Topic starter
22/02/2026 9:38 pm
TL;DR: January’s identity-driven attacks showed that valid credentials, OAuth tokens, and service accounts are now the preferred route into production systems, while 1,870 CVEs produced 360 identity-related disclosures and disproportionate blast radius, according to Delinea Labs. Access control, visibility, and lifecycle governance now determine how fast misuse is contained.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Credential misuse at scale is now the default”.
By the numbers:
- Of the 1,870 CVEs reported industry-wide, 360 were identity-related, with 16 directly impacting identity providers, access management platforms, and authentication services.
Key questions
Q: What breaks when stolen credentials are the main entry point for breaches?
A: When stolen credentials become the primary entry point, traditional perimeter and exploit-focused controls lose much of their value because the attacker is already authenticated.
Q: Why do service accounts and OAuth tokens increase breach impact in cloud environments?
A: Because they often carry standing access to more than one system and are trusted by the platforms they connect.
Q: How can teams tell whether identity misuse is being missed?
A: Look for access that is technically valid but operationally odd, such as automation using credentials outside expected workflows, credentials reused long after issuance, or authentication events that do not match the subject’s normal business purpose.
Practitioner guidance
- Strengthen continuous identity telemetry Correlate logins, token use, service-account activity, and automation events so misuse is visible before impact, not after a breach response begins.
- Review automation platforms as identity brokers Map which workflow tools can mint, store, or forward OAuth tokens and embedded secrets, then remove unnecessary cross-service access paths.
- Prioritise identity infrastructure vulnerabilities Triage flaws in token validation, trust relationships, and authentication logic ahead of lower-risk application bugs because they expand blast radius once access exists.
Bottom line: Credential misuse now matters more than initial exploitation because authenticated access can look legitimate until the attacker has already moved.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 2:48 am
Credential misuse has replaced exploitation as the default identity risk: the article shows that attackers increasingly prefer trusted access paths over noisy technical break-ins. That matters because the first security failure is no longer login prevention, it is the environment’s willingness to trust credentials long after they have been exposed. Practitioners should read this as a signal that identity governance is now a frontline security control, not a back-office hygiene function.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: What should organisations do when credential misuse happens before impact?
A: Containment has to start with revocation, scope reduction, and review of all dependent access paths. If the same credential can be reused across SaaS, cloud, or automation workflows, the incident is bigger than one account. Teams should assume connected permissions may also be compromised and validate them in sequence.
👉 Read our full editorial: Credential misuse at scale is now the default identity risk