Attackers don’t always need to exploit a vulnerability to gain access to an organization. Sometimes, they already have credentials that work.
Microsoft’s 2026 Digital Defense Report provides a closer look at how compromised credentials continue to play a role in cyberattacks. The findings highlight a familiar problem for security teams: legitimate accounts can become an entry point, and once attackers gain access, they often look for opportunities to compromise additional credentials.
Three statistics stand out, particularly for organizations looking to reduce password-related risk.
Microsoft found that valid accounts accounted for 20% of initial access activity observed in Microsoft Defender Experts customer notifications.
These attacks don’t necessarily require malware or a software exploit. Attackers may authenticate using stolen passwords or credentials obtained through password spraying. Other valid-account attacks can involve stolen session tokens or hijacked accounts.
For security teams, the challenge is that authentication alone doesn’t establish whether credentials are safe. A password can meet an organization’s complexity requirements, comply with its password policy, and successfully authenticate a user while also being known to an attacker.
This is the same risk explored in The Login Was the Breach: attackers can gain access using legitimate credentials without needing to exploit a software vulnerability.
This is an important distinction between password policy enforcement and compromised-password detection.
Traditional password policies establish requirements for password creation and management. They don’t necessarily identify when an existing password has been exposed in a breach or through other credential theft activity.
Organizations need both: controls that govern how passwords are created and the ability to identify passwords that have become compromised.
Gaining initial access is often only the beginning.
According to Microsoft, 52.2% of intrusions involving valid-account access included follow-on credential theft. Another 18.4% involved active password spray campaigns.
This is one of the report’s more significant findings for credential security. Attackers aren’t necessarily satisfied with access to a single account. Once inside, they may attempt to collect additional credentials, expand privileges, and move across systems.
That changes how organizations should think about the impact of a compromised password.
The concern isn’t limited to whether an attacker can access one account. It’s also what that access could enable next, particularly in environments where credentials provide access to multiple systems or where compromised passwords remain active.
It also reinforces why checking passwords only when they’re created or changed leaves a gap.
A password that passes a security check today may appear in newly discovered breach data tomorrow. If that password remains in use, the organization may have no indication that its risk has changed.
Continuous compromised-password monitoring addresses that gap by checking existing passwords against newly identified exposure data and supporting remediation when a password is found to be compromised.
While this doesn’t replace access monitoring or controls designed to detect lateral movement, it helps organizations address credential risk before exposed passwords can be used to gain access.
Microsoft’s report also provides insight into how compromised credentials support the broader cybercrime economy.
Data from Intel 471 identified 2,591 advertised initial-access sales between July 2025 and June 2026, affecting organizations in at least 117 countries.
Of those offers, 45% involved access obtained using legitimate but compromised login credentials.
The significance is straightforward: working credentials have value. As explored in Cybercriminals Want Fresh Credentials—Not More Data, attackers can use compromised credentials to gain access without having to exploit a vulnerability themselves.
Initial access brokers obtain unauthorized access to organizations and offer that access to other threat actors. Buyers can then use the access for additional malicious activity without having to compromise the original account themselves.
This creates another challenge for organizations. Credential exposure doesn’t have to originate from a direct attack against their own infrastructure.
Passwords may be exposed through third-party breaches, infostealer malware, or other sources outside the organization’s immediate visibility. When those credentials are reused or remain active, they can create opportunities for unauthorized access.
Organizations can’t prevent every external breach or credential theft incident. They can, however, improve their ability to identify when passwords associated with their users have been compromised.
That visibility is particularly important when exposed credentials circulate beyond the original incident and may be used in subsequent attacks.
Microsoft’s findings point to a recurring issue across the attack lifecycle.
Compromised credentials can provide initial access. That access can lead to additional credential theft. And working credentials continue to be valuable enough to be sold through criminal marketplaces.
None of these findings suggests that password security can be addressed through a single control.
Multifactor authentication, phishing-resistant authentication, least-privilege access, and identity monitoring all remain important. But organizations that continue to rely on passwords also need a way to determine whether those passwords have become compromised.
A strong password isn’t necessarily a safe password. Complexity and expiration requirements don’t reveal whether a password has appeared in breach data, and a successful authentication doesn’t establish that the person using the credentials is the legitimate account owner.
This is where continuous credential intelligence adds value.
Enzoic helps organizations identify compromised passwords and address exposure risk through continuous monitoring. Enzoic for Active Directory supports ongoing password protection in AD environments, while Enzoic’s APIs allow organizations to incorporate compromised-password checks and credential intelligence into their applications and security workflows.
The goal isn’t to replace existing identity security controls. It’s to close a visibility gap that password policies and point-in-time checks alone cannot address.
Microsoft’s 2026 Digital Defense Report provides further evidence that compromised credentials remain an important part of the attack landscape. For organizations, the priority is not simply enforcing stronger passwords, but knowing when passwords that are already in use are no longer safe.
Source: Microsoft Digital Defense Report 2026, pages 44 and 67. Statistics are drawn from Microsoft Defender Experts customer notifications and Intel 471 initial-access marketplace observations.