Topic starter
10/07/2026 9:19 pm
TL;DR: Exposed passwords keep driving web application breaches because attackers can automate credential stuffing and password spraying across multiple services, according to Verizon’s Data Breach Investigations Report and Enzoic’s analysis. Blocking compromised credentials during creation or reset shifts defence earlier in the identity workflow, where reuse becomes a controllable risk rather than a post-breach incident.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “Enzoic Expands Protection Against Dark Web Credential Exposure”.
Key questions
Q: How should security teams stop users from setting compromised passwords?
A: Security teams should enforce breach-intelligence checks at the exact moment a password is created or reset.
Q: Why do reused passwords create such a large identity risk?
A: Reused passwords turn one disclosure into many possible logins.
Q: What are the signs that password workflows are failing to block exposed credentials?
A: Warning signs include repeated login attempts with previously breached passwords, successful resets to risky passwords, and inconsistent enforcement between self-service and help-desk processes.
Practitioner guidance
- Block compromised passwords at issuance Enforce breach-based screening during both self-service and assisted password creation or reset so exposed secrets are rejected before activation.
- Integrate credential intelligence into identity workflows Connect compromise feeds to directories, authentication services, and IAM workflows so risky passwords are caught where access decisions are made.
- Review password reuse exposure paths Map where user-chosen passwords are reused across enterprise and personal accounts, then prioritise the systems with the highest exposure overlap.
Bottom line: Exposed passwords remain dangerous because attackers can reuse them across services long after the original breach.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:42 pm
Compromised-password screening is an issuance control, not a cleanup control: The central governance shift in this topic is moving exposed-credential checks into the moment a password is created or reset. That breaks the assumption that authentication controls only need to react after compromise is suspected. In practice, the security programme should treat password issuance as a decision point where external exposure data can still prevent a bad authenticator from entering circulation.
A few things that frame the scale:
- Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.
A question worth separating out:
Q: What happens when exposed-password checks are missing from identity governance?
A: When exposed-password checks are missing, an organisation keeps accepting secrets that attackers may already know. That creates a direct path from breach data to authenticated access, which can lead to account takeover, fraud, or lateral movement. The governance failure is not the breach itself, but the decision to let a known-compromised secret remain valid.
👉 Read our full editorial: Credential exposure in password workflows raises identity risk