Notifications
Clear all
Topic starter
10/07/2026 9:11 pm
TL;DR: Red Canary’s 2026 Threat Detection Report says identity-based threats now make up roughly 53% of detections, with identity-related activity rising 850% year over year, showing how valid credentials let attackers pass authentication instead of breaking it, according to Enzoic. Successful login can no longer be treated as trust; credential integrity has to be checked before access is granted.
NHIMG editorial — based on content published by Enzoic: The False Sense of Security in “Successful Logins”
By the numbers:
- Identity-based threats now account for roughly 53% of detections, and identity-related activity has surged by 850% year over year.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps.
Questions worth separating out
Q: How should security teams handle successful logins when credential exposure is possible?
A: Treat a successful login as proof that the credential worked, not proof that the actor is legitimate.
Q: Why do valid credentials make identity attacks harder to detect?
A: Because valid credentials let attackers move through normal authentication paths, which makes their activity look like ordinary user behaviour at first.
Q: What do security teams get wrong about successful logins?
A: They often treat login success as the end of the trust decision.
Practitioner guidance
- Add exposure-aware access checks Block or step up access when a credential appears in breach corpora, infostealer feeds, or other exposure sources before the session is accepted.
- Shorten the validity window of reusable credentials Reduce how long passwords, tokens, and service credentials remain usable so exposed secrets have less time to be abused across systems.
- Separate authentication success from trust decisions Treat a successful login as one input, then evaluate device posture, exposure history, and entitlement scope before allowing sensitive actions.
What's in the full article
Enzoic's full article covers the operational detail this post intentionally leaves for the source:
- Specific examples of how exposed credentials become valid access during real attacks.
- The research-driven explanation of why successful logins are deceptive in detection workflows.
- The article's guidance on shifting from session monitoring to credential integrity controls.
- The underlying evidence supporting the shift toward identity-based attacks.
👉 Read Enzoic's analysis of why successful logins are becoming a security blind spot →
Successful logins and identity attacks: are your controls keeping up?
Explore further
10/07/2026 9:34 pm
Successful authentication is no longer a trust event, it is only a credential state check. The security industry built login-centric control models for a world where authentication failure was the main concern. That model breaks when attackers enter with valid credentials, because the system verifies the secret rather than the legitimacy of the actor using it. The implication is that access governance must move upstream of the login event.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, with 38% reporting no or low visibility and 47% reporting only partial visibility.
A question worth separating out:
Q: Who is accountable when a valid credential is abused for access?
A: Accountability usually sits across identity operations, security monitoring, and the application owner because the failure begins before the login event. If exposure was known or could have been detected earlier, the control gap is governance of credential integrity, not just incident response after access has already been granted.
👉 Read our full editorial: Valid logins are becoming the blind spot in identity security
