Topic starter
24/06/2026 9:19 pm
TL;DR: Stolen usernames and passwords can still be replayed across multiple login systems, according to 1Kosmos. Identity systems that rely on passwords alone leave reused credentials useful for account takeover and fraud.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “What Is a Credential Stuffing Attack?”.
By the numbers:
- 1Kosmos reports that there were 193 billion credential stuffing attacks in 2020 alone.
Key questions
Q: How should security teams reduce credential stuffing risk across user and machine identities?
A: Use layered controls that limit credential reuse, strengthen authentication, and shorten the time a stolen secret remains useful.
Q: What are the signs that credential stuffing is already underway in an environment?
A: Common signs include rapid spikes in failed logins, repeated attempts from unfamiliar geographies, and simultaneous logins from disparate devices.
Q: Why do password reuse and credential stuffing remain so effective?
A: They remain effective because many users still reuse passwords and many environments still accept credentials without enough contextual risk checks.
Practitioner guidance
- Reduce password reliance at high-risk entry points Prioritise passwordless or phishing-resistant authentication for customer, workforce, and administrative accounts where account takeover would create material loss.
- Add step-up checks for anomalous logins Require additional verification when logins originate from new devices, unusual geographies, or abnormal velocity patterns that fit stuffing automation.
- Harden account recovery flows Remove weak recovery shortcuts that let a valid login become durable control through email reset loops or predictable knowledge-based verification.
Bottom line: Credential stuffing works because stolen usernames and passwords can be replayed against many services until one login succeeds.
Glossary terms: Credential Stuffing, Password reuse, Account Takeover, Phishing-Resistant Authentication
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 15 hours ago by NHI Mgmt Group
25/06/2026 6:28 am
Password-first identity creates credential portability: the real governance flaw is not only weak secrets, but the assumption that a password can continue to function as a reliable identity proof after reuse elsewhere. Credential stuffing proves that a password is a transferable bearer secret, not a durable trust signal. Identity programmes that still centre their controls on password possession are governing the symptom, not the failure mode.
A question worth separating out:
Q: Should organisations replace MFA with passwordless authentication?
A: Organisations should not treat this as a simple replacement question. MFA is still useful where passwordless is not yet available, but passwordless raises the security baseline by removing the password as the primary failure point. The right path is to use MFA as a bridge and passwordless as the destination.
👉 Read our full editorial: Credential stuffing exposes the limits of password-first identity