Verizon DBIR 2025 shows credential abuse still drives breach entry

At a glance

What this is: This analysis of Verizon DBIR 2025 argues that stolen credentials and MFA bypass remain the most effective ways attackers enter accounts.

Why it matters: It matters because IAM, CIAM, PAM, and NHI programmes still rely on authentication assumptions that attackers are systematically bypassing.

By the numbers:

• 88% of attacks against basic web applications involved stolen credentials.
• 60% of all breaches involved the human element.
• 31% of Microsoft 365 attacks used token theft as the MFA bypass method.
• Only 3% of compromised passwords met basic complexity requirements.

👉 Read Descope's analysis of Verizon DBIR 2025 and credential abuse

Context

Credential abuse remains the easiest path into many environments because identity controls are still strongest at the perimeter and weakest at the point of use. In practice, attackers do not need to defeat every layer of security if they can obtain a reusable credential or bypass the second factor.

For customer identity and workforce access alike, this is a governance problem as much as a technical one. Password policy, MFA design, token handling, and detection all have to work together, or the attacker will simply choose the least resistant path.

The DBIR findings also underscore why passwordless and phishing-resistant authentication are gaining urgency. If credentials are still the primary entry point, then identity programmes need to treat authentication strength as an operational control, not a checkbox.

Key questions

Q: How should security teams reduce breach risk from stolen credentials?

A: Security teams should reduce credential lifetime, remove stale secrets from code and tooling, and make access revocation faster than attacker reuse. The key is to assume credentials will leak and to limit what they can do once exposed. Rotation, least privilege, and detection on abnormal use all matter, but only when they are enforced consistently across human, NHI, and delegated access.

Q: Why do weak MFA implementations still fail against real attackers?

A: Because many attacks target the factor delivery or the session after the password is accepted. Token theft, prompt bombing, and adversary-in-the-middle techniques can defeat MFA if the second factor is not bound to the right device and session. Effective MFA requires phishing resistance, not just an extra prompt.

Q: What do security teams get wrong about password complexity?

A: They often treat complexity as a proxy for security. A password can be long and varied while still being exposed in public breach data or predictable enough to crack quickly. Effective policy must block known bad passwords, not just enforce character rules.

Q: What should teams do when a credential leak is discovered in a third-party system?

A: Treat it as a live identity event, not a notification. Revoke the credential, confirm which workloads or accounts depended on it, and review whether the partner environment exposed other credentials with the same privileges. Third-party leaks often become internal breaches because the same identity reaches both environments.

Technical breakdown

Why stolen credentials still open the door

Stolen credentials remain effective because most web applications still trust a reusable secret at sign-in, and many organisations continue to accept weak or reused passwords. Once an attacker has valid credentials, they no longer need to exploit an application bug. They can authenticate as the user, inherit whatever access that account has, and move straight into business logic, data, or admin workflows. The DBIR's numbers show that credential theft is not a niche technique but a repeatable access path that scales across phishing, infostealers, and brokered logins.

Practical implication: treat credential exposure as an access-control event, not only as an authentication problem.

Why MFA still fails under real attack pressure

Multi-factor authentication is not a single control category. Its strength depends on the factor type, the binding between the factor and the session, and the attacker's ability to intercept or replay the second factor. Token theft, prompt bombing, and adversary-in-the-middle attacks all exploit weaknesses in how MFA is delivered and consumed. If the second factor can be captured, coerced, or replayed in real time, the presence of MFA does not guarantee that the session is trustworthy.

Practical implication: move sensitive applications toward phishing-resistant authentication and monitor for MFA fatigue and token misuse.

Why passwords are now a lifecycle risk, not just a login risk

Passwords create downstream governance problems because they are portable, copyable, and difficult to retire cleanly once exposed. They also encourage compensating controls such as helpdesk resets, fallback channels, and broad reset permissions, all of which expand attack surface. The DBIR's password-quality findings reinforce a simple point: if most compromised passwords fail even baseline complexity rules, the lifecycle around passwords is already under strain. That strain affects user experience, fraud risk, and incident response at the same time.

Practical implication: reduce reliance on password recovery paths and prioritise phishing-resistant authentication for high-value accounts.

Threat narrative

Attacker objective: The attacker wants to turn stolen identity material into trusted access that can be used without triggering strong access controls.

1. Entry begins when attackers obtain valid credentials through phishing, credential stuffing, infostealers, or brokered password dumps, then use those credentials to authenticate through ordinary login flows.
2. Escalation follows when the attacker bypasses or defeats MFA through token theft, prompt bombing, or adversary-in-the-middle interception, allowing a trusted session to form.
3. Impact occurs when the attacker uses that session to access customer accounts, sensitive data, or downstream business systems with the privileges of the compromised identity.

Breaches seen in the wild

• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.
• IOS app secrets leakage report — iOS apps leaking hardcoded secrets and credentials endangering user privacy.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Credential exposure is now an identity governance failure, not just an authentication failure: the DBIR reinforces that stolen credentials still deliver the highest-return access path for attackers. Passwords, session tokens, and fallback recovery paths all become part of the same governance surface once identity is the entry point. Practitioners should stop treating authentication as a front-door problem and start treating it as lifecycle and blast-radius control.

Passwordless adoption is no longer a convenience discussion: when only 3% of compromised passwords meet basic complexity requirements, the baseline password model is already broken under operational conditions. That does not mean passwords disappear everywhere overnight, but it does mean high-risk populations need phishing-resistant alternatives first. The implication is that the strongest identity control is the one that removes reusable secrets from the attack path.

MFA is necessary but not sufficient when adversaries target the session, not the password: token theft and prompt bombing show that the real protection boundary is the authenticated session. This is where identity teams need to integrate authentication, device trust, and session monitoring rather than measuring MFA as a binary setting. The practical conclusion is that session assurance has become a core control objective.

Customer identity now intersects directly with enterprise threat modelling: the report's focus on customer-facing accounts matters because external identity abuse often becomes the first step in broader fraud or data access campaigns. CIAM teams, fraud teams, and security operations cannot work from separate assumptions about login trust. The field needs a shared model for when a login is genuine enough to issue durable access.

From our research:

• 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• That gap makes OWASP Agentic AI Top 10 a useful forward reference for teams deciding how to govern agent access and scope.

What this signals

Credential theft is no longer only a human authentication problem. As organisations add more automated and AI-driven access paths, the same identity assumptions that fail for passwords and MFA will fail again for machine identities, service accounts, and agent sessions unless governance changes with the actor type.

Session assurance gap: the real control boundary is shifting from login success to session trust, token integrity, and post-authentication monitoring. Teams that still measure authentication as a single event will miss the part of the attack where access becomes durable.

Identity programmes should align passwordless adoption, recovery-path hardening, and token telemetry into one operating model. For teams governing both human and non-human identities, the next step is to treat exposed credentials as a lifecycle problem, not an isolated security alert.

For practitioners

• Replace reusable secrets on high-risk accounts Prioritise phishing-resistant passkeys or equivalent methods for administrator, finance, support, and customer accounts that would create high blast radius if abused. Keep password fallback paths narrow and heavily monitored.
• Rework MFA around session trust Instrument token theft, MFA fatigue, and adversary-in-the-middle patterns in your detection stack. Review whether your MFA design binds the factor to the device, the origin, and the session rather than only to the login event.
• Shrink recovery-path privilege Limit helpdesk resets, step-up exemptions, and recovery flows to the smallest feasible set of staff and cases. Recovery should not become the easiest way to bypass the stronger controls you deployed.
• Correlate credential exposure with response workflows When stolen credentials appear in breach feeds or infostealer logs, treat that as a live identity event and force review of access, token revocation, and privileged session activity across linked systems.

Key takeaways

• Credential abuse remains the most reliable entry path because attackers can turn valid identity material into trusted access without breaking the application itself.
• The DBIR data shows that weak passwords, MFA bypass, and token theft are different expressions of the same governance gap.
• Identity teams should reduce reusable secrets, harden recovery flows, and measure session assurance instead of treating login success as the security outcome.

Key terms

• Credential Abuse: Credential abuse is the use of valid secrets or accounts by an unauthorised party or for unauthorised purposes. In practice, it often looks like normal authentication unless teams correlate context, privilege, and behaviour. It is one of the most persistent ways identity failures become breaches.
• MFA Bypass: MFA bypass is any technique that defeats the protection offered by multi-factor authentication without actually breaking the control itself. This includes prompt abuse, token theft, adversary-in-the-middle attacks, and weak reset or enrolment processes that let an attacker re-establish trust.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Session Assurance: Session assurance is the practice of continuously evaluating whether an active digital session still matches the expected identity, device, and behaviour profile. It goes beyond login verification and asks whether the current interaction still deserves to remain trusted before a payment or privilege change is completed.

What's in the full article

Descope's full analysis covers the operational detail this post intentionally leaves for the source:

• The full breakdown of DBIR credential abuse patterns across web applications, customer identity, and third-party access.
• The article's specific discussion of MFA bypass methods, including token theft, prompt bombing, and adversary-in-the-middle flows.
• The passkey adoption and implementation context that sits behind the passwordless recommendation.
• Descope's product-level guidance on bringing passkeys into existing CIAM flows without redesigning the entire authentication stack.

👉 Descope's full post covers the DBIR findings, MFA bypass patterns, and the case for passkeys in customer authentication.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.