In brief: Compromised credentials continue to drive the majority of successful breaches. This article examines the technical drivers, regulatory implications and practical steps to mitigate identity risk.
The concept of a hard network boundary has largely evaporated for Australian enterprises that have migrated to cloud-first strategies. Distributed workforces, third-party integrations and ephemeral container environments have pushed the attack surface well beyond the traditional perimeter firewall. In this distributed landscape, identity has replaced the network edge as the primary security perimeter, meaning that the compromise of user credentials remains the single most effective vector for malicious actors to gain initial access to enterprise environments. The Microsoft Security team confirms that breaches often follow a lifecycle beginning with initial access via phishing or credential stuffing, a pattern that has persisted despite years of awareness campaigns. Once inside, attackers leverage those compromised identities to move laterally, escalate privileges and exfiltrate sensitive data without triggering traditional network intrusion detection systems.
This shift is not theoretical but a daily operational reality for security operations centres. The Commonwealth Government Advisories issued in late September 2026 explicitly warn that phishing and information-stealing malware provide direct routes to account credentials, particularly as the adoption of generative AI tools by cybercriminals accelerates. Automated tools now generate highly convincing phishing emails and social engineering scripts at scale, bypassing traditional email filters and tricking users into surrendering their login details. The business impact extends far beyond immediate financial loss. A single compromised administrator account can lead to the decryption of entire data stores, the deployment of ransomware or the installation of persistent backdoors that remain undetected for months, severely eroding customer trust.
Despite decades of security awareness training, human behaviour remains a critical vulnerability that no technology can fully eliminate. Password habits continue to create significant risk across organisations, with users frequently reusing passwords across personal and professional accounts. This means that a breach on a non-essential platform can cascade directly into the corporate network, a risk the Australian Cyber Security Centre highlights in its Annual Cyber Threat Report as a persistent behaviour that makes credential theft easier for threat actors. This behavioural risk is compounded by the sheer volume of digital identities that employees and contractors must manage, leading to fatigue and a tendency to prioritise convenience over security.
Technical limitations also play a significant role in this persistence. Single sign-on solutions and federated identity protocols have improved user experience but have also created high-value targets that demand disproportionate protection. When a single identity provider is compromised, the attacker gains access to every application connected to that federation, effectively bypassing application-level security controls. Furthermore, the rise of API-driven architectures means that service accounts and machine identities are proliferating rapidly. These non-human identities are often less scrutinised than user accounts and may retain excessive privileges long after a project is completed, providing attackers with low-friction pathways to sensitive data.
The barrier to entry for credential theft has never been lower, with automated tools democratising access to offensive capabilities. Credential stuffing attacks utilise vast databases of previously compromised usernames and passwords from unrelated breaches, attempting these combinations against enterprise login portals at high speed. Traditional rate limiting and CAPTCHA challenges are often bypassed by sophisticated botnets that mimic human browsing patterns, making it difficult to distinguish between legitimate users and automated attackers. Additionally, supply chain compromises present a severe risk that extends beyond an organisation’s direct control. Recent reporting indicates that compromised third-party application access can expose multiple organisations simultaneously, allowing attackers to leverage trusted relationships to bypass individual organisational security controls.
For Australian organisations, the regulatory environment is tightening significantly, with frameworks moving from guidance to de facto requirements. APRA CPS 234 applies specifically to APRA-regulated entities, mandating strict information security standards regarding information risk management. While the standard does not prescribe specific technical controls, it requires organisations to manage third-party risk and ensure the confidentiality, integrity and availability of information. A credential-based breach that disrupts critical operations or compromises customer data can trigger significant regulatory scrutiny and financial penalties under this standard, particularly if the organisation cannot demonstrate adequate controls.
Similarly, the ACSC Essential Eight is widely adopted as a maturity model for enterprise security, though it remains recommended guidance rather than a universal legal requirement. Many procurement contracts and industry benchmarks now reference the Essential Eight as a baseline for security posture, effectively making it a commercial necessity. The strategy aims to mitigate the most effective cyber attacks, including those enabled by compromised credentials. Mitigating application control, patching applications and restricting administrative privileges directly addresses the threats that allow attackers to exploit weak identity hygiene. Organisations that ignore these guidance documents often find themselves non-compliant with specific industry regulations or failing to meet insurance requirements for cyber coverage.
Securing identities requires a layered approach that addresses both user and machine accounts with equal rigour. The most fundamental control is the enforcement of multi-factor authentication across all user accounts, a control the Australian Cyber Security Centre emphasises as critical for reducing account compromise. Phishing-resistant methods such as FIDO2 security keys or passwordless biometrics are preferable to SMS-based two-factor authentication, which is vulnerable to SIM swapping attacks and social engineering. Implementing conditional access policies that evaluate risk signals such as location, device health and user behaviour can further restrict access for suspicious requests, adding context-awareness to static credentials.
Privileged access management is another critical component that requires rigorous implementation. Administrative accounts should be isolated from standard user workstations to prevent credential theft via malware, using solutions like Microsoft Defender for Endpoint to monitor endpoint behaviour. Just-in-time access models ensure that elevated privileges are granted only when needed and revoked immediately after the task is complete, limiting the window of opportunity for attackers who have obtained admin credentials. Additionally, organisations must conduct regular reviews of user permissions to remove excessive access rights, ensuring that identity governance frameworks automate this process to keep access rights aligned with job roles.
Even with robust preventative controls, breaches will occur, making effective monitoring essential for detecting compromised credentials before significant damage is done. Security information and event management systems can aggregate logs from identity providers, applications and endpoints to identify anomalous behaviour that deviates from established baselines. Indicators such as impossible travel, access from unfamiliar locations or unusual data download volumes should trigger immediate alerts for investigation. However, monitoring alone is insufficient without active validation, as logs only show what has happened rather than whether controls would stop a future attempt. Traditional vulnerability scanning and annual penetration testing often fail to capture the dynamic nature of identity attacks, providing a snapshot in time but not verifying whether controls actually block exploitation in a live environment.
To close the gap between theoretical security and actual resilience, organisations must adopt continuous security validation that simulates real-world threats. PentestOps offers a platform for continuous penetration testing that automatically simulates real-world attack scenarios against identity infrastructure, providing ongoing assurance that controls are functioning correctly. Unlike manual annual assessments, this approach continuously tests the effectiveness of multi-factor authentication, privileged access controls and monitoring alerts under realistic conditions. It validates whether an attacker who obtains a valid credential can actually move laterally or escalate privileges, exposing configuration drifts that static tools miss. By integrating continuous validation into the security programme, teams can identify policy failures in real time, rather than discovering them after a breach has occurred.
A comprehensive identity security strategy requires alignment across technology, process and people, with no single control acting as a silver bullet. Technology investments in modern identity platforms must be supported by clear governance policies and ongoing user education to reduce the human factor in breaches. Organisations should adopt a zero trust mindset, verifying every request regardless of where it originates, which involves strict identity verification, continuous monitoring and adaptive access policies. The integration of behavioural analytics can help detect subtle signs of compromise that traditional rule-based systems might miss, such as slight deviations in typing patterns or access times.
The economic implications of identity security are substantial, with the cost of a breach involving compromised credentials including regulatory fines, legal fees, remediation costs and reputational damage. Investing in proactive identity protection is often far more cost-effective than dealing with the aftermath of a successful intrusion, particularly when considering the long-term erosion of customer trust. Furthermore, a strong identity posture can enhance customer trust and facilitate safer adoption of cloud services and digital transformation initiatives. As workforces become more distributed and applications more complex, the reliance on identity as the primary trust anchor will only increase, making robust identity security a strategic imperative rather than just a technical requirement.
Review your current identity architecture against the latest regulatory requirements and industry best practices to identify immediate gaps. Ensure that multi-factor authentication is enforced everywhere, particularly for remote access and privileged accounts, prioritising phishing-resistant methods. Audit your service account permissions to eliminate excessive privileges and remove dormant identities that pose unnecessary risk. Implement continuous monitoring to detect anomalous identity behaviour and consider integrating PentestOps to continuously validate your identity controls against real-world attack simulations. By taking these steps, organisations can significantly reduce their exposure to credential-based threats and build a more resilient digital foundation.
APRA CPS 234 requires regulated entities to manage information security risks effectively to ensure the confidentiality, integrity and availability of information. A breach caused by compromised credentials can lead to operational disruption or data loss, triggering reporting obligations and potential penalties. Organisations must demonstrate that they have implemented controls to mitigate such risks, including robust identity protection and third-party risk management, rather than relying solely on generic security statements.
While multi-factor authentication significantly reduces risk, it is not a complete solution against sophisticated attacks. Phishing-resistant MFA methods such as FIDO2 keys are more secure than SMS-based codes, which are vulnerable to SIM swapping and interception. Conditional access policies that assess risk context, such as device health and location, are also necessary to block suspicious access attempts even when valid credentials are presented, creating a defence-in-depth strategy.
Annual penetration testing provides a snapshot of security posture at a specific point in time, often missing changes that occur months later. Continuous validation simulates attacks in real-time to verify that controls remain effective against evolving threats and configuration drift. Continuous approaches like PentestOps identify policy failures immediately, allowing security teams to remediate gaps before they can be exploited by malicious actors, rather than waiting for the next scheduled assessment.
AI, cyber security, cloud and custom software for enterprises. Discovery session within 48 hours.
Start a conversation More insightsReal engineers, response within one business day.