82% of 2026’s Breaches Used No Malware, Just Stolen Logins. Can Your SOC See That?

The most difficult breaches to detect are no longer necessarily the ones that deploy malware. Attackers increasingly use valid credentials, trusted tools, and supplier access, leaving identity and behavior as the primary evidence. For regulated organizations in Indonesia and Southeast Asia, this creates both a detection problem and a breach-reporting problem.

TL;DR: Yes, a SOC can detect malware-free attacks, but only if it monitors identity behavior, access paths, and post-authentication activity rather than relying mainly on signatures. CrowdStrike reported that 82% of detections were malware-free in its 2026 report. Detection-as-code, behavioral analytics, and machine-speed response are now required to close the gap between a 29-minute breakout time and much slower human investigation.

Key Takeaways CrowdStrike’s 2026 Global Threat Report found that 82% of detections were malware-free, while average breakout time fell to 29 minutes (CrowdStrike, 2026). Valid credentials turn a security event into a behavior problem. The important signals may be unusual login timing, privilege use, access velocity, or lateral movement. IBM reported a mean breach-identification time of 181 days in its 2025 study, followed by approximately 60 days to contain the breach (IBM, 2025). Indonesian organizations must consider the 72-hour personal-data breach notification requirement under Law No. 27 of 2022 on Personal Data Protection, commonly called UU PDP. An autonomous AI-SOC combines behavioral detection with machine-speed triage and response, while retaining human approval for high-impact actions.

What does malware-free detection actually require?

Malware-free detection requires a SOC, or security operations center, to identify suspicious behavior after authentication, not only malicious files before or during execution. The relevant evidence includes identity use, access patterns, privilege changes, cloud activity, remote administration, and movement between systems.

A SIEM, or security information and event management platform, should therefore correlate identity, endpoint, network, application, and cloud telemetry. An EDR, or endpoint detection and response tool, remains valuable, but endpoint telemetry alone may not explain an attacker using a legitimate account through a trusted browser or remote-access service.

The distinction matters because a stolen login can pass several traditional controls. Multifactor authentication may be bypassed through social engineering, session theft, push fatigue, or an attacker convincing a help desk to reset access. Once authenticated, the attacker’s actions may resemble normal administration.

Indonesian organizations also need to connect detection with regulatory response. UU PDP, Law No. 27 of 2022, establishes obligations concerning personal-data processing and breach handling. Organizations in financial services must also consider OJK, the Financial Services Authority, requirements such as POJK No. 11/POJK.03/2022 on information technology risk management for commercial banks. Singapore-based operations commonly map controls to MAS TRM, the Monetary Authority of Singapore’s Technology Risk Management Guidelines.

The practical requirement is straightforward: security teams need enough context to determine whether a valid login is normal, compromised, or being used as the first stage of an intrusion. That context must be available quickly enough to support containment and notification decisions.

Valid credentials have moved the SOC’s main problem from prevention to verification

The core problem is no longer simply blocking malicious software. It is verifying whether an authenticated action is legitimate before the attacker can use that access to expand the breach.

CrowdStrike reported that average breakout time, the period between initial access and lateral movement, fell to 29 minutes in its 2026 Global Threat Report. The fastest observed breakout was 27 seconds, and AI-enabled adversary operations increased 89% year over year, according to the same report (CrowdStrike, 2026).

IBM’s 2025 Cost of a Data Breach research presents a different clock. The report found a mean time to identify a breach of 181 days and a further 67 days to contain it, producing a 241-day overall lifecycle in the reported average (IBM, 2025). These figures are not directly comparable with breakout time, but they show the operational gap clearly. An attacker may move laterally in minutes while an organization takes months to establish that a breach occurred.

The July 2026 incidents described in the supplied threat reporting illustrate the pattern. ShinyHunters reportedly used voice phishing, or vishing, to persuade victims at Charter Communications and Abbott Laboratories to provide access. The Craneware incident showed a related third-party risk: a compromise at a healthcare-billing provider affected downstream hospitals and clinics that did not directly interact with the attacker.

These cases should not be reduced to a single control failure. They demonstrate that trusted access, supplier relationships, and human interaction can become the attack path. A SOC that waits for a payload may miss the most important part of the intrusion.

Why is stolen-login detection getting harder in Southeast Asia?

Stolen-login detection is getting harder because attackers can combine social engineering, valid access, cloud services, and automation faster than many SOCs can validate an alert.

1. The signal is distributed across systems. A suspicious session may only become visible when identity-provider logs are correlated with VPN, endpoint, SaaS, database, and privilege-management events. A single log line rarely proves compromise.

2. Trusted tools create weak signatures. Attackers can use PowerShell, remote desktop, cloud consoles, collaboration platforms, and administrative utilities. The tool itself may be permitted. The useful signal is often the combination of user, device, location, time, privilege, and action sequence.

3. Third-party access expands the investigation. A supplier may have privileged access, shared infrastructure, or API connectivity. The affected organization must determine whether the event is local, inherited, or part of a wider campaign.

4. Cross-timezone coverage is difficult. Organizations operating across Indonesia, Singapore, Malaysia, Thailand, Vietnam, and the Philippines need continuous monitoring. An incident that starts outside a local team’s working hours cannot wait for the next shift.

5. Alert volume consumes analyst capacity. SOC analysts must distinguish a compromised identity from routine travel, remote work, service-account behavior, and legitimate administrative activity. Without enrichment and prioritization, the result is either missed attacks or excessive escalation.

The solution is not to treat every unusual login as a confirmed incident. It is to combine risk signals, establish a baseline, map activity to an attack technique, and produce an explainable decision. MITRE ATT&CK, a knowledge base of adversary tactics and techniques, can help analysts describe behaviors such as valid accounts, remote services, account manipulation, and lateral movement consistently.

How can a SOC close the stolen-credential detection gap?

A SOC can close the gap by combining identity-aware telemetry, behavioral analytics, detection-as-code, automated investigation, and controlled response. The approach should be vendor-neutral first, then mapped to the tools already deployed.

1. Normalize the evidence

Collect identity-provider, Active Directory, endpoint, VPN, firewall, cloud, SaaS, database, and privileged-access logs in a searchable platform. Normalize usernames, device identifiers, IP addresses, geolocation, timestamps, and asset criticality. Data sovereignty should be designed into this architecture, especially where Indonesian personal data or regulated financial information is involved.

2. Detect behavior and sequences

Useful detections should look for patterns such as:

• A user authenticating from an unusual country and accessing a sensitive application minutes later.

• A service account performing interactive logins or accessing systems outside its normal scope.

• A newly created privileged account querying large volumes of records.

• A successful VPN login followed by remote administration across several servers.

• A help-desk credential reset followed by rapid access to cloud storage or customer databases.

• A supplier account moving from one customer environment into another connected system.

These rules should include suppression logic, asset context, historical baselines, and clear investigation steps. A detection that only says “impossible travel” is less useful than one that explains the user, device, authentication method, privilege, resource, and subsequent actions.

3. Test detections before production

Detection-as-code means writing detections as versioned, reviewable logic that can be tested against historical data. It supports peer review, change tracking, rollback, and measurement of false positives. Back-testing is particularly important for identity analytics because normal behavior varies by shift, geography, role, and service-account design.

Norsesight Enigma is a ClickHouse-native SIEM designed around this operating model. Its ADCE, or AI Detection-as-Code Engine, can generate detection logic, back-test it against historical data, and document expected behavior before deployment. This capability does not remove the need for analyst review. It provides a faster way to create and evaluate detections as adversary techniques change.

4. Automate investigation and response

A SOAR, or security orchestration, automation, and response platform, should enrich an alert, retrieve related events, build a timeline, assess confidence, and recommend or execute an action. The action might include revoking a session, disabling an account, isolating an endpoint, blocking an indicator, or requesting manager confirmation.

Norsesight Aigis applies a multi-agent model to this workflow. Specialist AI agents can validate an alert, enrich its context, investigate related activity, and prepare a response. Human-in-the-loop control remains important for actions with a high blast radius, such as disabling a core banking administrator or isolating a production system.

Autonomy should be measured by outcomes, not by the number of automated actions. A good control reduces investigation time, preserves evidence, explains why an action was taken, and provides a safe approval path when confidence is limited.

5. Keep humans responsible for risk decisions

AI can accelerate triage and investigation, but governance still belongs to the organization. Define which actions can run automatically, which require approval, and which are prohibited without incident-command authorization. Record the evidence, decision, user, timestamp, and result for every response.

This is especially relevant for regulated organizations. A platform should support data residency, access controls, retention policies, audit trails, and explainable investigation outputs. Norsesight’s regional focus is based on this requirement: security operations need machine-speed processing without treating data sovereignty as an afterthought.

What does good stolen-login detection look like? A checklist

A SOC lead can use this checklist this week:

• [ ] Identity-provider, VPN, endpoint, cloud, SaaS, and privileged-access logs are centrally searchable.

• [ ] Every alert includes the user, device, location, authentication method, asset criticality, and recent activity.

• [ ] Service accounts are inventoried, have defined owners, and are monitored for interactive or anomalous use.

• [ ] Detections cover valid accounts, remote services, privilege escalation, account manipulation, and lateral movement.

• [ ] Detection rules are versioned, reviewed, back-tested, and measured for false positives.

• [ ] Analysts can reconstruct an attack timeline without manually searching several disconnected tools.

• [ ] Automated actions have documented approval thresholds and rollback procedures.

• [ ] Breach evidence can support notification, legal review, and regulator engagement.

• [ ] Overnight and weekend coverage is defined for every critical system.

• [ ] The SOC measures mean time to detect, or MTTD, and mean time to respond, or MTTR, separately.

See how Norsesight can help your SOC investigate valid-credential attacks

If your team wants to test whether its current stack can identify and contain a malware-free intrusion, request a Norsesight demonstration. The session can focus on identity behavior, detection-as-code, autonomous investigation, data sovereignty, and human approval controls for Indonesian and Southeast Asian operating environments.

Frequently Asked Questions

How do you detect a compromised account without malware?

You detect a compromised account by correlating identity, device, network, cloud, and application behavior. Look for unusual authentication time or location, unfamiliar devices, privilege changes, abnormal resource access, impossible travel, and rapid lateral movement. No single signal is conclusive. A useful detection combines several weak signals into an explainable risk assessment and links the activity to a response workflow.

What is the difference between valid account abuse and normal login activity?

Valid account abuse usually differs from normal activity in context and sequence, not in the fact that authentication succeeded. Compare the user’s normal devices, locations, times, applications, privileges, and access volume. A successful login followed by unusual administrative actions or access to sensitive systems is more concerning than an isolated login anomaly. Analysts should investigate the complete session timeline.

Can a SIEM detect attacks that use legitimate tools?

Yes, a SIEM can detect legitimate-tool abuse when it receives the right telemetry and uses behavioral or sequence-based detections. The SIEM should correlate identity, endpoint, network, cloud, and application events instead of searching only for known malicious files. Detection quality also depends on normalization, asset context, historical baselines, tested rules, and analysts who can validate the result.

How fast should a SOC respond to a stolen credential?

A SOC should begin triage immediately because lateral movement can occur within minutes. The exact containment target depends on account privilege, asset criticality, confidence, and business impact. High-confidence abuse of a privileged account may justify rapid session revocation or account suspension, while lower-confidence anomalies may require enrichment and human approval before containment.

What should Indonesian companies log for UU PDP breach assessment?

Indonesian companies should retain the evidence needed to determine what personal data was affected, which systems and subjects were involved, when access occurred, how the incident progressed, and what containment actions were taken. UU PDP compliance requires legal and organizational interpretation, so security teams should coordinate with privacy, legal, and incident-response stakeholders. Logs must also be protected and governed appropriately.

Conclusion

Stolen credentials are difficult to detect because authentication can look legitimate while the activity that follows is not. The practical answer is to monitor behavior across identity, endpoint, cloud, network, and application systems, then connect detection to a controlled response process.

• Malware-free attacks require identity-aware detection, not signatures alone.

• Breakout can occur in minutes, so manual triage alone cannot provide dependable coverage.

• Detection-as-code and multi-agent response can increase speed while preserving human oversight.

For Norsesight, the operating principle is direct: your SOC, running at machine speed. The next step is to test your current telemetry and response workflow against a valid-credential intrusion scenario.