Topic starter
11/07/2026 8:36 pm
TL;DR: Stolen credentials still drive successful SMB intrusions, including the 88% share of basic web application breaches Enzoic cites, according to Enzoic. Exposure monitoring and tighter privilege scope are what keep a valid login from turning into broad compromise.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “Protecting Your SMB”.
By the numbers:
- 88% of basic web application breaches involve stolen credentials, according to the 2025 Verizon DBIR cited by Enzoic.
- Microsoft Security reports that 1 in 3 SMBs experienced a cyberattack in the past year.
- Sophos found that compromised credentials played a role in 30% of ransomware attacks in the 100–250 employee segment.
Key questions
Q: Why does weak user access management increase security risk in small and mid-sized businesses?
A: Weak user access management leaves permissions scattered, outdated, and hard to audit.
Q: What are the signs that credential-based access controls are failing in an organisation?
A: Common warning signs include repeated login failures from unusual locations, unexpected privilege changes, orphaned accounts, and access being granted long after role changes.
Q: What fails first when SMBs rely on valid credentials as proof of trust?
A: The failure is the assumption that authentication success equals trust.
Practitioner guidance
- Implement continuous credential screening Check both newly created and existing passwords against known-compromised lists, breach corpuses, and dark-web exposure feeds so valid but unsafe credentials are blocked before use.
- Tighten privilege around high-value accounts Limit email, VPN, and Active Directory accounts to the minimum access they need, then segment critical systems so a stolen login cannot reach the entire environment.
- Enforce stronger MFA enforcement consistency Require the same MFA standard across all remote and local access paths, and remove weaker second factors where prompt bombing or interception can bypass them.
Bottom line: Credential-based attacks succeed in SMBs because valid logins still bypass too many trust assumptions.
Glossary terms: Credential Stuffing, Exposure Monitoring, Unmanaged Device, CI trust boundary
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 hours ago by NHI Mgmt Group
11/07/2026 9:04 pm
Credential trust debt is the hidden SMB identity risk: SMB programmes often still treat a valid password as a strong trust signal, even when the credential has already been exposed, reused, or sold. That assumption is what credential-based attackers exploit. The practitioner conclusion is that identity governance has to measure exposure, not just authentication success.
A few things that frame the scale:
- Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.
A question worth separating out:
Q: How should teams reduce the blast radius of a stolen SMB credential?
A: Start by limiting what email, VPN, and directory accounts can reach, then separate critical systems so compromise of one login does not translate into broad access. The goal is to make a stolen credential useful only for the narrowest possible scope, which turns many intrusions into contained events instead of full environment compromises.
👉 Read our full editorial: Credential-based attacks expose SMB identity gaps that IAM teams miss