Topic starter
12/02/2026 9:09 pm
TL;DR: Man-in-the-middle attacks intercept credentials, session data, and other exchanges between users and trusted systems, and StrongDM cites estimates that 35% of exploitation activity involves this pattern. The enduring lesson for IAM and NHI teams is that authentication alone does not protect trust when traffic, sessions, and identities can be silently inserted into the middle.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “Man-in-the-Middle (MITM) Attack: Definition, Examples & More”.
By the numbers:
- Nearly 58% of all posts on criminal forums and marketplaces contain banking data of others collected by MITM or other attack types.
- Business email compromise resulted in over $1.8 billion made by scammers in 2020.
Key questions
Q: What breaks when man-in-the-middle protection is not in place?
A: When MITM protection is weak, users can authenticate successfully while an attacker silently intercepts the session, captures credentials, and reuses them against the real service.
Q: Why do adversary-in-the-middle attacks still work when MFA is enabled?
A: Because the attacker does not need to defeat MFA directly.
Q: What are the signs that a session may be under MITM interception?
A: Common indicators include repeated login prompts, unexpected certificate warnings, suspicious DNS resolutions, mixed-content errors, and network traffic to unfamiliar intermediary IPs.
Practitioner guidance
- Harden certificate validation Require strict certificate chain validation, monitor for expiry or unexpected issuer changes, and remove shared or weakly managed certificates from externally reachable services.
- Protect session tokens as credentials Shorten session lifetime where appropriate, bind sessions to stronger device or context signals, and revoke tokens immediately when interception is suspected.
- Reduce spoofing opportunities Use DNS over HTTPS, avoid insecure public Wi-Fi for sensitive access, and ensure critical applications fail closed when transport indicators are inconsistent.
Bottom line: Man-in-the-middle attacks exploit the gap between authenticating a user and authenticating the path the user is using.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/10/2026 6:46 pm
MITM exposes a trust-path problem, not just a login problem. Authentication can be perfectly valid while the connection itself is being intercepted, which means identity assurance must extend across DNS, certificates, transport, and session handling. That is why the control failure is not simply weak passwords or user error. The practitioner conclusion is that trust verification has to be continuous across the entire request path.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
- By 2029, 40% of enterprises that successfully implement zero trust within cloud service provider environments will rely on the advanced visibility and control capabilities offered by CNAPP solutions.
A question worth separating out:
Q: Should organisations prioritise HTTPS, MFA, or certificate management first against MITM?
A: Start with certificate management and transport integrity for the services most exposed to interception, then layer MFA to limit credential reuse, and finally tighten user exposure to unsafe networks. The right sequence depends on which part of the trust path is weakest. If the channel is compromised, stronger passwords alone will not help.
👉 Read our full editorial: Man-in-the-middle attacks expose why IAM needs stronger verification