Topic starter
27/06/2026 1:36 pm
TL;DR: Compromised credentials take an average of 246 days to identify and contain, according to IBM’s 2025 Cost of a Data Breach Report, while Abnormal AI says its behavioral models can detect takeover in seconds and Cyera can surface the exposed data footprint. The real security problem is that revoking a session does not answer what the attacker could already reach.
Editorial analysis by NHI Mgmt Group, based on content published by Abnormal AI: “Account Takeover Protection Meets DLP: How Abnormal and Cyera Work Together”.
By the numbers:
- Compromised credentials take an average of 246 days to identify and contain, according to IBM’s 2025 Cost of a Data Breach Report cited by Abnormal AI.
Key questions
Q: What breaks when account takeover response stops at session revocation?
A: Session revocation ends one control failure, but it does not answer what the attacker already reached before containment.
Q: Why do account takeovers create a data-governance problem as well as an identity problem?
A: Because the attacker inherits the user’s existing permissions, so the true risk is not only who signed in, but what that identity can reach.
Q: How do security teams know whether ATO controls are actually working?
A: Effective ATO controls reduce successful abuse across recovery, step-up, and session channels, not only failed logins.
Practitioner guidance
- Link account takeover alerts to data reachability Map ATO detections to the SaaS, cloud storage, and file repositories the identity could reach at the time of compromise, then rank those locations by sensitivity and exposure likelihood.
- Use identity-specific behavioural baselines Tune detection around per-user login, device, communication, and relationship patterns so takeover signals are measured against what normal looks like for that identity.
- Trigger containment and data tightening together When takeover is confirmed, revoke the session and immediately apply stricter controls for that identity, including blocking downloads, disabling external sharing, and restricting sensitive repositories.
Bottom line: Account takeover is not fully contained when the session ends, because the attacker may already have reached sensitive SaaS, cloud, or file data.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 2:59 pm
Identity containment without data containment is incomplete: Revoking a compromised account stops one path of abuse, but it does not answer what the attacker already accessed. The article shows that response quality now depends on linking identity compromise to data exposure across SaaS and cloud. Practitioners should treat blast-radius control as part of the response state, not as a separate investigation afterthought.
A few things that frame the scale:
- Breaches involving stolen or compromised credentials take an average of 292 days to identify and remediate, according to IBM’s Cost of a Data Breach.
A question worth separating out:
Q: What should teams do when a compromised email account is detected?
A: Teams should move immediately from detection to containment. That usually means logging the user out, terminating active sessions, forcing password resets, and adding the user to watchlists that can trigger endpoint containment or reauthentication. The response should be coordinated across identity, email, and endpoint controls so the attacker loses both access and persistence.
👉 Read our full editorial: Account takeover response needs identity and data blast-radius control