Topic starter
10/07/2026 9:21 pm
TL;DR: Identity-related compromise hit 55% of organisations even though 85% deploy identity security solutions, and 68% detect identity attacks within 24 hours while only 55% contain them that fast, according to Enzoic's review of the 2026 SANS Identity Threats & Defenses Survey. The failure is upstream credential exposure: controls assume credentials remain trustworthy until login, but attackers exploit already-compromised access paths.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “2026 SANS Identity Threats Report: Why Attacks Still Work”.
By the numbers:
- 55% of organisations experienced an identity-related compromise in the past year despite deploying identity security solutions.
- 85% deploy identity security solutions.
- 68% detect identity attacks within 24 hours.
Key questions
Q: What breaks when compromised credentials are still accepted by identity systems?
A: When compromised credentials are still accepted, detection becomes a post-exploitation signal rather than a control.
Q: Why do exposed credentials remain a major IAM risk in hybrid environments?
A: Exposed credentials remain risky because hybrid estates often trust the same identity across directories, cloud services, and SaaS applications.
Q: What are the signs that identity detection is working but containment is too slow?
A: A common sign is fast alerting but recurring compromise, especially when attackers keep operating after the initial login is flagged.
Practitioner guidance
- Continuously identify exposed credentials Correlate breached-password intelligence, endpoint telemetry, and browser session data so credentials can be flagged before they are reused in trusted login flows.
- Invalidate compromised access paths quickly Automate session revocation, token invalidation, and password reset workflows so a known exposed identity cannot keep authenticating while analysts investigate.
- Map where credentials stay valid across systems Document which passwords, tokens, and browser-based sessions can still authenticate across Active Directory, cloud identity providers, and SaaS integrations.
Bottom line: The core failure is not weak login monitoring but the fact that exposed credentials often remain acceptable to systems that still trust them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:43 pm
Upstream credential exposure is the control gap that identity programmes still underweight. The article shows that attackers do not need to defeat authentication when they can arrive with credentials that are already compromised. That shifts the decisive control point from login-time inspection to pre-use trust evaluation. For practitioners, the key question is no longer whether the identity platform sees the login, but whether the credential should have remained admissible at all.
A question worth separating out:
Q: Should teams prioritise credential exposure monitoring over more login alerts?
A: They should prioritise exposure monitoring when the dominant threat is compromised credentials entering legitimate login flows. Login alerts still matter, but they are downstream of the real failure point. If a credential is already exposed, the most valuable control is knowing that before it is reused, not simply seeing the authentication event.
👉 Read our full editorial: Identity attacks still work because exposed credentials stay valid