Topic starter
19/08/2026 4:04 pm
TL;DR: Identity-based attacks accounted for 47.7% of all identity incidents that ended in successful account access in Expel’s 2026 Annual Threat Report, which also shows attackers refining familiar endpoint techniques and exploiting low-volume, high-risk cloud activity. The core lesson is that established identity controls such as MFA and conditional access still matter because attackers keep choosing the path of least resistance.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Expel’s 2026 Annual Threat Report is live–here’s what you need to know”.
By the numbers:
- In 2025, nearly half 47.7% of all identity incidents resulted in attackers successfully gaining account access using stolen credentials.
Key questions
Q: Why do stolen credentials still matter in environments with MFA?
A: Stolen credentials matter because they are often the first step in a chain that ends with social engineering or MFA fatigue.
A: Security teams should treat identity as a primary control plane, not a supporting layer.
Q: What does low-volume cloud activity tell you about security risk?
A: Low-volume activity can still indicate high risk when it involves privileged identities, exposed management surfaces, or service accounts that should not be active in the first place.
Practitioner guidance
- Harden conditional access for every critical identity Require device, location, and session risk checks for accounts that can reach sensitive systems, and do not allow password validity alone to satisfy access decisions.
- Reduce the lifetime of reusable credentials Shorten the window in which passwords, tokens, and service credentials can be replayed by enforcing rotation, revocation, and reauthentication where the workflow allows it.
- Separate cloud anomaly triage from simple volume thresholds Escalate low-volume cloud activity when it touches privileged identities, management planes, or unusual service accounts, even if the activity appears operationally small.
Bottom line: Identity attacks dominated Expel’s 2025 incident handling because stolen credentials kept turning into real account access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:38 pm
Identity attacks remain the most efficient compromise path because organisations still over-trust successful authentication. Expel’s data shows that stolen credentials continue to convert into account access at scale, which means authentication success is being treated too often as security success. MFA and conditional access help, but they are only decisive when they are enforced consistently and tied to real risk signals. For IAM teams, the lesson is that identity governance fails when it assumes a login event proves trust.
A question worth separating out:
Q: How do teams know whether incident data is improving identity governance?
A: They should look for fewer repeat incidents tied to access, provisioning, or service account failures, and for faster closure when a control gap is found. If incident volume stays flat while the same identity-related issues recur, the process is recording work rather than improving governance.
👉 Read our full editorial: Identity attacks dominated 2025 incidents in Expel’s annual report