Topic starter
19/08/2026 4:04 pm
TL;DR: Stolen credentials kept turning identity incidents into successful account access in Expel's 2026 Annual Threat Report, according to Expel. Identity governance has to track authentication, privilege use, and account abuse more closely when familiar controls only work if they are consistently enforced.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Expel’s 2026 Annual Threat Report is live–here’s what you need to know”.
By the numbers:
- In 2025, nearly half 47.7% of all identity incidents resulted in attackers successfully gaining account access using stolen credentials.
Key questions
A: Security teams should treat identity as a primary control plane, not a supporting layer.
Q: What does low-volume cloud activity tell you about security risk?
A: Low-volume activity can still indicate high risk when it involves privileged identities, exposed management surfaces, or service accounts that should not be active in the first place.
Q: Why do stolen credentials still matter in environments with MFA?
A: Stolen credentials matter because they are often the first step in a chain that ends with social engineering or MFA fatigue.
Practitioner guidance
- Harden conditional access for every critical identity Require device, location, and session risk checks for accounts that can reach sensitive systems, and do not allow password validity alone to satisfy access decisions.
- Reduce the lifetime of reusable credentials Shorten the window in which passwords, tokens, and service credentials can be replayed by enforcing rotation, revocation, and reauthentication where the workflow allows it.
- Separate cloud anomaly triage from simple volume thresholds Escalate low-volume cloud activity when it touches privileged identities, management planes, or unusual service accounts, even if the activity appears operationally small.
Bottom line: Identity attacks dominated Expel’s 2025 incident handling because stolen credentials kept turning into real account access.
Glossary terms: Identity Governance, Conditional Access, Credential replay, Standing Privilege
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
19/08/2026 4:38 pm
Identity attacks remain the most efficient compromise path because organisations still over-trust successful authentication. Expel’s data shows that stolen credentials continue to convert into account access at scale, which means authentication success is being treated too often as security success. MFA and conditional access help, but they are only decisive when they are enforced consistently and tied to real risk signals. For IAM teams, the lesson is that identity governance fails when it assumes a login event proves trust.
A question worth separating out:
Q: How do teams know whether incident data is improving identity governance?
A: They should look for fewer repeat incidents tied to access, provisioning, or service account failures, and for faster closure when a control gap is found. If incident volume stays flat while the same identity-related issues recur, the process is recording work rather than improving governance.
👉 Read our full editorial: Identity governance needs tighter enforcement as stolen credentials persist
This post was modified 1 day ago by NHI Mgmt Group