Notifications
Clear all
Topic starter
02/09/2026 3:58 pm
TL;DR: Account takeover defense now depends on continuous risk signals, phishing-resistant MFA, and session monitoring rather than login-only checks, according to SecureAuth. The core issue is that traditional authentication assumes the threat ends at sign-in, but modern CIAM must defend the entire customer session.
NHIMG editorial — based on content published by SecureAuth: Customer Identity and Access Management (CIAM) account takeover defense guidance
By the numbers:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should CIAM teams reduce account takeover without overchallenging legitimate customers?
A: Use adaptive authentication to reserve friction for high-risk moments instead of every login.
Q: Why do phishing-resistant factors matter more than stronger passwords?
A: Because they change the attack model.
Q: How do you know if account takeover controls are actually working?
A: Look for reduced successful takeovers, lower fraud losses, and preserved good-user throughput at the same time.
Practitioner guidance
- Deploy step-up controls on high-risk customer actions Apply adaptive authentication when users change passwords, add payee details, reset recovery factors, or alter profile attributes.
- Prioritise phishing-resistant MFA for recovery and admin-like journeys Roll out passkeys or other phishing-resistant factors where account recovery, payment changes, or support-assisted resets create the highest takeover value.
- Correlate device, behaviour, and bot signals in one risk engine Feed device intelligence, behavioural biometrics, and automation detection into the same decision layer so post-login abuse can trigger step-up, rate limiting, or session lockdown before fraud completes.
What's in the full article
SecureAuth's full article covers the operational detail this post intentionally leaves for the source:
- Product positioning for SecureAuth's Continuous Authority platform and how its modules are grouped for customer identity defence.
- The specific CIAM capability descriptions behind adaptive authentication, behavioural biometrics, and device intelligence.
- Implementation-facing examples of how the controls respond to suspicious customer behaviour during a session.
- The vendor's own explanation of how its customer and workforce identity offerings fit together.
👉 Read SecureAuth's analysis of CIAM controls for account takeover defense →
CIAM against account takeover: are adaptive controls enough?
Explore further
02/09/2026 3:58 pm
CIAM is now a session-governance problem, not a login problem. Once an attacker has valid credentials, the control question shifts from initial authentication to whether the platform can keep reassessing trust after the session begins. That is why risk engines, device intelligence, and continuous verification matter together. The practitioner conclusion is simple: if the programme ends at sign-in, it is not governing account takeover.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing how slowly identity exposure is actually remediated.
A question worth separating out:
Q: What should organisations do when a customer session starts to look suspicious?
A: Escalate quickly to session-level controls such as re-authentication, transaction blocking, or temporary lockout before the attacker completes a password change or payout update. The right response depends on preserving the legitimate customer relationship while stopping the session from being used as a trusted fraud channel.
👉 Read our full editorial: CIAM against account takeover: what adaptive defense changes
