Topic starter
24/06/2026 10:18 pm
TL;DR: Verizon's Data Breach Investigations Report shows that stolen credentials remain the top access path and that the human element appears in 74% of breaches, while 44.7% of breaches involve stolen credentials, according to 1Kosmos's analysis of the report. Identity programmes still overvalue credential possession and underweight verification.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Verizon Data Breach Investigations Report 2023”.
By the numbers:
- The human element appears in 74% of breaches, including error, privilege misuse, stolen credentials, and social engineering.
- Stolen credentials account for 44.7% of breaches.
Key questions
Q: What breaks when stolen credentials are reused but not correlated across systems?
A: Teams lose the ability to prove that a login was part of an intrusion rather than ordinary user activity.
Q: Why do stolen or phished credentials create such outsized risk in modern breaches?
A: Stolen credentials are powerful because they often bypass the hardest part of an attack, getting in without triggering obvious malware defenses.
Q: How can IAM teams tell whether fraud controls are actually working?
A: Look for fewer unverified high-risk requests, better challenge rates on abnormal approvals, and stronger separation between routine identity events and exceptional transactions.
Practitioner guidance
- Reassess credential possession as a trust signal Map where your IAM programme still treats password or token possession as sufficient proof of the right user, then flag those flows for stronger verification.
- Add identity verification at enrollment and access Require a verified identity step at onboarding and re-check it at higher-risk access requests so the user can be distinguished from a copied credential.
- Reduce reliance on reusable credentials Prioritise access paths where passwords or shared secrets still gate sensitive systems, and move them toward stronger assurance methods that do not depend on memorised secrets.
Bottom line: Stolen credentials remain a dominant breach path because many identity programmes still equate possession with trust.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 6:56 am
Credential possession is no longer a sufficient trust signal: The article reinforces a basic governance failure in many identity programmes. A system that treats a reusable secret as proof of personhood is making an assumption that attackers can exploit with stolen logins. Practitioners should treat possession-based login as an incomplete security decision, not a finished control.
A few things that frame the scale:
- Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.
A question worth separating out:
Q: What should organisations do when passkeys are not enough on their own?
A: Add session and authorization controls that limit damage after login. Bind sessions to devices where possible, shorten token lifetimes for sensitive actions, and monitor consent grants, endpoint compromise, and unusual recovery events. Passkeys protect authentication, but they do not prevent OAuth abuse or post-login session theft.
👉 Read our full editorial: Credentials still drive most breaches, but verification is the real gap