Seven security actions that expose the 2026 attack gaps

At a glance

What this is: At-Bay's analysis frames seven defensive actions for 2026 around leaked credentials, VPN exposure, remote access control, MFA, logging, MDR, and DLP.

Why it matters: It matters because the article shows that practitioners need to govern implementation consistency across identity, remote access, and data movement controls, not just buy more tooling.

By the numbers:

• 53% of breaches in 2025 started with purchased credentials.
• The average time from credential theft to network compromise is just 3-14 days.
• In H2 2025, approximately 80% of Akira cases investigated by At-Bay Security’s Response & Recovery team were associated with SonicWall VPN for initial entry.

Context

At-Bay’s 2025 threat intelligence summary argues that attackers are exploiting predictable control gaps rather than inventing entirely new techniques. The article groups seven defensive actions into pre-breach visibility, context and correlation, and data movement detection, which is a useful way to think about where governance fails in practice.

The identity angle is strongest where stolen credentials, MFA enforcement, privileged access, and remote access tools overlap. NHI lifecycle management becomes relevant because leaked credentials, shared admin accounts, and unmanaged access paths all become durable attack surfaces when lifecycle controls are inconsistent.

Key questions

Q: What breaks when MFA is not enforced on every remote access path?

A: When MFA is inconsistent, a stolen password can still function as a valid enterprise login, which gives attackers a low-friction entry point into critical systems. That failure is especially dangerous in legacy portals and hybrid environments, where exceptions often persist longest and are hardest to audit.

Q: Why do stolen credentials remain dangerous even when a business already uses passwords and multifactor authentication?

A: Stolen credentials stay dangerous because attackers often need only one weak recovery path to impersonate a legitimate user. Passwords and multifactor controls help, but they do not always prove the person is the enrolled account owner during high-risk events like login challenges or resets. Strong identity proofing closes that gap and limits misuse of compromised data.

Q: How should teams detect whether remote access tools are being used for persistence?

A: By defining what normal remote access looks like first, then flagging tools, hosts, and usage patterns that fall outside that baseline. Inventory is the prerequisite. Without it, legitimate administration software and attacker-controlled remote tools blend together, and persistence can continue without clear alarms.

Q: How should security teams adapt ransomware defenses when attackers focus on data theft and extortion instead of encryption alone?

A: Security teams should assume ransomware may be a stealthy extortion operation, not just a disruption event. That means prioritising rapid detection of unusual data access, egress monitoring, backup isolation, and incident response plans that cover disclosure pressure as well as recovery. Controls should be tested against double extortion scenarios, where attackers threaten public release to force payment and avoid the noise of traditional ransomware encryption.

Technical breakdown

Why leaked credentials remain the fastest entry path

Purchased or stolen credentials bypass the first authentication hurdle because they already look legitimate to many controls. The problem is not only theft, but the short delay between exposure and abuse, which turns credential hygiene into an incident-response problem as much as a preventative one. Dark web monitoring, breach corpus checks, and automated resets are all aimed at shrinking that window before attackers can turn a valid identity into an initial foothold. In identity terms, this is a governance failure over authenticators and account state, not just a phishing problem.

Practical implication: Treat exposed credentials as active compromise signals and trigger forced resets, not ticket queues.

Why edge VPNs and remote access tools widen the attack surface

VPN appliances and remote access software create a control plane that attackers can scan, exploit, or impersonate. When organisations leave end-of-life devices in place or lack an inventory of remote access tools, they lose both prevention and detection. The technical issue is visibility into exposed ingress paths and persistence mechanisms, especially where legitimate tools can be repurposed for covert access and exfiltration. This is why patching, SASE, Zero Trust, and software inventory are discussed together: they reduce both the number of externally reachable paths and the chance of unauthorised persistence.

Practical implication: Track every externally reachable access path and retire any remote access tool you cannot account for.

How logging, MFA, and MDR change post-compromise visibility

MFA reduces the value of stolen passwords, logging provides the evidence trail, and MDR adds continuous interpretation of suspicious behaviour. None of these controls works alone if exceptions remain, logs are too shallow, or alerts are not actively monitored. The article’s point is that detection becomes meaningful only when authentication, logging, and human response are linked into one operational chain. Without that chain, teams can still be breached, but they lose the ability to reconstruct the attack and stop lateral movement before impact.

Practical implication: Align MFA enforcement, log retention, and response coverage so suspicious sign-ins are investigated in real time.

Threat narrative

Attacker objective: The attacker seeks reliable access, persistence, and monetisable leverage through either ransomware encryption or large-scale data theft.

1. Entry occurs through purchased credentials or exploitable edge devices, with SonicWall VPN exposure highlighted as a common initial path in Akira cases.
2. Escalation follows when attackers use legitimate remote access tools or weakly governed admin access to maintain persistence and move through the environment.
3. Impact is either ransomware encryption or pure extortion, where data is stolen at scale and leveraged without encrypting the victim's systems.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Control consistency is now the real security variable: the article shows that organisations often have the right tools but fail at enforcement, timing, or coverage. That is a governance problem, not a tooling problem, because attackers only need one inconsistent control boundary to turn a valid identity or exposed edge device into an entry point. Practitioners should measure whether each defence is actually enforced across all environments, not just purchased.

Identity controls fail when lifecycle governance is fragmented: stolen credentials, privileged accounts, and service access all become durable attack paths when account state is not continuously managed. That is why leaked credential monitoring and MFA are inseparable from NHI governance, especially when service accounts and privileged access are explicitly called out. Joiner-Mover-Leaver is the operational lens that explains why dormant or unrevoked access becomes attacker inventory.

Remote access is a persistence problem as much as an access problem: legitimate tools such as AnyDesk, TeamViewer, and RClone become offensive infrastructure when organisations lack normal-state baselines. The article correctly links inventory, monitoring, and blocking because you cannot detect abnormal use if you have not defined approved use first. This is where CI/CD Pipeline Identity Security Guide-style thinking about trust, scope, and explicit approval should inform broader remote access governance.

Pure extortion changes the control objective from recovery to prevention of loss: the article's DLP and egress-control section reflects a shift away from assuming encryption is the main damage mechanism. Once data theft becomes the primary monetisation path, the decisive question is whether abnormal movement is detected early enough to stop exfiltration. That makes data movement governance, not backup strategy alone, the control boundary practitioners must harden.

What this signals

Implementation drift is the category's hidden failure mode: the article repeatedly shows that controls often exist but are inconsistently applied, which is why attackers keep finding a path through. That pattern matters because governance programmes frequently measure control presence instead of control enforcement, and those are not the same thing.

Data movement is now a first-class identity-adjacent control plane: once attackers can reuse valid access and move laterally, the decisive question becomes whether outbound movement is observable and controllable. For practitioners, that means egress policy, remote access governance, and identity enforcement need to be treated as one operating model, not separate projects.

For practitioners

• Enforce leaked-credential response workflows Wire dark web alerts, breach database checks, and forced password resets into a single response path so exposed accounts are treated as compromised immediately.
• Inventory and retire exposed remote access paths Build a complete list of VPN appliances, remote access apps, and administration tools, then remove any software or device you cannot justify for business use.
• Make MFA mandatory on all privileged access Remove exceptions on VPNs, RDP, and cloud admin consoles, and review bypasses monthly so privileged access is always subject to the second factor.
• Centralise logging before you need it Send VPN and administrative access logs to a SIEM, keep at least 90 days of retention, and test whether analysts can query user, source IP, and duration quickly.
• Baseline egress and block unjustified exfiltration paths Set normal data transfer baselines, alert on unusual outbound volume, and restrict consumer file-transfer tools unless the business can explain their use.

Key takeaways

• The article's central warning is that attackers exploit inconsistent enforcement more reliably than missing tools.
• Its evidence ties breached credentials, VPN exposure, and pure extortion to measurable operational gaps.
• The strongest mitigations are lifecycle discipline, enforced MFA, remote access inventory, and outbound data control.

Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · Joiner-Mover-Leaver (JML) Guide · CI/CD Pipeline Identity Security Guide · GitHub and GitHub Actions Security Guide

Key terms

• Leaked Credentials Data: Leaked credentials data is the collected set of usernames, passwords, hashes, or account records found on the open web, dark web, paste sites, or in criminal data dumps. Security teams use it to estimate whether external credential leakage could translate into real account compromise.
• Remote Access Tool: A remote access tool is malware that lets an attacker control an infected system from a distance. It commonly supports command execution, information theft, and persistence. In practice, these tools behave like backdoors, giving operators interactive access to a victim environment after the initial compromise.
• Data Exfiltration: Data Exfiltration is the unauthorised transfer of data out of an environment to an attacker-controlled location. It is often the end stage of intrusion, using cloud sync, email, APIs, removable media, or encrypted tunnels. Defenders monitor unusual volume, destinations, file access patterns, and identity misuse to stop it early.
• Implementation Drift: Implementation drift is the gap between an approved security or identity design and how it is actually deployed over time. In practice, controls, configurations, permissions, and workflows slowly diverge from the intended model, creating hidden exposure. For identity systems, drift often appears in stale access, inconsistent policy enforcement, and unmanaged exceptions.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners build the lifecycle discipline this article shows is often missing.