Topic starter
22/02/2026 10:33 pm
TL;DR: Identity-based attacks exploit phishing, credential stuffing, password spraying, pass-the-hash, and man-in-the-middle techniques to steal or misuse digital identities, according to Keeper Security. The deeper issue is that identity controls built for static users and reusable credentials still leave lateral movement and privileged misuse open.
Editorial analysis by NHI Mgmt Group, based on content published by Keeper Security: “What Are Identity-Based Attacks?”.
By the numbers:
- 56% of users reuse their passwords, according to Keeper’s 2022 Password Practice Report cited by Keeper Security.
Key questions
Q: What breaks when password-based identity controls still allow credential reuse?
A: Credential reuse turns one exposed password into multiple possible entry points.
A: These attacks remain effective because they exploit predictable human and technical weaknesses at scale.
A: Warning signs include unusual authentication patterns, cross tier access by privileged accounts, unexpected use of legacy protocols, and service accounts behaving outside their normal baseline.
Practitioner guidance
- Strengthen MFA coverage Require additional verification for high-risk logins so a stolen password alone is not enough to gain access.
- Reduce password reuse Enforce unique credentials and monitor for reused passwords across employee and privileged accounts.
- Constrain privileged reach Apply least privilege to administrative and sensitive accounts so one compromised identity cannot move broadly across systems.
Bottom line: Identity-based attacks succeed because they target trust in credentials and sessions, not just perimeter defences.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/10/2026 2:19 am
Identity-based attacks expose an authentication assumption gap, not just a user-behaviour problem: these attacks work because IAM often treats identity proofing and login success as sufficient evidence of trust. Phishing, stuffing and spraying show that the credential itself can be the compromised object. The practitioner implication is that identity assurance has to extend beyond successful login to the conditions under which the credential was issued, stored and reused.
A question worth separating out:
Q: What should security teams prioritise before scaling identity security?
A: Security teams should prioritise identity data quality, standard access patterns, and clear ownership for lifecycle decisions. If identity records are fragmented, every downstream control becomes harder to trust. A clean data layer and consistent governance model make scale possible without multiplying exceptions.
👉 Read our full editorial: Identity-based attacks expose the limits of IAM and PAM controls