TL;DR: SANS data shows 35% of organisations cite credential phishing or stolen credentials in identity attacks, 24% report brute force or credential stuffing, and 47% still rely on on-premises Active Directory or legacy applications for critical identities, according to Enzoic. The login workflow is now a control surface, not just a checkpoint, because compromised credentials can satisfy authentication while already being unsafe.
At a glance
What this is: This analysis argues that pre-authentication risk is shifting identity security toward the login workflow, because valid credentials can still be compromised before access is granted.
Why it matters: IAM and identity security teams need to treat authentication as an active control surface, since credential exposure now undermines both human login flows and downstream account protection.
Context
Pre-authentication risk is the point where exposed credentials become dangerous before the login event itself. The article argues that organisations have over-invested in controls that look for suspicious behaviour after access is granted, while attackers increasingly succeed earlier by using credentials that are valid but already unsafe.
In identity programmes, that changes the role of authentication from a simple correctness check to a security decision point. The practical question is no longer only whether a password matches, but whether the credential has been exposed, reused, or harvested elsewhere before it reaches the login form.
Key questions
Q: What breaks when organisations treat login as the whole authentication control?
A: They miss post-login fraud, session theft, and impersonation that happens after initial access is granted. A login-only model also overstates assurance in environments where attackers reuse sessions, share credentials, or move through delegated access paths. The control fails because trust is assumed to persist without being revalidated.
Q: Why do compromised credentials often bypass MFA controls?
A: Because many attacks steal the artifact issued after MFA, not the password itself. If an attacker reuses a session cookie, OAuth token, or refresh token, the login appears already authenticated. MFA was satisfied earlier, so the control did its job but did not protect the downstream artifact from replay.
Q: What are the signs that pre-authentication risk is being underestimated?
A: Look for heavy dependence on post-login alerts, repeated account takeover activity, and legacy identity systems that still anchor critical access. Those patterns usually mean the programme is reacting after authentication instead of preventing compromised credentials from entering the workflow in the first place.
Q: How should teams balance login controls with legacy identity infrastructure?
A: They should tighten controls where the riskiest identity paths still exist, especially Active Directory-backed or hybrid flows that support critical access. The goal is not to replace every downstream control, but to move the first meaningful decision closer to credential use and away from post-authentication detection.
Technical breakdown
Why credential correctness and credential safety are different
Authentication systems traditionally answer a narrow question: does the presented secret match what is stored? Pre-authentication risk adds a second question: is that secret still trustworthy? Phishing kits, infostealer malware, breach datasets, and password reuse can all make a credential dangerous while leaving it technically valid. That is why compromised credentials often pass the front door without triggering classic detection logic. In modern identity defence, the login event is not proof of safety; it is only proof that the attacker has brought the right credential to the gate.
Practical implication: move credential exposure checks into the authentication path, not just into post-login monitoring.
Why credential stuffing works inside expected login behaviour
Credential stuffing succeeds because it does not need an exploit chain. Attackers reuse previously exposed username and password pairs and test them across login endpoints, relying on the fact that many people recycle credentials across services. From the system’s perspective, each attempt can look like an ordinary login request. That makes rate-limits, anomaly detection, and MFA necessary but not sufficient. The central weakness is that the authentication workflow can still accept a credential that is correct for the system but already compromised in the wider ecosystem.
Practical implication: treat exposed credential screening as part of the login decision, especially for high-value accounts.
Why Active Directory keeps pre-authentication risk alive
Active Directory remains a high-impact control plane because so many enterprise identities, legacy applications, and hybrid access paths still depend on it. When compromised credentials reach AD-backed systems, attackers may authenticate without needing to defeat perimeter controls first. That matters because AD environments often contain long-lived accounts, service accounts, and broad access paths that make a successful login much more valuable than the login event alone suggests. The risk is not merely access, but what that access unlocks in a connected identity estate.
Practical implication: inventory legacy identity dependencies and align login controls with the systems that still anchor critical access.
Breaches seen in the wild
- 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Pre-authentication risk exposes a login-centric assumption gap: traditional identity controls were built on the assumption that the authentication event is where risk begins. That assumption fails when the credential itself is already unsafe before the user reaches the login page. The implication is that identity programmes must stop treating login as a neutral checkpoint and recognise it as a governed security boundary.
Credential safety is now part of identity governance, not just threat detection: post-authentication monitoring cannot compensate for credentials that arrive compromised. This is especially true where exposed passwords, reused secrets, and legacy identity dependencies intersect. The practitioner conclusion is that identity governance must extend upstream into issuance, exposure, and login-time validation.
Active Directory is still a pre-authentication risk amplifier: the article shows how hybrid estates preserve old assumptions about trusted login paths. When critical identities still sit in AD or legacy applications, credential exposure can translate directly into access without first tripping modern cloud-native controls. Practitioners should treat legacy identity dependency as a risk multiplier, not a background detail.
Login workflow controls are becoming the new first line of defence: the most useful shift is not more noise after login, but better decisions before access is granted. Screening for exposed credentials, validating password safety at reset and creation, and tying response to the accounts actually at risk all point to the same conclusion. Identity security now depends on governance at the point of authentication.
What this signals
Credential safety has become a governance concern: identity programmes built only around authentication success are now blind to the exposure event that happened earlier. Security teams need controls that evaluate the trustworthiness of the credential at the point of use, not just the fact that it matches.
Legacy identity paths are where pre-authentication assumptions linger longest: Active Directory and other older systems still anchor critical access in many environments, which means login workflows there carry more risk than their age suggests. The programme implication is to prioritise those flows for exposure-aware controls first.
For practitioners
- Expand login-time credential screening Check presented credentials against exposure data at authentication and password reset points so compromised secrets are blocked before access is granted.
- Prioritise legacy identity surfaces Map which critical applications still depend on Active Directory or other legacy identity systems, then apply stronger login controls where those paths remain in use.
- Separate correct from safe credentials Update identity workflows so a valid password is not treated as trustworthy unless it also clears exposure and reuse checks.
- Target remediation to exposed accounts Use real-time credential intelligence to focus resets and user intervention on accounts with known exposure rather than forcing broad password changes.
- Reduce reliance on post-authentication-only controls Rebalance identity defence so session monitoring and ITDR complement, rather than carry, the burden of stopping compromised credentials.
Key takeaways
- Pre-authentication risk shifts identity defence from post-login detection to the moment a credential is used.
- Credential correctness and credential safety are not the same thing, and that distinction now determines whether a login is trustworthy.
- Teams should focus login-time controls on exposed credentials and legacy identity paths because those are the conditions attackers exploit most often.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article is about credentials that remain valid but unsafe at login time. |
| NHI-07 — Long-Lived Secrets | Password reuse and exposed secrets create persistent login risk across systems. | |
| Recommendation — Apply NHI-04 thinking to validate credential trust at login, not only credential correctness. Reduce long-lived credential exposure by tightening password and secret lifetime controls. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on how authentication decisions gate access to critical identities. |
| Recommendation — Align login controls with access authorisation decisions so unsafe credentials do not become valid sessions. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The piece emphasises safer credential handling at creation, reset, and use. |
| Recommendation — Use IA-5 to govern authenticator lifecycle and enforce stronger controls on exposed credentials. | ||
| MITRE ATT&CK | TA0006 — Credential Access | Credential theft and credential stuffing are central threat mechanisms in the article. |
| Recommendation — Map exposed-credential activity to TA0006 and prioritise detections around credential harvesting and reuse. | ||
Key terms
- Pre-authentication exploitation: An attack that succeeds before a system performs authentication, signature verification, or other trust checks. This raises severity because the attacker does not need valid credentials or a legitimate session to reach the vulnerable code path.
- Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.
- Authentication Control Surface: The set of user-facing and system-level elements that determine whether a login is accepted, challenged, or denied. For magic links, this includes the email template, expiry, device checks, warning text, and any step-up challenge tied to the request.
- Legacy identity platform: An older identity system built around custom integrations, manual workflows, and fixed governance patterns. These platforms often struggle to keep pace with cloud adoption, dynamic access demands, and modern audit expectations because they were designed for a slower operating model.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on July 10, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org