Verizon DBIR 2025 shows credential abuse still drives breach entry

At a glance

What this is: This analysis of Verizon's 2025 DBIR says credential abuse remains the dominant breach entry path, with stolen credentials and human-driven compromise still central to attack success.

Why it matters: IAM, CIAM, and NHI teams should treat credential theft as an operating condition, not an edge case, because authentication design still shapes breach exposure across human and machine access.

By the numbers:

• The 18th annual DBIR analyzed over 22,000 incidents, with roughly half confirmed as actual data breaches.
• A staggering 88% of attacks against basic web applications involved the use of stolen credentials.
• Brute force attacks against basic web apps rose nearly tripling over the last year, from roughly 20% to 60%.
• Only 3% of compromised passwords met basic complexity requirements.

Context

Credential abuse is the repeated use of stolen, guessed, reused, or harvested secrets to enter accounts and systems. In this article, the security problem is not just weak passwords but an authentication model that still assumes credentials remain trustworthy long enough to be defended after exposure.

Descope uses the 2025 Verizon Data Breach Investigations Report to show that attackers keep choosing the easiest path, and that path is still identity. The analysis connects basic web application compromise, human-driven phishing, and MFA bypass into one practical lesson for IAM and CIAM programmes.

For identity teams, the important question is no longer whether credentials are under attack, but whether the current auth stack can still distinguish legitimate use from stolen access once the secret leaves the user or workload boundary.

Key questions

Q: What should teams do first when stolen credentials are driving breach entry?

A: Start by identifying the accounts and journeys where reused secrets still grant the highest reach, then replace those paths with phishing-resistant authentication. The first goal is not broader MFA coverage, but removing the easiest replay path before an attacker can use harvested credentials at scale.

Q: Why do conventional MFA controls still fail against credential theft?

A: Conventional MFA fails when the attacker can intercept prompts, steal tokens, or replay a session after the first secret is exposed. The control still adds value, but it no longer guarantees that the person or device completing the step is the intended one, especially in customer-facing flows.

Q: What are the signs that password-based access is still too easy to abuse?

A: Repeated credential reuse, high reset volume, unexpected login success after password exposure, and fraud or compromise that survives MFA all point to weak identity assurance. If stolen secrets keep working long enough to create account access, the authentication design is already overstretched.

Q: How should security teams implement phishing-resistant authentication without hurting adoption?

A: Start with the highest-risk populations and applications, then offer the simplest usable authenticators that still meet your assurance target. Build recovery, enrollment, and help desk processes at the same time. If users cannot enroll and recover reliably, they will route around the control and weaken the programme.

Technical breakdown

Why credential theft still works at the front door

Credential theft succeeds because many systems still treat possession of a secret as sufficient proof of identity. Once a password, token, or session artefact is exposed, attackers can reuse it directly or pair it with other data to defeat weak account protections. The DBIR examples in this article show that phishing, brute force, credential stuffing, and marketplace resale all feed the same access path: entry through trusted identity material. That is why the problem persists even when perimeter security improves. Practical implication: reduce the value and lifetime of reusable credentials before focusing on downstream detection.

Practical implication: shorten the trust window for reusable credentials and stop relying on static secrets as the primary control.

How MFA bypass changes the threat model

MFA is no longer a single control, but a control family with very different failure modes. Prompt bombing, token theft, and adversary-in-the-middle attacks do not defeat MFA by removing the second factor entirely; they exploit how users, devices, and tokens are validated during the session. SMS one-time passwords are especially exposed because the code itself can be intercepted or redirected. Phishing-resistant methods such as passkeys change the protocol by binding authentication to the legitimate origin and device, which removes many relay and replay options. Practical implication: assess whether your MFA method resists interception, not just whether MFA is enabled.

Practical implication: move from generic MFA coverage to phishing-resistant authentication for high-risk accounts and customer journeys.

Why customer identity programmes need evidence-based auth design

Customer identity programmes often inherit assumptions from employee IAM that do not hold at internet scale. The DBIR findings in this article show that large numbers of compromised passwords, infostealer logs, and third-party exposure combine into a reuse problem, not just a password hygiene problem. That means identity proofing, credential issuance, session protection, and recovery flows all need to be considered together. The relevant design question is not whether one login method is more convenient, but whether the whole flow still works after a credential has already been seen by an attacker. Practical implication: redesign CIAM around exposure resilience, not just sign-in convenience.

Practical implication: test customer authentication flows against stolen-secret scenarios, not only happy-path login success.

Threat narrative

Attacker objective: The attacker wants reliable account access that converts stolen identity material into direct entry to applications, data, and downstream services.

1. Entry begins when attackers obtain credentials through phishing, brute force, infostealers, or purchase from credential markets.
2. Escalation occurs when stolen passwords, tokens, or session material bypass weak MFA designs or are used before revocation.
3. Impact follows when attackers enter customer or enterprise accounts and access the data and services those identities can reach.

Breaches seen in the wild

• McKinsey AI platform breach: McKinsey AI platform hack exposed 46M chats and sensitive data.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential abuse is now an authentication design problem, not a password problem. The DBIR data in this article shows that stolen credentials remain the preferred entry path even when organisations invest heavily in layered security. That means the control failure sits in the trust model for reused secrets, not in one missed alert or one weak user. The practitioner conclusion is that authentication architecture has to assume exposure and reduce the usefulness of any single credential artifact.

Phishing-resistant authentication is the practical dividing line, not MFA presence. The article is clear that prompt bombing, token theft, and adversary-in-the-middle techniques can all operate through conventional MFA flows. That makes

MFA enabled

an incomplete security statement for customer and workforce access. The security question is whether the method resists relay, replay, and session theft after the secret is exposed. Practitioners should evaluate the actual factor type, not the policy label.

Identity blast radius is expanding across human and third-party ecosystems. The article links human behaviour, infostealers, and third-party account exposure into the same breach pattern. That matters because account compromise is no longer confined to one user journey; it propagates through vendor, customer, and service access paths. The practitioner conclusion is that access scope and recovery design must reflect shared exposure, not isolated user risk.

From our research library:

• Credential abuse across the entire attack chain, not just initial access, appears in 39% of all breaches, according to the 2026 Verizon Data Breach Investigations Report.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Credential blast radius now defines auth resilience: when stolen secrets can still reach production accounts, the meaningful control is not more login friction but less reusable trust. That changes how teams think about password policy, session design, and recovery flows across both human and non-human identities.

Customer identity programmes should expect stolen-secret scenarios as a baseline threat model rather than an exception. That means passkey rollout, MFA method selection, and account recovery controls need to be evaluated together instead of as separate projects.

For practitioners

• Prioritise phishing-resistant authentication Replace password-plus-OTP defaults for high-risk customer and workforce journeys with origin-bound authentication methods that resist relay and replay attacks.
• Reduce reusable credential value Shorten the lifetime of passwords, tokens, and session artefacts wherever reuse is possible, and make revocation faster than attacker reuse.
• Test recovery and fallback paths Validate password reset, account recovery, and step-up flows against stolen-credential scenarios so attackers cannot pivot through the weakest alternate path.
• Harden third-party access assumptions Review partner and supplier authentication requirements separately from internal user controls, especially where shared SaaS or delegated access can amplify compromise.

Key takeaways

• Credential abuse remains the most reliable breach entry path because exposed secrets can still be replayed, reused, or sold before defenders can react.
• The DBIR evidence in this article ties stolen credentials, weak password quality, and MFA bypass into one persistent identity risk pattern.
• Security teams should shift from password-centric defence to phishing-resistant authentication and tighter recovery controls that assume compromise.

Key terms

• Credential Abuse: Credential abuse is the use of valid secrets or accounts by an unauthorised party or for unauthorised purposes. In practice, it often looks like normal authentication unless teams correlate context, privilege, and behaviour. It is one of the most persistent ways identity failures become breaches.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• MFA Bypass: MFA bypass is any technique that defeats the protection offered by multi-factor authentication without actually breaking the control itself. This includes prompt abuse, token theft, adversary-in-the-middle attacks, and weak reset or enrolment processes that let an attacker re-establish trust.
• Customer Identity And Access Management: Customer Identity and Access Management is the discipline of governing how external users sign in, recover access, and move through digital services. It combines authentication, profile management, and lifecycle control so organisations can deliver secure, low-friction experiences at scale.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.