Notifications
Clear all
Topic starter
02/08/2026 11:43 am
TL;DR: Compromised credentials now include OAuth tokens, session cookies, API keys, and service account credentials that can authenticate as legitimate users and bypass MFA, according to Panther. Static login rules miss much of this abuse, so detection now depends on post-authentication behavioural signals, cross-log correlation, and rapid session revocation.
NHIMG editorial — based on content published by Panther: How to Detect Compromised Credentials: Signs and Response Steps
By the numbers:
- Stolen credentials were involved in 22% of breaches in 2025.
- Those breaches took an average of about 292 days to identify and contain.
- The median handoff time from initial access to a secondary threat group was 22 seconds.
Questions worth separating out
Q: How should security teams respond when attackers steal a valid session instead of a password?
A: They should treat the session as compromised, not just the password.
Q: Why do compromised credentials often bypass MFA controls?
A: Because many attacks steal the artifact issued after MFA, not the password itself.
Q: What signals indicate that a service account has been abused?
A: Interactive logons, unfamiliar source hosts, atypical time-of-day use, and sudden access bursts are the most useful signals.
Practitioner guidance
- Revoke sessions before resetting passwords When credential compromise is suspected, terminate active sessions, invalidate tokens, and then rotate passwords or keys.
- Correlate identity and cloud events into one detection layer Join IdP sign-ins, cloud control-plane actions, and SaaS changes on a normalised identity key so a sequence like MFA success, new device fingerprint, and mailbox forwarding rule creation becomes visible as one attack path.
- Flag service account behaviour that looks human Alert on interactive logons, remote interactive logon types, unexpected source hosts, and unusual access bursts for service accounts and workload identities, because those accounts should not behave like end-user desktops.
What's in the full article
Panther's full blog covers the operational detail this post intentionally leaves for the source:
- Concrete log field examples for correlating IdP, SaaS, and cloud control-plane events.
- Detection logic patterns for impossible travel, MFA fatigue, and token replay sequences.
- Step-by-step response sequencing for session revocation, scoping, and coordinated remediation.
- Implementation notes for normalising identities across multiple telemetry sources.
👉 Read Panther’s analysis of compromised credential detection and response steps →
Compromised credentials: are your post-authentication controls enough?
Explore further
02/08/2026 12:54 pm
Compromised credentials are now a post-authentication detection problem. The traditional IAM assumption is that successful authentication meaningfully proves the actor is the legitimate user. That assumption fails once session cookies, OAuth tokens, and API keys can be replayed without any new login event. The implication is that identity programmes must treat authentication as the beginning of scrutiny, not the end of it.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, with inadequate monitoring and logging at 37% and over-privileged accounts at 37%.
A question worth separating out:
Q: Who is accountable when stolen tokens are used to change cloud settings?
A: Accountability sits with the team that owns identity policy, privileged access design, and incident response together. If token revocation, admin separation, and tenant-change monitoring are split across teams, attackers can move faster than the response model. Governance must cover the whole session lifecycle.
👉 Read our full editorial: Compromised credentials now bypass many authentication controls
