Topic starter
12/07/2026 12:18 pm
TL;DR: Credential theft becomes more damaging when passwords are reused across personal and corporate accounts, according to GlobalSign. Stronger authentication, signed email, and encrypted sessions help close the identity and communication gaps that let one exposed secret spread across systems.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “La Importancia de la Seguridad de la Información”.
Key questions
Q: Why do phishing campaigns still work even when organisations have security tools in place?
A: They often succeed before tooling has a chance to intervene.
Q: How do S/MIME and SSL/TLS address different identity risks?
A: S/MIME protects the authenticity and confidentiality of email messages, while SSL/TLS protects data in transit between a user and a website or application.
Q: How should IAM teams reduce password-related productivity loss?
A: They should start by measuring where password failures interrupt work most often, then redesign the highest-friction journeys first.
Practitioner guidance
- Tighten password reuse controls Block reused credentials where possible, and prioritise high-value corporate identities that share patterns with personal accounts.
- Deploy sender verification for sensitive email Use S/MIME or an equivalent email signing model for communications that carry business-sensitive instructions or data.
- Enforce encrypted web sessions Require SSL/TLS for any portal or application handling credentials, customer data, or internal workflows.
Bottom line: Credential theft becomes more damaging when users reuse passwords across personal and corporate accounts, because one exposed secret can unlock multiple identities.
Glossary terms: Credential Theft, Phishing, S/MIME, SSL/TLS
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 8 hours ago by NHI Mgmt Group
12/07/2026 12:32 pm
Credential reuse is an identity governance failure, not a user habit problem. The article’s strongest point is that copied or shared passwords let attackers move from a weak personal account into a corporate one. That is a lifecycle and governance issue because the enterprise cannot prove uniqueness or exclusivity of the credential. Practitioners should read this as a signal that authentication policy is only as strong as the reuse boundary it enforces.
A question worth separating out:
Q: When should organisations treat identity assurance as more important than user awareness?
A: When a single stolen password or convincing email can lead to corporate access, identity assurance has to come first. Awareness helps, but it cannot reliably prevent credential reuse or targeted impersonation. Controls that verify the identity of the user and the sender are more dependable than human detection alone.
👉 Read our full editorial: Credential theft and phishing expose identity gaps in digital security