Notifications
Clear all
Topic starter
01/08/2026 9:00 pm
TL;DR: Persistent account takeover activity can span weeks, hundreds of IPs, and multiple successful authentications before containment, according to Exaforce's account takeover analysis. The case shows that geo, ASN, and session-behaviour correlation remains essential because raw login logs alone do not reveal coordinated identity abuse quickly enough.
NHIMG editorial — based on content published by Exaforce: Learning from the Exaforce frontline, how Exaforce detected an account takeover attack in a customer's environment
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams detect account takeovers after login succeeds?
A: Security teams should monitor the session after authentication, not just the login event.
Q: Why are valid credentials so dangerous in identity attacks?
A: Valid credentials are dangerous because they inherit existing trust, roles, and access paths, which makes them harder to distinguish from normal activity.
Q: What do teams get wrong about impossible travel alerts?
A: They treat impossible travel as a yes-or-no decision instead of one signal in a larger behavioural pattern.
Practitioner guidance
- Correlate login events across geography and ASN Join geolocation, ASN history, and account-specific behaviour into one detection view so repeated attempts from inconsistent networks can be scored as a single campaign.
- Prioritise high-value identities for session reconstruction Build timeline stitching for admin accounts, shared accounts, and identities tied to sensitive operations so analysts can reconstruct activity after valid credentials are used.
- Use MFA as a containment control, not just a prevention control When a takeover is suspected, force logout active sessions, reset credentials, and enrol the account in MFA immediately so the attacker cannot continue using the same access path.
What's in the full article
Exaforce's full blog post covers the operational detail this post intentionally leaves for the source:
- The incident timeline with the specific dates, IP clusters, and policy evaluations that supported triage.
- The exact detection sequence across impossible travel, ASN anomaly, and success-failure ratios.
- The remediation actions taken after compromise, including session termination, password reset, and MFA enrolment.
- The analyst-style breakdown of how the platform packaged evidence for export and audit use.
👉 Read Exaforce's account takeover detection analysis for the full incident timeline →
Account takeover detection in SaaS identity: are your controls keeping up?
Explore further
01/08/2026 9:06 pm
Identity telemetry is now a primary control surface, not just a detection layer. This incident shows that account takeover does not announce itself through a single obvious event. It emerges through weak signals that only become meaningful when geolocation, ASN history, and session behaviour are stitched together. The practitioner conclusion is straightforward: identity telemetry has to be treated as an operational control surface, not an after-action investigation tool.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when account takeover succeeds despite verification controls?
A: Accountability sits across identity, fraud, and operations, because takeover usually exploits a gap between onboarding, monitoring, and transaction decisioning. If a business relies on one team to verify the customer and another to catch abuse later, the attacker can move through the handoff. Governance should assign ownership across the full account lifecycle.
👉 Read our full editorial: Account takeover detection shows why identity telemetry still matters
