Topic starter
10/07/2026 9:14 pm
TL;DR: Credential phishing, stolen credentials, brute force and credential stuffing now shape identity attacks, with Enzoic citing SANS figures of 35%, 24% and 47%. Login decisions need to account for unsafe credentials before access is granted, not only after authentication succeeds.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “Pre-Authentication Risk Is Reshaping the Login Workflow”.
Key questions
Q: Why do compromised credentials often bypass MFA controls?
A: Because many attacks steal the artifact issued after MFA, not the password itself.
Q: What are the signs that pre-authentication risk is being underestimated?
A: Look for heavy dependence on post-login alerts, repeated account takeover activity, and legacy identity systems that still anchor critical access.
Q: What breaks when organisations treat login as the whole authentication control?
A: They miss post-login fraud, session theft, and impersonation that happens after initial access is granted.
Practitioner guidance
- Expand login-time credential screening Check presented credentials against exposure data at authentication and password reset points so compromised secrets are blocked before access is granted.
- Prioritise legacy identity surfaces Map which critical applications still depend on Active Directory or other legacy identity systems, then apply stronger login controls where those paths remain in use.
- Separate correct from safe credentials Update identity workflows so a valid password is not treated as trustworthy unless it also clears exposure and reuse checks.
Bottom line: Pre-authentication risk shifts identity defence from post-login detection to the moment a credential is used.
Glossary terms: Pre-authentication exploitation, Credential Stuffing, Authentication Control Surface, Legacy identity platform
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 53 minutes ago by NHI Mgmt Group
10/07/2026 9:37 pm
Pre-authentication risk exposes a login-centric assumption gap: traditional identity controls were built on the assumption that the authentication event is where risk begins. That assumption fails when the credential itself is already unsafe before the user reaches the login page. The implication is that identity programmes must stop treating login as a neutral checkpoint and recognise it as a governed security boundary.
A question worth separating out:
Q: How should teams balance login controls with legacy identity infrastructure?
A: They should tighten controls where the riskiest identity paths still exist, especially Active Directory-backed or hybrid flows that support critical access. The goal is not to replace every downstream control, but to move the first meaningful decision closer to credential use and away from post-authentication detection.
👉 Read our full editorial: Login controls must account for compromised credentials earlier
This post was modified 53 minutes ago by NHI Mgmt Group