Microsoft Defender XDR: Closing Attack Paths with Identity Intelligence

Identity-based attacks continue to surge, with compromised credentials remaining one of the most common entry points for attackers. In the first half of 2025 alone, identity-based attacks increased by more than 32%, and it's estimated that 97% of them are password-focused. While these numbers are staggering, the reality is that it only takes a single exposed account to give an attacker a foothold from which they can move laterally toward critical assets.

At today's attack scale, identity signals need to be connected with broader context to stop attacks earlier in the kill chain. Microsoft Defender XDR is now helping security professionals proactively understand how identity-related risks, like leaked credentials, relate back to critical assets, enabling teams to close potential entry points before they can be exploited.

Understanding the Identity Attack Landscape

Leaked credentials refer to valid usernames and passwords that have been exposed beyond their intended scope. Whether this exposure occurs as part of a data breach, phishing attack, or postings on dark web forums, the result is the same: an attacker may be using legitimate credentials to access your organization.

Attack paths describe the sequence of misconfigurations, permissions, and trust relationships that an attacker can chain together to move from an initial foothold to high-value resources. Rather than relying on a single vulnerability, attackers think in graphs, following paths of least resistance to systematically escalate privileges and expand access.

This makes identities the primary control plane they target, with leaked credentials as an extremely common entry point. The recent Microsoft Digital Defense Report highlighted this reality, stating that more than 61% of attack paths lead to a sensitive user. These user accounts have elevated privileges or access to critical resources, meaning that if they were to be attacked or misused, it would significantly impact the organization.

Beyond Basic Detection: Microsoft's Differentiated Approach

Most security solutions stop at the alert and can only tell you that a password was exposed, found, or leaked. While that information matters, it's incomplete—it describes an event, not the risk. The real differentiation starts with the next question: what does this exposure mean for my environment right now?

Not every exposed password creates the same level of risk. Context is what determines impact. Which identity does the password belong to? What assets can that identity access? Does that access still exist? And are those assets truly sensitive?

That's why exposed password detection is a starting point, not an end state. Effective protection begins when organizations move beyond technical alerts and toward an identity-aware understanding. This shift from detection to context is where better decisions are made and where meaningful security value is created.

Microsoft has taken its identity alerts a step further by connecting these risks with broader security context to reveal how an initial identity signal can lead to sensitive users, critical assets, and core business operations. This perspective moves security beyond isolated alerts to prioritized, actionable insight that shows not just if risk exists, but how identity-based threats could unfold and where to intervene to stop them before they have impact.

How Microsoft Defender XDR Closes Attack Paths

In the case of leaked credentials, Microsoft continuously scans for exposed accounts across public and private breach sources. If a match is found, Microsoft's Advanced Correlation Engine (MACE) automatically identifies the affected user within your organization and surfaces the exposure with clear severity and context.

By bringing this powerful detection into Defender, teams can investigate and respond with better context, allowing leaked credentials to be evaluated alongside endpoint, email, and app activity. This gives teams the additional context needed to prioritize response effectively.

Additionally, for Microsoft Entra ID accounts, Microsoft can go a step further by validating whether the discovered credentials actually correspond to a real, usable password for an identity in the tenant. This confirmation further reduces unnecessary noise and gives defenders an early signal—often before any malicious activity begins.

Next, Microsoft Defender correlates these signals with your organization's unique security context. By connecting the alert and associated account with other signals like unusual authentications, lateral movement attempts, or privilege escalations, Defender elevates the isolated alert into a complete story about any potential incidents related to that vulnerability.

At the same time, Microsoft Exposure Management analyzes the same data to create a potential attack path related to the exposed credentials. By tracing permissions, consents, and access relationships, Attack Paths show exactly which routes an attacker could take and what controls will break that path.

When these capabilities work together, visibility becomes action. MACE identifies who is exposed, Defender connects other signals into an incident-level view, and Attack Paths reveal where the attacker could go next. The result is a single, connected workflow that transforms early exposure data into prioritized, measurable risk reduction.

The Strategic Impact

Leaked credentials should be treated as the beginning of a story, not an isolated event. Microsoft Defender XDR is uniquely able to enrich security teams' visibility and understanding of identity-related threats from initial exposure to detection, risk prioritization, and remediation.

This connected visibility fundamentally changes how defenders manage identity risk, shifting the focus from reacting to individual alerts to continuously reducing exposure and limiting blast radius. One leaked password doesn't have to become a breach. With Microsoft's identity security capabilities, it becomes a closed path and a measurable step toward greater resilience.

Security teams can now move from a reactive posture—responding to alerts as they come in—to a proactive stance that anticipates attacker movements and closes paths before they're exploited. This represents a significant evolution in identity security, where the focus shifts from simply detecting compromises to understanding and mitigating the full attack path that compromised credentials could enable.

For organizations looking to strengthen their identity security posture, this integrated approach provides the context and actionable intelligence needed to make informed decisions about where to focus remediation efforts and how to prioritize security investments for maximum impact.

Learn more about attack paths and the new leaked credentials capabilities in Microsoft Defender XDR.