not yet mature.

Q: What should teams do when a login looks unusual but not definitive?

A: Treat it as an investigation trigger, not a dismissal. Validate the user's context, inspect device and session history, and check for unusual post-authentication behaviour. A login that seems plausible in isolation can still be the first step in a compromise chain if the surrounding evidence is ignored.

Technical breakdown

Why authentication logs fail without context correlation

Authentication telemetry on its own is often too thin to separate compromise from legitimate variation. A login from a new geography, a late-night session, or a new device may be harmless in isolation, but the same signals become meaningful when combined with user baseline, role, and business context. ITDR has to correlate identity provider, VPN, directory, and application events in near real time, otherwise each signal remains a weak fragment rather than a usable decision point.

Practical implication: Centralise identity telemetry and correlate it before alerts are generated, not after an analyst starts investigating.

How attackers use timing and volume to stay below thresholds

Modern identity attacks rarely rely on noisy brute force. Credential stuffing, password spraying, and carefully timed impossible-travel logins are designed to stay under static thresholds while still achieving authenticated access. That means the control failure is not just visibility, but stale detection logic that treats all failed or unusual logins as comparable. Behavioural anomalies matter because attacker success often depends on blending into expected rhythm rather than breaking it.

Practical implication: Replace fixed login thresholds with detections that model user cadence, device history, and role-specific behaviour.

Why post-authentication behaviour is the real escalation signal

Once an account is authenticated, the most reliable warning often shifts from login metadata to what the account does next. Accessing unfamiliar repositories, downloading unusual volumes, or attempting administrative actions without history are stronger indicators of compromise than the original login event. In other words, authentication security is only the first layer of ITDR. Without post-authentication monitoring, teams see the entry point but miss the escalation path.

Practical implication: Track post-login actions for privilege changes, unusual data access, and cross-role activity, especially on privileged accounts.

Threat narrative

Attacker objective: The attacker aims to turn a valid login into sustained access that can be used for privilege abuse, lateral movement, and data exposure before response teams react.

1. Entry occurs through stolen or sprayed credentials that authenticate successfully without triggering a decisive alert because each login appears plausible on its own.
2. Escalation follows when attackers exploit timing gaps, after-hours access, or device changes to blend into normal activity and avoid threshold-based detection.
3. Impact comes when the authenticated account is used for data access, privilege abuse, or lateral movement before the organisation recognises the compromise.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Authentication monitoring has become a context problem, not a log problem. Permiso Security's analysis shows that many teams already collect identity data, but still miss compromise because the decisive signal only emerges when location, device, role, and timing are correlated. The practical implication is that authentication security now depends on decision quality, not simply event volume.

Static thresholds are now a structural weakness in ITDR programmes. Attackers can space attempts, reuse credentials across systems, and make logins look operationally plausible long enough to avoid alerting. That means threshold-based monitoring fails not because it is absent, but because it assumes adversaries will be noisy. Practitioners should treat threshold-only detection as an obsolete baseline.

Authentication is now a continuity control as much as a security control. When compromised identities are not detected quickly, the business impact extends beyond the account itself into lateral movement, data access, and operational disruption. This shifts identity detection from a narrow security function into a resilience requirement for IAM and PAM teams.

Identity attack timing is the new signal surface. The article shows that attackers exploit the gap between first authenticated access and human review. That gap is where compromise becomes durable, so the field needs more emphasis on session-level and post-authentication behaviour than on login success alone.

Permiso Security's data suggests the detection window itself is deteriorating. When more compromises hinge on identity abuse and fewer organisations can detect them within 24 hours, the issue is no longer just control coverage. It is whether identity programmes are still built around a review cycle that attackers can outlast.

What this signals

Identity telemetry only becomes useful when it is assembled into a decision model. For IAM and ITDR programmes, the operational shift is from log collection to correlation quality. Teams should expect attackers to exploit whatever remains outside that correlation loop, especially when authentication, session, and device signals are managed in different tools.

Session-level visibility is now part of authentication security. A successful login no longer proves safety, because the next actions in the session often reveal the compromise. That makes post-authentication monitoring a core requirement for identity teams that still treat login success as the endpoint.

Context-aware detection will define the next phase of identity defence. Organisations that maintain rigid, one-size-fits-all login rules will keep over-alerting on harmless variation while missing patient abuse. The practical lesson is to move toward baselines that reflect role, cadence, device trust, and real user behaviour.

For practitioners

• Correlate identity events across systems Bring identity provider, VPN, directory, and application authentication logs into one investigation path so that geography, device, MFA, and privilege changes are assessed together.
• Replace static login thresholds Tune detections around user-specific baselines for login time, location, device history, and role rather than depending on universal thresholds that attackers can easily game.
• Escalate privileged anomalies immediately Treat new devices, unusual geographies, and off-hours privileged logins as response-triggering events when they affect administrators or high-value accounts.
• Inspect post-authentication behaviour Review what the account accessed after login, including repository use, bulk downloads, group changes, and permission grants, because compromise often shows up after authentication succeeds.

Key takeaways

• Identity compromise is outpacing traditional authentication monitoring because suspicious logins can now look plausible in isolation.
• Permiso Security's analysis shows that detection speed has worsened even as identity-based breaches have become more common.
• IAM and ITDR teams need correlated context, not just more alerts, if they want to contain account abuse before escalation.

Key terms

• Identity Threat Detection and Response: Identity threat detection and response is the practice of finding misuse of credentials, unusual access patterns, and compromised identities across human and machine actors. For NHIs, it relies on telemetry from code, vaults, cloud services, and pipelines to detect abuse early enough to contain it.
• Credential Context: Credential context is the surrounding data that makes a stolen credential more usable, such as login URLs, email domains, recovery details, usernames, and device information. Context helps attackers validate the target, tailor the attack, and move faster than defenders who only see the password itself.
• Impossible Travel: A detection pattern that flags two sign-ins from locations too far apart to be physically plausible in the time available. In SaaS identity work, it becomes useful only when paired with baseline user behaviour, proxy indicators, and follow-on account actions.
• Post-authentication behaviour: Post-authentication behaviour is what an identity does after access has been accepted. For machine and AI identities, that includes token reuse, secret retrieval, lateral movement, and policy deviation, which means defenders must watch execution patterns, not only login outcomes.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.