Topic starter
20/08/2026 5:54 pm
TL;DR: Identity-based attacks made up 73.9% of incidents the SOC investigated, while compromised credentials accounted for 54.9% of cloud-service cases and secret key exposure rose to 26.8% of cloud infrastructure incidents, according to Expel’s Q3 2025 Quarterly Threat Report. The pattern reinforces that identity and secret governance now determine whether attackers reach cloud, email, and business systems.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Expel Quarterly Threat Report, Q3 2025: Q3 by the numbers”.
By the numbers:
- Compromised credentials accounted for 54.9% of cloud-service incidents.
- The cloud infrastructure category represented around 1.1% of total incidents.
Key questions
Q: What breaks when identity attacks dominate incident volume?
A: Security teams lose the ability to rely on perimeter-first thinking because the attacker’s entry point is already trusted access.
Q: Why do compromised credentials keep showing up in cloud incidents?
A: Cloud services are built to trust authenticating identities, so stolen credentials often look legitimate until they are used in ways that violate normal behaviour.
Q: How do security teams know whether secret management is actually reducing risk?
A: Look for fewer reusable credentials, shorter credential lifetimes, and a lower number of systems that still depend on manually rotated secrets.
Practitioner guidance
- Implement separate control plans for each attack surface Build different playbooks for identity-based attacks, endpoint malware, and cloud infrastructure exposure so detection and response do not assume one control pattern fits all incidents.
- Tighten cloud credential lifecycle controls Inventory cloud keys, tokens, and service credentials, assign ownership, and require rotation or revocation paths that work even when the original issuance system is unavailable.
- Reduce standing trust in login and API access Limit how long credentials remain valid, narrow the permissions they carry, and validate that failed and blocked access attempts are visible to the teams responsible for response.
Bottom line: Identity-based attacks dominated the quarter’s SOC activity, showing that trusted access paths remain the easiest route into enterprise environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:35 pm
Identity telemetry has become the real front line for incident triage. When 73.9% of SOC-investigated incidents are identity-based, the security problem is no longer just whether an account was breached. It is whether authentication, session handling, and identity lifecycle controls can distinguish normal access from attacker use quickly enough to matter. Practitioners should treat identity events as operational control signals, not just investigation artefacts.
A question worth separating out:
Q: When should organisations separate human and machine identity controls?
A: They should separate them as soon as service accounts, API keys, or cloud tokens carry meaningful access, because machine identities fail differently from user accounts. Human login controls do not prevent a leaked application key from being replayed, so the lifecycle and monitoring model has to change.
👉 Read our full editorial: Q3 2025 incident trends show identity attacks dominating operations