Notifications
Clear all
Topic starter
02/08/2026 12:00 pm
TL;DR: Credential stuffing succeeds when stolen username and password pairs are tested at scale, and detection often lives outside the enforcement path, according to Impart Security. The real governance gap is not spotting bots but making sure identity signals can drive blocking decisions before valid sessions are established.
NHIMG editorial — based on content published by Impart covering credential stuffing: What Your WAF Misses: Credential Stuffing
Questions worth separating out
Q: What breaks when credential stuffing controls rely on WAF rules alone?
A: WAF rules usually see isolated requests, while credential stuffing is a cross-account pattern.
Q: Why do password reuse and credential stuffing remain so effective?
A: They remain effective because many users still reuse passwords and many environments still accept credentials without enough contextual risk checks.
Q: How do security teams know if stuffing controls are working?
A: Look for reduced account velocity from shared source patterns, fewer successful logins from breached credential lists, and lower post-authentication abuse after the control is enabled.
Practitioner guidance
- Instrument cross-account login correlation Track failed logins, session history, and source rotation across identities so stuffing patterns are visible at the aggregate level, not just per request.
- Move stuffing decisions into the enforcement path Ensure the control that detects abnormal login velocity can also block or step up authentication in the same request flow, rather than relying on a separate WAF rule.
- Use shadow mode before blocking Run the policy against live traffic in shadow mode, log the full evidence chain, and only promote rules that match expected behaviour without creating widespread false positives.
What's in the full article
Impart's full blog post covers the operational detail this post intentionally leaves for the source:
- How the bot tooling, proxy rotation, and request patterns are assembled in a real stuffing campaign
- Examples of the login signals that distinguish a valid failed login from coordinated credential abuse
- The difference between alerting on stuffing and actually enforcing against it in the request path
- Shadow-mode workflow details for testing blocking logic before it affects production users
👉 Read Impart Security's analysis of credential stuffing and WAF enforcement gaps →
Credential stuffing and WAFs: what IAM teams need to fix?
Explore further
02/08/2026 1:06 pm
Detection without enforcement is a governance failure, not a tooling gap. Credential stuffing is often recognised correctly but contained poorly because the evidence is trapped in one control and the block decision is made in another. That split weakens identity governance, especially when the behaviour spans many accounts rather than a single bad login. The practical conclusion is that authentication controls need a shared decision path, not just better alerting.
A question worth separating out:
Q: What should teams do when credential stuffing is confirmed?
A: Contain it in the authentication path first. Prioritise blocking or step-up decisions for the affected login flow, preserve the evidence trail, and avoid broad account lockouts unless the attack pattern justifies them. The goal is to stop valid-session creation before the attacker can reuse it for fraud or data access.
👉 Read our full editorial: Credential stuffing exposes the gap between detection and enforcement
