Notifications
Clear all
Topic starter
20/08/2026 5:54 pm
TL;DR: Identity-based attacks made up 73.9% of incidents the SOC investigated, while compromised credentials accounted for 54.9% of cloud-service cases and secret key exposure rose to 26.8% of cloud infrastructure incidents, according to Expel’s Q3 2025 Quarterly Threat Report. The pattern reinforces that identity and secret governance now determine whether attackers reach cloud, email, and business systems.
NHIMG editorial — based on content published by Expel: the Q3 2025 Quarterly Threat Report for July to September
By the numbers:
- Compromised credentials accounted for 54.9% of cloud-service incidents in the quarter, showing how often attackers were blocked before account takeover.
Questions worth separating out
Q: What breaks when credential exposure is not paired with strong verification controls?
A: Attackers can test stolen usernames, passwords, tokens, and keys at machine speed, then keep the identities that still authenticate.
Q: What problem does ownership attribution solve for service accounts and API keys?
A: It closes the gap between exposure detection and accountable remediation.
Q: How do teams know if identity security controls are actually working?
A: Identity security controls are working when teams can show a current view of high-risk entitlements, detect privilege drift quickly, and remove access before exposure spreads.
Practitioner guidance
- Map identity attack paths by control stop-point Track whether attempts are stopped at authentication, token issuance, device trust, or privileged action so you can see where attacker access is actually interrupted.
- Eliminate static secrets from cloud automation Replace hard-coded keys, long-lived tokens, and embedded credentials with workload identity and short-lived credentials for applications, CI/CD, and service integrations.
- Prioritise verification controls for exposed credentials Use MFA, conditional access, and device-based trust to prevent replay of known credentials before session establishment, especially for high-value cloud and SaaS accounts.
What's in the full report
Expel's full report covers the operational detail this post intentionally leaves for the source:
- Quarter-by-quarter incident breakdowns across identity, endpoint, and cloud infrastructure for teams benchmarking their own detection mix
- Category definitions for compromised credentials, identity or email compromise, and secret key exposure that help map findings to internal workflows
- Industry-by-industry incident distribution that can support control prioritisation and board reporting
- The second-quarter comparison data behind the trend lines, useful for teams tracking whether identity controls are improving
👉 Read Expel's Q3 2025 Quarterly Threat Report on identity, cloud, and endpoint incidents →
Identity attacks dominated Q3 incidents. What should teams change?
Explore further
20/08/2026 6:35 pm
Identity is now the primary attack substrate, not just an authentication layer. Expel’s quarter-over-quarter data shows attackers are still getting the best return from identity pathways because those pathways are shared by users, service accounts, and automation. That convergence means the governance problem spans IAM, PAM, and NHI control planes, not just help desk password resets. Practitioners should treat identity telemetry, entitlement scope, and secret lifecycle as one control domain.
A question worth separating out:
Q: Should organisations treat NHI secrets and human credentials under the same governance model?
A: Yes, when the credential can authenticate to production systems or cloud services. The governance logic is the same: know who or what it belongs to, limit privilege, shorten lifetime, and remove it cleanly when the owner changes or the task ends. The controls differ in execution, but the lifecycle risk is shared.
👉 Read our full editorial: Q3 2025 incident trends show identity attacks dominating operations
