Topic starter
06/07/2026 9:40 am
TL;DR: Credential stuffing can account for up to 44% of all login attempts in a single day for some organisations, according to the Verizon 2025 Data Breach Investigations Report, and Descope says adding Arkose Bot Manager signals into authentication flows helps block automated attacks before session creation. Traditional sign-in controls fail when the attacker presents valid credentials but abnormal behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Strengthen Sign-In Security With Descope and Arkose Bot Manager”.
Key questions
Q: What breaks when sign-in controls rely only on valid credentials?
A: They fail to distinguish a real user from an attacker using stolen credentials, especially when automation, device rotation, and low-and-slow timing are used to hide abuse.
Q: Why do credential stuffing attacks keep working against rate limits?
A: Because attackers do not need high volume from one source.
Q: How do security teams know whether chatbot controls are actually working?
A: They need evidence from both adversarial testing and production monitoring.
Practitioner guidance
- Instrument behavioural scoring at sign-in Evaluate device reputation, interaction patterns, and network metadata inside the authentication flow so risk is assessed before a session is issued.
- Tune adaptive challenge logic Route medium-risk logins to MFA or bot enforcement, while keeping low-risk legitimate users on a friction-light path.
- Correlate repeated login behaviour Track repeated attempts by device fingerprint and behaviour across IP changes so distributed credential stuffing does not disappear behind rotation.
Bottom line: Bot-driven login attacks succeed because valid credentials can still arrive with malicious behaviour, which makes password checks alone an incomplete control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:55 am
Behavioural trust has become a first-class sign-in control. Credentials are no longer a sufficient trust boundary when attackers can present valid pairs at scale while mimicking ordinary login flows. The practical shift is from authenticating a secret to assessing whether the actor behind the secret looks human, stable, and legitimate enough to continue.
A question worth separating out:
Q: When should teams add behavioural checks to authentication flows?
A: When valid credentials are no longer a reliable indicator of trust, especially for applications exposed to credential stuffing, account takeover attempts, or automation-driven reconnaissance. Behavioural checks belong in the sign-in path whenever post-login detection is too late.
👉 Read our full editorial: Behavioral bot controls are closing gaps in sign-in security