Topic starter
11/07/2026 8:36 pm
TL;DR: Credential-based attacks remain the path of least resistance for SMB intrusions, with Enzoic citing 2025 Verizon DBIR data showing 88% of basic web application breaches involved stolen credentials and Microsoft and Sophos reporting frequent SMB compromise, unmanaged-device exposure, and costly recovery. The problem is not password complexity alone but the lack of continuous credential screening, least-privilege containment, and exposure monitoring.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “Protecting Your SMB”.
By the numbers:
- 88% of basic web application breaches involve stolen credentials, according to the 2025 Verizon DBIR cited by Enzoic.
- Microsoft Security reports that 1 in 3 SMBs experienced a cyberattack in the past year.
- Sophos found that compromised credentials played a role in 30% of ransomware attacks in the 100–250 employee segment.
Key questions
Q: What fails first when SMBs rely on valid credentials as proof of trust?
A: The failure is the assumption that authentication success equals trust.
Q: Why does weak user access management increase security risk in small and mid-sized businesses?
A: Weak user access management leaves permissions scattered, outdated, and hard to audit.
Q: What are the signs that credential-based access controls are failing in an organisation?
A: Common warning signs include repeated login failures from unusual locations, unexpected privilege changes, orphaned accounts, and access being granted long after role changes.
Practitioner guidance
- Implement continuous credential screening Check both newly created and existing passwords against known-compromised lists, breach corpuses, and dark-web exposure feeds so valid but unsafe credentials are blocked before use.
- Tighten privilege around high-value accounts Limit email, VPN, and Active Directory accounts to the minimum access they need, then segment critical systems so a stolen login cannot reach the entire environment.
- Enforce stronger MFA enforcement consistency Require the same MFA standard across all remote and local access paths, and remove weaker second factors where prompt bombing or interception can bypass them.
Bottom line: Credential-based attacks succeed in SMBs because valid logins still bypass too many trust assumptions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:04 pm
Credential trust debt is the hidden SMB identity risk: SMB programmes often still treat a valid password as a strong trust signal, even when the credential has already been exposed, reused, or sold. That assumption is what credential-based attackers exploit. The practitioner conclusion is that identity governance has to measure exposure, not just authentication success.
A few things that frame the scale:
- Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.
A question worth separating out:
Q: How should teams reduce the blast radius of a stolen SMB credential?
A: Start by limiting what email, VPN, and directory accounts can reach, then separate critical systems so compromise of one login does not translate into broad access. The goal is to make a stolen credential useful only for the narrowest possible scope, which turns many intrusions into contained events instead of full environment compromises.
👉 Read our full editorial: Credential-based attacks expose SMB identity gaps that IAM teams miss