Topic starter
11/07/2026 8:21 pm
TL;DR: Credential stuffing still succeeds because attackers reuse breached credentials at scale, with success rates of 0.1% to 4%, while AI agents are helping them bypass CAPTCHAs and mimic legitimate behaviour, according to Authsignal. The real defence is to move beyond static login flows toward adaptive authentication and passkeys, not to rely on rate limiting alone.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “How to actually stop credential stuffing in 2025”.
Key questions
Q: What fails when credential stuffing is handled with static login rules?
A: Static login rules fail because credential stuffing is designed to look like normal low-volume access across many accounts and many IPs.
Q: Why do password reuse and near reuse create such high account takeover risk?
A: Password reuse turns one breach into many because attackers often test exposed credentials across multiple services.
Q: How do security teams know adaptive MFA is actually reducing credential stuffing?
A: They should look for fewer successful logins following unusual risk signals, fewer account recoveries after suspicious sign-ins, and lower fraud or support volume tied to authentication abuse.
Practitioner guidance
- Implement adaptive step-up policies Use device, location, velocity, and historical access patterns to trigger additional verification only when sign-in risk changes materially.
- Prioritise passkey rollout for high-value accounts Start with accounts that create the greatest fraud or data exposure if taken over, then expand to broader user populations once recovery and enrolment flows are stable.
- Reduce reliance on static login signals Supplement IP reputation and rate limiting with behavioural and session signals so distributed attacks are visible even when each attempt is low frequency.
Bottom line: Credential stuffing remains effective because attackers can turn breached passwords into valid sessions even when each individual attempt looks low risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:51 pm
Static login flows are the real vulnerability, not passwords alone. Credential stuffing succeeds because authentication systems still assume that a login attempt can be judged in isolation. Once attacker infrastructure spreads attempts across many IPs and many accounts, that assumption collapses. The practitioner lesson is that identity assurance has to move from the login event to the context around it.
A question worth separating out:
Q: Should organisations replace passwords everywhere with passkeys immediately?
A: No. Organisations should prioritise high-volume, high-friction consumer flows first, then expand where device support and recovery controls are mature. Immediate replacement can create support gaps if the fallback model is weak. A staged rollout lets teams verify assurance, usability, and operational readiness before eliminating passwords more broadly.
👉 Read our full editorial: Credential stuffing in 2025: why passwords still fail