Topic starter
02/01/2026 10:57 am
TL;DR: Identity compromise and impersonation now account for 53.0% and 54.3% of breaches, while the share of organisations able to detect compromised identities within 24 hours fell from 90.3% to 60.6% in one year, according to Permiso Security. Traditional authentication monitoring is now outpaced by attacker timing, context loss, and delayed response, making identity-focused detection a business continuity issue.
Editorial analysis by NHI Mgmt Group, based on content published by Permiso Security: “ITDR and Authentication Security: Why Traditional Identity Defense Falls Short in 2025”.
By the numbers:
- credential compromise and impersonation attacks now account for 53.0% and 54.3% of security breaches respectively, according to Permiso Security.
Key questions
Q: What breaks when authentication monitoring relies on static thresholds?
A: Static thresholds break because attackers can pace credential stuffing, password spraying, and impossible-travel activity to stay below alert levels.
Q: Why do compromised identities increase business interruption risk?
A: Because valid credentials let attackers act like authorised users, which means they can disable systems, alter workflows, or interrupt vendor-dependent processes without immediately triggering obvious alarms.
Q: How do security teams decide whether ITDR is working?
A: ITDR is working when responders can move from alert to containment without a long investigative detour.
Practitioner guidance
- Correlate identity events across systems Bring identity provider, VPN, directory, and application authentication logs into one investigation path so that geography, device, MFA, and privilege changes are assessed together.
- Replace static login thresholds Tune detections around user-specific baselines for login time, location, device history, and role rather than depending on universal thresholds that attackers can easily game.
- Escalate privileged anomalies immediately Treat new devices, unusual geographies, and off-hours privileged logins as response-triggering events when they affect administrators or high-value accounts.
Bottom line: Identity compromise is outpacing traditional authentication monitoring because suspicious logins can now look plausible in isolation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
11/10/2026 4:48 am
Authentication monitoring has become a context problem, not a log problem. Permiso Security's analysis shows that many teams already collect identity data, but still miss compromise because the decisive signal only emerges when location, device, role, and timing are correlated. The practical implication is that authentication security now depends on decision quality, not simply event volume.
A question worth separating out:
Q: What should teams do when a login looks unusual but not definitive?
A: Treat it as an investigation trigger, not a dismissal. Validate the user's context, inspect device and session history, and check for unusual post-authentication behaviour. A login that seems plausible in isolation can still be the first step in a compromise chain if the surrounding evidence is ignored.
👉 Read our full editorial: ITDR authentication security is falling behind identity attacks in 2025