Topic starter
01/08/2026 10:50 pm
TL;DR: High-profile incidents at MGM Resorts, TransUnion, McDonald’s, UnitedHealth, and Okta show that password-centric controls still fail under social engineering and visibility gaps, according to Unixi. The real issue is not MFA alone but identity perimeter coverage, unmanaged SaaS, and shared or default credentials that leave attackers room to move.
Editorial analysis by NHI Mgmt Group, based on content published by Unixi: “How 5 Credential Theft Breaches Could Have Been Prevented”.
By the numbers:
- 85% of data breaches will involve social engineering by 2026, according to Gartner predictions cited by Unixi.
Key questions
Q: What breaks when only part of the environment uses SSO?
A: Partial SSO creates two security models at once: governed access for federated apps and ad hoc access for everything else.
Q: Why do social engineering attacks still succeed against identity support teams?
A: They succeed because many support processes still depend on discretionary human judgment, static knowledge questions, and urgency-based exception handling.
Q: What signs show that identity coverage is incomplete?
A: The clearest signs are separate review processes, missing activity timelines, and systems that cannot be governed without opening network paths to the control plane.
Practitioner guidance
- Map every non-federated access path Identify SaaS, legacy portals, vendor systems, and admin consoles that still authenticate outside the IdP, then assign owners and remediation dates to each exception.
- Treat help desk resets as privileged workflows Require strong identity verification, audited approval, and escalation thresholds for password resets, MFA resets, and account recovery requests that can create valid access for attackers.
- Eliminate shared and default administrative credentials Replace common admin logins with individually attributable access, and offboard any shared secret that cannot be tied to a named owner or a specific system purpose.
Bottom line: Credential theft keeps succeeding where identity coverage is partial, especially when unmanaged SaaS, legacy portals, and shared accounts remain outside the governed perimeter.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:58 pm
Partial SSO is an identity governance gap, not a convenience trade-off: When some access paths remain outside federation, security policy becomes conditional rather than universal. That breaks the assumption that a central control plane actually governs all access. The practical conclusion is that coverage, not just control quality, defines the true identity perimeter.
A question worth separating out:
Q: When should teams replace shared credentials with named access?
A: They should do it whenever a credential is used by more than one person, team, or vendor, or when it grants administrative access to a business-critical system. Shared credentials destroy attribution, complicate offboarding, and widen blast radius, so the default should be individually attributable access unless a technical exception is unavoidable.
👉 Read our full editorial: Credential theft and partial SSO gaps are exposing modern identity controls