Topic starter
10/07/2026 9:14 pm
TL;DR: SANS data shows 35% of organisations cite credential phishing or stolen credentials in identity attacks, 24% report brute force or credential stuffing, and 47% still rely on on-premises Active Directory or legacy applications for critical identities, according to Enzoic. The login workflow is now a control surface, not just a checkpoint, because compromised credentials can satisfy authentication while already being unsafe.
Editorial analysis by NHI Mgmt Group, based on content published by Enzoic: “Pre-Authentication Risk Is Reshaping the Login Workflow”.
Key questions
Q: What breaks when organisations treat login as the whole authentication control?
A: They miss post-login fraud, session theft, and impersonation that happens after initial access is granted.
Q: Why do compromised credentials often bypass MFA controls?
A: Because many attacks steal the artifact issued after MFA, not the password itself.
Q: What are the signs that pre-authentication risk is being underestimated?
A: Look for heavy dependence on post-login alerts, repeated account takeover activity, and legacy identity systems that still anchor critical access.
Practitioner guidance
- Expand login-time credential screening Check presented credentials against exposure data at authentication and password reset points so compromised secrets are blocked before access is granted.
- Prioritise legacy identity surfaces Map which critical applications still depend on Active Directory or other legacy identity systems, then apply stronger login controls where those paths remain in use.
- Separate correct from safe credentials Update identity workflows so a valid password is not treated as trustworthy unless it also clears exposure and reuse checks.
Bottom line: Pre-authentication risk shifts identity defence from post-login detection to the moment a credential is used.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:37 pm
Pre-authentication risk exposes a login-centric assumption gap: traditional identity controls were built on the assumption that the authentication event is where risk begins. That assumption fails when the credential itself is already unsafe before the user reaches the login page. The implication is that identity programmes must stop treating login as a neutral checkpoint and recognise it as a governed security boundary.
A question worth separating out:
Q: How should teams balance login controls with legacy identity infrastructure?
A: They should tighten controls where the riskiest identity paths still exist, especially Active Directory-backed or hybrid flows that support critical access. The goal is not to replace every downstream control, but to move the first meaningful decision closer to credential use and away from post-authentication detection.
👉 Read our full editorial: Pre-authentication risk is reshaping identity login controls