Topic starter
16/01/2026 4:47 pm
TL;DR: Despite heavy investment in layered controls, identity-based attacks still account for 50-80% of enterprise breaches, according to Beyond Identity's analysis, because legacy authentication continues to trust shared secrets and user judgment. Phishing-resistant, device-bound credentials change the problem by making whole attack classes technically impossible rather than merely less damaging.
Editorial analysis by NHI Mgmt Group, based on content published by Beyond Identity: “How to Eliminate Identity-Based Threats”.
By the numbers:
- Credential and user-based attacks account for 50-80% of enterprise breaches, according to Beyond Identity.
- Phishing and stolen credentials were the 2 most prevalent attack vectors in IBM's 2024 Cost of a Data Breach Report, cited by Beyond Identity.
Key questions
Q: What breaks when authentication starts with shared secrets instead of verified identity?
A: When authentication depends on shared secrets, security teams inherit the weaknesses of those secrets.
Q: Why do phishing-resistant authentication controls reduce breach risk so much?
A: They reduce risk because they make the credential non-transferable and bind it to a specific device and verifier.
Q: How do teams know whether authentication is actually preventing identity attacks?
A: Look for whether users can complete login only through phishing-resistant paths and whether any recovery, fallback, or alternate factor reintroduces a phishable secret.
Practitioner guidance
- Replace shared-secret primary authentication Migrate high-risk applications and administrative pathways away from passwords and one-time codes where phishing and replay are realistic threats.
- Remove phishable fallback factors Review help desk resets, recovery flows, and alternate login paths for any step that can be socially engineered back into a reusable secret or second device challenge.
- Bind credentials to the device Use device-bound asymmetric authentication so the credential cannot be copied into a phishing page, proxy, or remote replay workflow.
Bottom line: Identity-based attacks persist because authentication still relies on secrets that can be stolen, replayed, or socially engineered out of users.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:57 pm
Shared secrets are the wrong trust primitive for identity security: The article’s core failure mode is not weak user behaviour but an authentication model that still treats transferable secrets as proof of identity. That premise was designed for an environment where secrets could be reused and defended at the human layer. It fails when the attacker’s goal is to capture the secret itself. The implication is that IAM programmes should treat secret dependence as a structural liability, not a tuning problem.
A question worth separating out:
Q: Should organisations prioritise passkeys before adding more detection tools?
A: Yes, when the dominant problem is stolen credentials or phishing, because detection and response assume compromise has already happened. Passkeys and other device-bound credentials address the access problem earlier by removing reusable secrets from the primary path. Detection still matters, but it should not be the main defence for a login model that remains phishable.
👉 Read our full editorial: Identity-based threats persist because legacy authentication still trusts secrets