Topic starter
06/07/2026 9:40 am
TL;DR: Verizon found credential stuffing can make up to 44% of login attempts in a single day for some organisations, according to Descope. Authentication layers need behavioural signals because valid credentials alone do not separate stolen access from legitimate sign-ins.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Strengthen Sign-In Security With Descope and Arkose Bot Manager”.
Key questions
Q: Why do credential stuffing attacks keep working against rate limits?
A: Because attackers do not need high volume from one source.
Q: How do security teams know whether chatbot controls are actually working?
A: They need evidence from both adversarial testing and production monitoring.
Q: What breaks when sign-in controls rely only on valid credentials?
A: They fail to distinguish a real user from an attacker using stolen credentials, especially when automation, device rotation, and low-and-slow timing are used to hide abuse.
Practitioner guidance
- Instrument behavioural scoring at sign-in Evaluate device reputation, interaction patterns, and network metadata inside the authentication flow so risk is assessed before a session is issued.
- Tune adaptive challenge logic Route medium-risk logins to MFA or bot enforcement, while keeping low-risk legitimate users on a friction-light path.
- Correlate repeated login behaviour Track repeated attempts by device fingerprint and behaviour across IP changes so distributed credential stuffing does not disappear behind rotation.
Bottom line: Bot-driven login attacks succeed because valid credentials can still arrive with malicious behaviour, which makes password checks alone an incomplete control.
Glossary terms: Credential Stuffing, Behavioural Risk Scoring, Bot Detection, Account Takeover
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
06/07/2026 9:55 am
Behavioural trust has become a first-class sign-in control. Credentials are no longer a sufficient trust boundary when attackers can present valid pairs at scale while mimicking ordinary login flows. The practical shift is from authenticating a secret to assessing whether the actor behind the secret looks human, stable, and legitimate enough to continue.
A question worth separating out:
Q: When should teams add behavioural checks to authentication flows?
A: When valid credentials are no longer a reliable indicator of trust, especially for applications exposed to credential stuffing, account takeover attempts, or automation-driven reconnaissance. Behavioural checks belong in the sign-in path whenever post-login detection is too late.
👉 Read our full editorial: Behavioral bot controls are closing gaps in sign-in security