Why do valid accounts still matter in major breaches?

Why valid accounts matter to attackers

Valid accounts matter because they give an intruder the same doors a normal user already has. That can turn an intrusion from noisy exploitation into low-friction access, especially when the account is already trusted by applications, cloud services or remote access layers. The better the account looks like routine activity, the harder it is to separate misuse from normal work.

That is why valid-account abuse sits so close to the start of many intrusion chains. A good defensive mindset is to treat any legitimate login path as a potential attack path, not just a convenience for users.

For a deeper look at how this technique shows up across the kill chain, see Initial Access Techniques Guide and the broader pattern in MITRE ATT&CK T1078 Valid Accounts Guide.

How valid accounts bypass normal security expectations

Once attackers have a real account, they often inherit whatever trust the organisation already gave it. That can include access to SaaS platforms, internal applications, VPNs, cloud consoles, inboxes, file stores and administrative workflows. If the session is stolen rather than the password alone, MFA may never be challenged again until the session expires or is revoked.

The practical problem is that many controls are tuned to stop unknown or malformed access. A valid account, by contrast, can satisfy allow-lists, lookups, policy checks and approval paths because it is operating inside expected behaviour. Even when the underlying credentials were phished, reused or purchased, the resulting access can still appear legitimate to upstream systems.

When identity telemetry is available, it becomes much easier to distinguish routine use from abuse. The detection challenge is to find the account activity that is technically allowed but contextually wrong, such as impossible travel, abnormal logon types, unusual device posture or service-account behaviour outside its usual job function.

Why standing privilege makes the blast radius worse

Standing privilege matters because compromise of an already powerful account shortens the path from entry to impact. An admin account, service account or other privileged account can often move laterally, change security settings, access high-value data or create persistence without needing additional approval.

That changes the response question from “Was the account compromised?” to “What could that account already do before we noticed?” A privileged account with broad standing access can turn a single theft event into data exposure, cloud control-plane abuse, privilege escalation or recovery friction if the attacker changes settings before detection.

For practitioner context on privilege misuse and account abuse patterns, Privileged Access Statistics helps frame why standing privilege keeps showing up in major incidents, while Recovering IAM and PAM After Ransomware or Domain Compromise shows why privileged accounts must be reset and revalidated in a deliberate order after compromise.

Risk and Threat Considerations

Valid accounts are attractive because they reduce attacker friction and increase survival time inside an environment. If defenders rely too heavily on password resets or endpoint signals, a stolen session or reused credential can continue to provide access even after the original compromise route is closed.

Failure mechanism: The account is real, trusted and already authorised, so the attacker inherits legitimate access paths, normalised activity patterns and, in some cases, standing privilege that expands the blast radius before detection.

Impact: The breach can progress quietly into lateral movement, data access, privilege abuse or persistence, and the organisation may lose time because the activity does not immediately look like an intrusion.

Practitioner Guidance

What to verify: Check whether each sensitive account has a current owner, a known purpose and a privilege level that still matches its job. If you cannot explain why the account exists, where it is used and what it can reach, assume it is a candidate for overexposure.

Decision rule: If the account can authenticate to production systems or security tooling, prioritise token revocation, session invalidation and privilege review before relying on password changes alone. Password rotation without session control often leaves the attacker in place.

What good looks like: High-value accounts are few, monitored, short-lived where possible and segmented by function. Normal users should not have standing admin rights, and service accounts should be constrained to the smallest practical scope with clear detection signals for misuse.

Practitioner takeaway: The key issue is not whether an account is “valid”, it is whether it is trusted enough to let an attacker act like an authorised user before your controls notice the difference.

Related resources from NHI Mgmt Group

• Why do valid credentials still drive major cloud breaches?
• Why do still-valid secrets matter after public disclosure?
• Why do valid SMB credentials still matter in this vulnerability?
• Why do inactive SaaS accounts still matter in identity governance?