Q3 2025 incident trends show identity attacks dominating operations

At a glance

What this is: This is Expel’s Q3 2025 incident summary, and its key finding is that identity-based attacks dominated the SOC’s investigations across cloud, email, and business systems.

Why it matters: It matters because IAM, PAM, NHI, and human identity teams need to treat credential exposure, secret handling, and verification controls as operational attack-surface management, not just account administration.

By the numbers:

• 73.9%, ity-based attacks comprised almost three-quarters of incidents, at 73.9%, in Expel’s Q3 2025 SOC investigations.
• Compromised credentials accounted for 54.9% of cloud-service incidents in the quarter, showing how often attackers were blocked before account takeover.
• Secret key exposure made up 26.8% of cloud infrastructure incidents, up 7.8 percentage points from Q2.

👉 Read Expel's Q3 2025 Quarterly Threat Report on identity, cloud, and endpoint incidents

Context

Identity attacks are now a baseline operating condition for security teams, not an edge case. In this report, Expel’s SOC shows that credential abuse, email compromise, and secret exposure keep converging on the same access pathways, which is exactly where IAM, PAM, and NHI governance overlap.

The practical problem is that cloud services, SaaS, and internal applications all depend on different trust signals, but attackers only need one exposed credential or one weak verification step. For identity programmes, that means the control gap is not visibility alone, but lifecycle discipline across human accounts, service accounts, tokens, and keys.

Key questions

Q: What breaks when credential exposure is not paired with strong verification controls?

A: Attackers can test stolen usernames, passwords, tokens, and keys at machine speed, then keep the identities that still authenticate. When verification is weak, exposure turns into repeatable access rather than a one-time event. The result is account takeover, cloud misuse, or persistence across multiple services, especially when the same identity is trusted in more than one system.

Q: What problem does ownership attribution solve for service accounts and API keys?

A: It closes the gap between exposure detection and accountable remediation. Many organisations can find the secret, but not the human who introduced it, maintains it, or can safely replace it. Ownership attribution gives security teams a practical way to assign action without relying on informal knowledge that disappears during staff changes.

Q: How do teams know if identity security controls are actually working?

A: Identity security controls are working when teams can show a current view of high-risk entitlements, detect privilege drift quickly, and remove access before exposure spreads. A useful sign is reduced time between entitlement change and policy review. Another is fewer unresolved conflicts between approved access and actual production permissions.

Q: Should organisations treat NHI secrets and human credentials under the same governance model?

A: Yes, when the credential can authenticate to production systems or cloud services. The governance logic is the same: know who or what it belongs to, limit privilege, shorten lifetime, and remove it cleanly when the owner changes or the task ends. The controls differ in execution, but the lifecycle risk is shared.

Technical breakdown

Why identity-based attacks dominate incident queues

Identity-based attacks dominate because credentials remain the most reusable form of access across cloud, SaaS, and business applications. A stolen password, session token, or API key can bypass perimeter controls and look legitimate until a risky action occurs. In modern environments, attackers prefer identity because it is portable, cheap to exploit, and often shared across multiple systems. That makes account trust, authentication strength, and entitlement scope the real control surface, not the login page alone.

Practical implication: teams need to treat identity telemetry as a primary detection source, not a secondary audit log.

Why compromised credentials are often stopped before takeover

Compromised credentials do not always become full compromises because layered controls can interrupt the attack path. MFA, conditional access, impossible-travel checks, device trust, and token binding can block use even when the secret is already known. That is why a high volume of credential exposure can coexist with a lower volume of successful account compromise. The technical issue is that attackers are testing the boundary between possession of a secret and successful authentication, and every extra verification step raises the cost of success.

Practical implication: measure not just exposure events, but how often controls stop credential replay before session establishment.

How secret key exposure changes cloud risk

Secret key exposure matters because many cloud credentials are bearer-style secrets. Whoever holds the key can often authenticate as the workload, application, or automation process that owns it. Hard-coded keys in source code, leaked environment variables, and exposed CI/CD artefacts create a standing trust problem that outlives the original deployment. Once a secret is public, the defender is racing against attacker automation, not a human adversary.

Practical implication: replace static secrets with workload identity and short-lived credentials wherever the platform allows it.

Threat narrative

Attacker objective: The attacker’s objective is to turn one exposed identity artefact into durable access across cloud, email, or business systems.

1. Entry occurs when attackers obtain exposed credentials, phishing credentials, or leaked secret keys and begin testing them against cloud and business applications.
2. Escalation follows when those secrets map to over-permissive accounts, reusable sessions, or poorly segmented cloud roles that allow broader access than intended.
3. Impact arrives through account takeover, cloud abuse, data access, or persistence inside SaaS and infrastructure services that still trust the compromised identity.

NHI Mgmt Group analysis

Identity is now the primary attack substrate, not just an authentication layer. Expel’s quarter-over-quarter data shows attackers are still getting the best return from identity pathways because those pathways are shared by users, service accounts, and automation. That convergence means the governance problem spans IAM, PAM, and NHI control planes, not just help desk password resets. Practitioners should treat identity telemetry, entitlement scope, and secret lifecycle as one control domain.

Standing secrets create a governance debt that attackers can cash in immediately. Secret key exposure is not a narrow cloud issue, because the same static credential can reach infrastructure, data, and downstream services. The named concept here is secret exposure velocity: the speed at which a leaked key becomes exploitable before defenders can rotate or revoke it. The faster that velocity, the less value traditional review cycles have. Practitioners should shrink the lifetime of every bearer credential.

Block rate matters as much as compromise rate. The report’s split between compromised credentials and successful identity or email compromise suggests some controls are working at the edge of takeover. That is a useful governance signal, but only if organisations can see which control stopped the attempt and whether the same identity can be re-used elsewhere. For NHI governance, the lesson is to measure interruption points across the full lifecycle, not just final compromise outcomes.

Attack-surface differentiation should drive programme design. Expel’s breakdown shows cloud infrastructure, endpoints, and identity services fail in different ways, so a single defensive pattern will not cover all three. Identity programmes should not assume cloud misconfiguration, malware, and credential theft belong to separate teams with separate metrics. The operational conclusion is that identity governance has to be integrated with cloud security, endpoint detection, and email defence if it is meant to reduce real attacker paths.

What this signals

Identity operations should now be measured by how quickly they interrupt misuse, not just how clean the inventory looks. When attackers are primarily entering through credentials and secrets, the winning programme is the one that reduces standing trust, shortens secret lifetime, and links detection to revocation across human and machine identities.

Secret exposure velocity: the time between a leaked secret becoming public and that secret being operationally unusable. This quarter’s patterns suggest that many teams still lose that race, which is why workload identity, revocation automation, and cross-domain telemetry need to be treated as core control capabilities, not optimisation work.

For identity teams, the next step is to connect cloud security findings with NHI governance and privileged access review. The practical standard is not whether a secret exists, but whether it can still be used after discovery, and whether every privileged artefact has a clear owner, purpose, and expiry.

For practitioners

• Map identity attack paths by control stop-point Track whether attempts are stopped at authentication, token issuance, device trust, or privileged action so you can see where attacker access is actually interrupted.
• Eliminate static secrets from cloud automation Replace hard-coded keys, long-lived tokens, and embedded credentials with workload identity and short-lived credentials for applications, CI/CD, and service integrations.
• Prioritise verification controls for exposed credentials Use MFA, conditional access, and device-based trust to prevent replay of known credentials before session establishment, especially for high-value cloud and SaaS accounts.
• Review NHI privilege scope as one lifecycle Classify service accounts, API keys, and certificates together, then rotate, revoke, and offboard them on the same governance cycle instead of treating each secret type separately.

Key takeaways

• Identity-based attacks dominated Expel’s Q3 incident picture because attackers continue to get the highest return from credentials, sessions, and secret keys.
• The report’s cloud data shows that many attacks are stopped before takeover, which makes verification controls and secret containment more important than raw detection volume.
• The most effective response is lifecycle governance across human and non-human identities, with shorter secret lifetime and faster revocation at the centre.

Key terms

• Identity-centric attack: An identity-centric attack is a compromise path that uses valid credentials, tokens, or sessions instead of breaking technical controls at the network edge. The attacker behaves like a legitimate identity long enough to move laterally, escalate privilege, or exfiltrate data while appearing authorised.
• Secret Key Exposure: Secret key exposure occurs when a credential that authorises access to a system becomes visible to an unauthorised party, often through code, logs, misconfiguration, or malware. Because many cloud secrets are bearer credentials, exposure can create immediate operational risk unless the secret is revoked or replaced quickly.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Compromised Credential Screening: Compromised credential screening checks new or changed secrets against known breach corpuses before they are accepted. In practice, it prevents users and service owners from choosing passwords that have already been exposed, which lowers account takeover risk and reduces the chance that an identity programme certifies a broken secret.

What's in the full report

Expel's full report covers the operational detail this post intentionally leaves for the source:

• Quarter-by-quarter incident breakdowns across identity, endpoint, and cloud infrastructure for teams benchmarking their own detection mix
• Category definitions for compromised credentials, identity or email compromise, and secret key exposure that help map findings to internal workflows
• Industry-by-industry incident distribution that can support control prioritisation and board reporting
• The second-quarter comparison data behind the trend lines, useful for teams tracking whether identity controls are improving

👉 Expel's full Q3 report includes the category definitions, incident trends, and industry breakdowns behind these findings.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to connect identity lifecycle controls to broader security operations.