We picture intrusions as something forced — a wall breached, a lock picked, an exploit fired. The data tells a quieter story. In most modern breaches, the adversary simply signs in. Valid account. Valid session. Nothing for the perimeter to catch, because from the system's point of view, nothing is wrong.
Those three numbers reframe the whole defensive question. If more than half of intrusions begin with a legitimate login, then a hardened perimeter is solving for the wrong threat. The credential is the new exploit — and it's the one your scanners are least likely to flag.
One password becomes the whole network
A single credential is rarely the prize. It's the on-ramp. Watch how a low-value login walks all the way to Domain Administrator — every hop a valid authentication, none of it tripping an alarm.
- Hop 1 — Initial sign-in. Phished or sprayed credential gets a foothold on a workstation via VPN or RDP. Normal-looking session, normal-looking user.
- Hop 2 — Local discovery. Cached service-account hash dumped from memory. No exploit needed — the OS handed it over to a process running as the logged-in user.
- Hop 3 — Lateral move. Pass-the-Hash against an internal share. Authentication succeeds. From the server's perspective, this is just the service account doing its job.
- Hop 4 — Privilege escalation. Kerberoasting against a weak SPN ticket yields an offline-crackable hash. A reused or short password becomes Domain Admin within hours.
Every hop in that chain is an authentication event a defender would struggle to distinguish from normal work. That's the point. RDP, VPNs and remote services — the same tools that keep a business running — are the entry path precisely because their traffic is supposed to be there.
Why this vector dwells the longest
Stolen credentials don't just open the most doors — they keep them open the longest. At 292 days of dwell time, credential-based attacks outlast every other vector, because there's nothing anomalous to find. No malware signature, no exploit payload, no broken lock. Just a user who appears to be doing their job, for the better part of a year.
Test the chain, not the checkbox
If the attack is a sequence of valid logins, the only honest test is to run that sequence. Not "is MFA enabled?" but "starting from a credential an attacker could realistically obtain, how far can it actually travel?" That means exercising the full path — credential capture, lateral movement, privilege escalation, Active Directory attacks — the way an adversary would, and surfacing the hops that work before someone else finds them.
Walk the path before they do.
Arxiis's credential, lateral-movement and AD-attack modules run the real chain — Pass-the-Hash, Kerberoasting, trust abuse — and prove which login becomes domain admin. Every finding is CVSS-scored and MITRE ATT&CK-tagged, generated in hours, entirely inside your own perimeter. No data leaves the building.
