2026 attack gaps: what should security teams fix first?

TL;DR: Most 2025 breaches began with purchased credentials, VPN edge exposure, weak remote-access inventory, incomplete MFA enforcement, thin logging, limited MDR coverage, and data exfiltration controls that were inconsistently applied, according to At-Bay. The real issue is not missing tools but uneven governance across the attack lifecycle, where control gaps persist long enough for attackers to move.

Editorial analysis by NHI Mgmt Group, based on content published by At-Bay: “7 Security Actions to Take in 2026 to Exponentially Reduce Your Risk”.

By the numbers:

• 53% of breaches in 2025 started with purchased credentials.
• The average time from credential theft to network compromise is just 3-14 days.

Key questions

Q: What breaks when MFA is not enforced on every remote access path?

A: When MFA is inconsistent, a stolen password can still function as a valid enterprise login, which gives attackers a low-friction entry point into critical systems.

Q: Why do stolen credentials remain dangerous even when a business already uses passwords and multifactor authentication?

A: Stolen credentials stay dangerous because attackers often need only one weak recovery path to impersonate a legitimate user.

Q: How should teams detect whether remote access tools are being used for persistence?

A: By defining what normal remote access looks like first, then flagging tools, hosts, and usage patterns that fall outside that baseline.

Practitioner guidance

• Enforce leaked-credential response workflows Wire dark web alerts, breach database checks, and forced password resets into a single response path so exposed accounts are treated as compromised immediately.
• Inventory and retire exposed remote access paths Build a complete list of VPN appliances, remote access apps, and administration tools, then remove any software or device you cannot justify for business use.
• Make MFA mandatory on all privileged access Remove exceptions on VPNs, RDP, and cloud admin consoles, and review bypasses monthly so privileged access is always subject to the second factor.

Bottom line: The article's central warning is that attackers exploit inconsistent enforcement more reliably than missing tools.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →