Topic starter
06/07/2026 9:44 am
TL;DR: Credential stuffing still drives account takeover and breach risk, with Arkose Labs citing IBM data that 16% of breaches involve stolen credentials, compromised credential attacks take 292 days on average to contain, and the average breach cost is $4.81M. The governance problem is reducing the durability and usefulness of stolen identity material, not only blocking bots.
Editorial analysis by NHI Mgmt Group, based on content published by Arkose Labs: “Credential Stuffing Solution”.
By the numbers:
- 16% of breaches are caused by stolen credentials.
- Compromised credential attacks take 292 days on average to contain.
- The average cost of a breach involving stolen credentials is $4.81M.
Key questions
Q: What breaks when credential stuffing is not blocked at the login layer?
A: The login plane becomes a low-cost test bed for stolen credentials, and one valid reuse can turn into account takeover.
Q: Why do stolen credentials keep creating breach risk after the first leak?
A: Stolen credentials keep working because many people reuse passwords and many services still treat possession of a correct password as strong proof of identity.
Q: How do organisations know whether credential stuffing controls are working?
A: Look for fewer reused secrets in code and configuration, lower volumes of anomalous login attempts, faster secret rotation after exposure, and clear ownership for every service credential.
Practitioner guidance
- Reduce credential reuse exposure Measure how often exposed passwords still work across your estate, then prioritise services where the same secret unlocks multiple applications or channels.
- Harden account recovery paths Review password reset, MFA reset, and trusted-device flows for takeover paths that bypass the primary login control.
- Add adaptive friction at sign-in Use risk signals such as impossible travel, device change, velocity, and request pattern to decide when to challenge a login.
Bottom line: Credential stuffing remains effective because valid stolen secrets can still unlock accounts even when perimeter defences are in place.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 10:01 am
Credential stuffing is an identity lifecycle failure, not just a bot problem: the real issue is that stolen credentials remain usable long enough to be replayed across multiple services. Once credential reuse becomes normal, sign-in becomes an industrial abuse surface rather than a trust boundary. Practitioners should treat credential durability as a governance metric, not only a detection problem.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: A unified platform is better when the goal is to coordinate signals across the full customer journey. Isolated controls can still help, but they often miss the link between registration abuse, login attacks, and post-authentication fraud. Shared intelligence lets teams challenge risky activity earlier and apply stronger controls only where the risk justifies it.
👉 Read our full editorial: Credential stuffing and account takeover still drive breach risk