Notifications
Clear all
Topic starter
16/08/2026 1:11 pm
TL;DR: Credential abuse remains the dominant breach entry path, with stolen credentials involved in 88% of attacks against basic web applications and only 3% of compromised passwords meeting basic complexity requirements, according to Descope. Verizon's 2025 DBIR findings reinforce that password-based authentication and weak MFA assumptions are no longer sufficient for customer identity programmes.
NHIMG editorial — based on content published by Descope: Verizon DBIR 2025: Credentials Are Still #1 Threat
By the numbers:
- 88% of attacks against basic web applications involved stolen credentials.
- 60% of all breaches involved the human element.
- 31% of Microsoft 365 attacks used token theft as the MFA bypass method.
Questions worth separating out
Q: How should security teams reduce breach risk from stolen credentials?
A: Security teams should reduce credential lifetime, remove stale secrets from code and tooling, and make access revocation faster than attacker reuse.
Q: Why do weak MFA implementations still fail against real attackers?
A: Because many attacks target the factor delivery or the session after the password is accepted.
Q: What do security teams get wrong about password complexity?
A: They often treat complexity as a proxy for security.
Practitioner guidance
- Replace reusable secrets on high-risk accounts Prioritise phishing-resistant passkeys or equivalent methods for administrator, finance, support, and customer accounts that would create high blast radius if abused.
- Rework MFA around session trust Instrument token theft, MFA fatigue, and adversary-in-the-middle patterns in your detection stack.
- Shrink recovery-path privilege Limit helpdesk resets, step-up exemptions, and recovery flows to the smallest feasible set of staff and cases.
What's in the full article
Descope's full analysis covers the operational detail this post intentionally leaves for the source:
- The full breakdown of DBIR credential abuse patterns across web applications, customer identity, and third-party access.
- The article's specific discussion of MFA bypass methods, including token theft, prompt bombing, and adversary-in-the-middle flows.
- The passkey adoption and implementation context that sits behind the passwordless recommendation.
- Descope's product-level guidance on bringing passkeys into existing CIAM flows without redesigning the entire authentication stack.
👉 Read Descope's analysis of Verizon DBIR 2025 and credential abuse →
Credentials still lead breach entry in the DBIR - what teams should do?
Explore further
16/08/2026 1:13 pm
Credential exposure is now an identity governance failure, not just an authentication failure: the DBIR reinforces that stolen credentials still deliver the highest-return access path for attackers. Passwords, session tokens, and fallback recovery paths all become part of the same governance surface once identity is the entry point. Practitioners should stop treating authentication as a front-door problem and start treating it as lifecycle and blast-radius control.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: What should teams do when a credential leak is discovered in a third-party system?
A: Treat it as a live identity event, not a notification. Revoke the credential, confirm which workloads or accounts depended on it, and review whether the partner environment exposed other credentials with the same privileges. Third-party leaks often become internal breaches because the same identity reaches both environments.
👉 Read our full editorial: Verizon DBIR 2025 shows credential abuse still drives breach entry
