Notifications
Clear all
Topic starter
11/07/2026 8:28 pm
TL;DR: IBM’s 2025 breach research shows phishing at 16% of incidents and third-party or supply-chain compromise at about 15%, while stolen credentials still drive roughly one in ten breaches and remain among the slowest to detect, according to Enzoic’s analysis of the report. Continuous credential monitoring is now a core containment control because valid logins still outperform many preventive defences.
NHIMG editorial — based on content published by Enzoic: Why Credential Monitoring is Essential When Attackers are Logging in, Not Breaking In
By the numbers:
- In 2025, phishing rose to the number one attack vector at 16% of breaches.
- 15% of breaches and took nearly nine months, counted for about 15% of breaches and took nearly nine months on average to detect.
- Breaches initiated with stolen credentials have a mean time to identify and contain of about 246 days.
Questions worth separating out
Q: How should security teams respond when stolen credentials are discovered in breach data?
A: They should treat the finding as an active exposure event, not a background risk note.
Q: Why do stolen credentials still cause breaches even when MFA is deployed?
A: Because attackers often target the part of the identity flow that MFA does not fully eliminate, such as session tokens, infostealer output, vendor logins, or social engineering against the approved path.
Q: What breaks when organisations do not monitor third-party credentials?
A: Visibility breaks first, then accountability.
Practitioner guidance
- Continuous credential screening across all identity types Screen employee, contractor, vendor, and privileged credentials against breach corpora, paste sites, and malware logs so exposure is detected before attackers reuse it.
- Shorten the exposure-to-response window Route every confirmed exposure into a defined workflow that can reset passwords, revoke session tokens, and force step-up checks before the identity is used again.
- Extend monitoring to third-party access paths Include partner users, federated accounts, and contractor logins in the same compromise-detection process as internal identities.
What's in the full article
Enzoic's full article covers the operational detail this post intentionally leaves for the source:
- How continuous credential monitoring is wired to breach databases, paste sites, and dark-web logs.
- How organisations can automate resets, lockouts, and challenge flows after credential exposure is confirmed.
- How vendor and contractor identities are folded into monitoring programs without relying on perimeter controls alone.
👉 Read Enzoic’s analysis of why credential monitoring is essential in 2025 breach response →
Credential monitoring and stolen login risk , are your controls keeping up?
Explore further
11/07/2026 8:58 pm
Credential exposure, not password weakness, is the real trust failure: The article reflects a broader identity reality that valid credentials have become the attacker’s preferred transport layer. Once a password, cookie, or token is exposed, the security model is no longer about whether authentication works. It is about whether the organisation can still trust the identity after compromise. Practitioners should treat exposed login data as an identity-state change, not a policy exception.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to Astrix Security & CSA.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to Astrix Security & CSA.
A question worth separating out:
Q: Who is accountable when a compromised vendor login is used to access an enterprise environment?
A: Accountability sits with both sides of the access relationship. The vendor must manage its own credential hygiene, but the enterprise remains responsible for deciding what third-party access is trusted, monitored, and rapidly revoked when exposure is found. Shared access does not mean shared control.
👉 Read our full editorial: Credential monitoring is now central to breach containment
