Topic starter
22/06/2026 1:44 pm
TL;DR: Identity-based intrusions rose 156% between 2024 and Q1 2025 and now account for 59% of all confirmed incidents, according to SPHERE citing eSentire and Cybersecurity Intelligence, as phishing kits and infostealer malware make valid credential theft fast enough to bypass MFA and reach critical systems. Identity hygiene is no longer cleanup work; it is the control plane for reducing blast radius and proving least privilege.
Editorial analysis by NHI Mgmt Group, based on content published by SPHERE: “From Credential Chaos to Boardroom Mandate: How Modern Leaders Turn Identity Hygiene into Competitive Advantage”.
By the numbers:
- Identity-based intrusions soared 156% between 2024 and Q1 2025, according to SPHERE citing eSentire and Cybersecurity Intelligence.
- Identity-based intrusions now account for 59% of all confirmed incidents, according to SPHERE citing eSentire and Cybersecurity Intelligence.
- SPHERE says its Identity Hygiene platform cut orphaned accounts by a median of 80% in the first 30 days.
Key questions
Q: What breaks when organisations rely on annual access reviews for credential intrusion defence?
A: Annual reviews break because credential attacks move faster than certification cycles.
Q: Why do valid credentials create such a large security risk even when MFA is in place?
A: Valid credentials matter because MFA only proves an authentication event, not whether the resulting access is appropriate, current, or narrowly scoped.
Q: What are the signs that identity hygiene is failing in an organisation?
A: Common warning signs include orphaned accounts, excessive privileges, inconsistent MFA enforcement, weak or reused credentials, and unmanaged non-human identities such as service accounts or API keys.
Practitioner guidance
- Map every identity class Create a complete inventory across privileged, service, dormant, and human accounts, and tie each account to an owner and business justification.
- Reduce standing privilege Review entitlements for excessive or outdated permissions and remove access that no longer matches job function or system purpose.
- Automate risky access cleanup Use automated detection and remediation for dormant accounts, orphaned identities, and privilege drift so compromise windows shrink before attackers can move laterally.
Bottom line: Credential intrusions are succeeding because attackers increasingly rely on valid access rather than noisy exploitation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 1:50 pm
Identity hygiene has become intrusion prevention, not administrative cleanup. Once attackers can buy or steal valid credentials, the decisive control is no longer perimeter denial but whether identity governance can collapse the attacker's usable access. That shifts identity hygiene from a housekeeping function into a front-line security control. The practical conclusion is that IAM, PAM, and NHI teams should measure hygiene by intrusion reduction, not only by audit readiness.
A question worth separating out:
Q: How should security teams reduce the risk of credential stuffing in SaaS environments?
A: Start by removing the conditions that make credential reuse effective. Enforce unique passwords, adopt phishing-resistant MFA for sensitive access, monitor for anomalous logins, and close shadow SaaS gaps that bypass central control. The strongest defence combines prevention with post-login detection, because some valid credentials will eventually be used successfully.
👉 Read our full editorial: Identity hygiene is now the core defense against credential intrusions