Notifications
Clear all
Topic starter
11/07/2026 8:26 pm
TL;DR: Compromised credentials remain the most reliable path to account takeover, with 93.7% of organisations concerned about ATO in the next two years and 56.3% unable to detect dark web exposure immediately, according to Osterman Research. The operational gap is no longer visibility alone, but the delay between exposure discovery and neutralisation.
NHIMG editorial — based on content published by Enzoic: Osterman’s 2025 findings on compromised passwords
By the numbers:
- 93.7% are concerned about account takeover due to compromised credentials in the next two years.
- 56.3% say they cannot immediately detect when employees’ credentials show up on dark web forums.
- Only 35.7% of organisations currently use technology to detect compromised credentials on dark web forums.
Questions worth separating out
Q: How should security teams respond when exposed passwords appear on dark web forums?
A: Security teams should map the exposed credential to a live identity, assess whether it is still valid, and trigger containment actions immediately if the match is credible.
Q: Why do compromised credentials remain such a persistent account takeover risk?
A: Compromised credentials remain effective because they often look legitimate to authentication systems and can be reused quickly across services.
Q: What do security teams get wrong about dark web monitoring?
A: The common mistake is treating dark web monitoring as a visibility exercise instead of a containment capability.
Practitioner guidance
- Correlate exposed credentials to live identities Link dark web findings to corporate email domains, user directories, and authentication records so analysts can distinguish irrelevant leaks from identities that can still be used.
- Automate credential neutralisation Expire risky passwords, revoke active sessions, and force reset workflows as soon as a match is confirmed, instead of waiting for manual investigation and ticket closure.
- Measure containment speed Track time to detect and time to neutralise as separate metrics, because visibility alone does not reduce exposure if access remains valid for hours or days.
What's in the full article
Enzoic's full article covers the operational detail this post intentionally leaves for the source:
- Figure-level breakdowns of detection maturity, confidence, and response gaps in Osterman Research's white paper
- The sponsor’s practical approach to real-time dark web monitoring and identity matching workflows
- Operational examples of autonomous remediation for leaked passwords and exposed credentials
- The survey context behind the findings, including sample composition and response patterns
👉 Read Enzoic's analysis of Osterman Research's findings on compromised passwords and ATO risk →
Compromised passwords and account takeover: what identity teams need now?
Explore further
11/07/2026 8:55 pm
Compromised password exposure is a blast-radius problem, not just a detection problem. Organisations can see the leak and still fail to contain it before the credential is reused. The decisive control question is whether exposure intelligence can trigger revocation before the attacker gets a usable session.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- 46% confirmed a non-human identity breach and 26% suspected one, which shows how often identity exposure is recognised only after the control failure has already occurred.
A question worth separating out:
Q: Who is accountable when a leaked password leads to account takeover?
A: Accountability sits with the teams responsible for identity governance, detection, and containment, because password exposure is only a breach if the organisation fails to act on it. Governance, IAM operations, and incident response all share responsibility for shortening the exposure window.
👉 Read our full editorial: Compromised passwords remain the fastest route to account takeover
