Most leaked logins are old, but infostealers reach 72% of firms

Outpost24 research found at least one employee or customer login exposed at 72% of 4,824 companies analyzed across the US and Europe over the past year. The study identified 31.5 million exposed credentials in total, with fewer than 3% stolen directly from infected devices.

Analysis

The key implication is a shift in the security problem from device cleanup to identity control: if credentials are harvested beyond directly infected corporate devices, endpoint protection alone cannot close the exposure. That supports demand for MFA/passkeys, identity-threat detection, credential monitoring and incident-response services, potentially benefiting Microsoft, Okta, CrowdStrike and Palo Alto Networks. But the study does not quantify paid demand, customer spending or losses, so it is not evidence for near-term revenue upgrades; broad exposure may also reflect credentials that are stale or low privilege.

Near term, treat this as a modest narrative tailwind, not a standalone catalyst. Over 1–3 months, watch for enterprise security budgets, vendor commentary on identity-security attach rates, and disclosed incidents or remediation costs. Over 6–18 months, persistent credential abuse could raise the relative value of identity-centric controls and pressure organizations relying mainly on endpoint defenses. The report’s sample and credential provenance need validation before extrapolating to the wider market. A contrary outcome—no measurable increase in purchasing or breach losses—would leave this as awareness rather than monetizable demand.

Key Decisions for Investors

• No directional trade on this report alone: the findings do not establish incremental spending, vendor share gains or financial losses.
• Add identity-security exposure at Microsoft, Okta, CrowdStrike and Palo Alto Networks to the watch list; seek evidence of identity-product growth or attach-rate commentary before acting.
• Monitor enterprise security-budget surveys, breach disclosures and identity-related guidance revisions over the next 1–3 months; these are more actionable catalysts than the study headline.
• Falsify the demand thesis if vendor commentary and reported identity-security growth remain unchanged despite continued credential-abuse reporting.