Topic starter
16/08/2026 1:11 pm
TL;DR: Stolen credentials still sit at the center of breach entry, with 88% of attacks against basic web applications involving them, according to Descope. Identity programs now have to assume replayed secrets can reach accounts before recovery or MFA catches up.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Verizon DBIR 2025: Credentials Are Still #1 Threat”.
By the numbers:
- The 18th annual DBIR analyzed over 22,000 incidents, with roughly half confirmed as actual data breaches.
- A staggering 88% of attacks against basic web applications involved the use of stolen credentials.
- Brute force attacks against basic web apps rose nearly tripling over the last year, from roughly 20% to 60%.
Key questions
Q: Why do conventional MFA controls still fail against credential theft?
A: Conventional MFA fails when the attacker can intercept prompts, steal tokens, or replay a session after the first secret is exposed.
Q: What are the signs that password-based access is still too easy to abuse?
A: Repeated credential reuse, high reset volume, unexpected login success after password exposure, and fraud or compromise that survives MFA all point to weak identity assurance.
Q: What should teams do first when stolen credentials are driving breach entry?
A: Start by identifying the accounts and journeys where reused secrets still grant the highest reach, then replace those paths with phishing-resistant authentication.
Practitioner guidance
- Prioritise phishing-resistant authentication Replace password-plus-OTP defaults for high-risk customer and workforce journeys with origin-bound authentication methods that resist relay and replay attacks.
- Reduce reusable credential value Shorten the lifetime of passwords, tokens, and session artefacts wherever reuse is possible, and make revocation faster than attacker reuse.
- Test recovery and fallback paths Validate password reset, account recovery, and step-up flows against stolen-credential scenarios so attackers cannot pivot through the weakest alternate path.
Bottom line: Credential abuse remains the most reliable breach entry path because exposed secrets can still be replayed, reused, or sold before defenders can react.
Glossary terms: Credential Abuse, Phishing-Resistant Authentication, MFA Bypass, Customer Identity And Access Management
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 12 hours ago by NHI Mgmt Group
16/08/2026 1:13 pm
Credential abuse is now an authentication design problem, not a password problem. The DBIR data in this article shows that stolen credentials remain the preferred entry path even when organisations invest heavily in layered security. That means the control failure sits in the trust model for reused secrets, not in one missed alert or one weak user. The practitioner conclusion is that authentication architecture has to assume exposure and reduce the usefulness of any single credential artifact.
A few things that frame the scale:
- Credential abuse across the entire attack chain, not just initial access, appears in 39% of all breaches, according to the 2026 Verizon Data Breach Investigations Report.
A question worth separating out:
Q: How should security teams implement phishing-resistant authentication without hurting adoption?
A: Start with the highest-risk populations and applications, then offer the simplest usable authenticators that still meet your assurance target. Build recovery, enrollment, and help desk processes at the same time. If users cannot enroll and recover reliably, they will route around the control and weaken the programme.
👉 Read our full editorial: Verizon DBIR 2025 shows credential abuse still drives breach entry