Credential stuffing has been a known and growing threat for over a decade, and the defensive maturity gap remains wide. Some organisations have invested in genuinely effective defenses; many continue to rely on basic measures that don’t meaningfully address the modern threat profile. The economic incentives for attackers have not declined, the supply of compromised credentials has continued to grow, and the tooling for automating attacks has matured. The defensive imperative is real.

The May 2026 picture for what actually defends against credential stuffing is clearer than it was even two years ago. Worth setting out what works and what doesn’t.

What works

Multi-factor authentication, properly implemented. The MFA story is more nuanced than the headlines suggest. SMS-based MFA is meaningfully better than no MFA but is bypassable by attackers willing to invest in SIM-swap or interception attacks. Authenticator app-based MFA is meaningfully better than SMS but is still bypassable by sophisticated phishing and adversary-in-the-middle attacks. Hardware-token MFA — FIDO2/WebAuthn — is the strongest mainstream option and is bypassable only in narrow categories of attack.

The proportion of credential stuffing attacks defeated by basic MFA remains very high. The attacks that succeed against MFA-protected accounts are increasingly the more sophisticated ones that use real-time phishing or adversary-in-the-middle infrastructure. For most use cases, getting MFA properly deployed across the user base is the highest-impact defensive measure available.

Bot detection and traffic analysis. The credential stuffing tooling used by attackers in 2026 is sophisticated. Browser automation that emulates real user behaviour, residential proxy infrastructure that distributes traffic across consumer IP space, and increasingly the use of language model agents that can navigate complex login flows — all of this means that simple bot detection (CAPTCHA challenges, IP rate limiting) catches diminishing fractions of actual attack traffic.

The bot detection that works in 2026 is behavioural rather than perimeter-based. Mouse movement analysis, keyboard cadence, navigation patterns, device fingerprinting, and the characteristics of the request flow that distinguish automation from human use. The leading commercial bot detection products combine multiple signals to produce risk scores that are then used in adaptive authentication decisions. Where this is implemented well, attack success rates drop substantially.

Compromised credential matching. The major identity-as-a-service providers and a number of specialist vendors maintain databases of credentials that have appeared in known breaches and infostealer-derived credential trading. Checking submitted login attempts against these databases — at the time of submission, before authentication completes — and prompting affected users to reset their passwords is a high-impact defense. The implementation requires either using a vendor service or maintaining an internal database, and the privacy and operational considerations need to be addressed properly. Done well, this prevents the use of compromised credentials before they can be successfully used.

Risk-based authentication and adaptive controls. The shift from “always require MFA” or “never require MFA” to “require additional authentication when risk indicators are present” is the maturation pattern that’s emerging in well-built identity systems. The risk indicators include geolocation, device recognition, historical patterns, time of access, and the bot detection signals mentioned above. The authentication friction is reserved for high-risk attempts; legitimate users with normal patterns experience minimal additional friction.

What doesn’t work as well as marketed

Password complexity rules. The evidence is now reasonably clear that password complexity rules — minimum lengths beyond reasonable thresholds, required character mixes, scheduled rotations — produce password choices that are often weaker against modern attacks than the alternatives. Long passphrases, breached-password checks, and accommodation of password manager usage produce stronger outcomes than complex rules that drive users to predictable patterns.

CAPTCHA challenges as primary defense. CAPTCHAs were never strong against motivated attackers and are weaker now than they were five years ago. The combination of human-CAPTCHA-solving services (real humans paid to solve CAPTCHAs at scale) and AI-based solving capability means that CAPTCHA challenges defeat low-effort attacks but don’t materially affect determined ones. CAPTCHAs as one signal among many in a behavioural analysis system are useful. CAPTCHAs as a primary defense are not.

IP-based blocking. The supply of residential proxy infrastructure means that attackers have effectively unlimited IP diversity available. IP blocking of specific addresses or address ranges catches the most amateur attacks but does little against any operation with operational sophistication. Geolocation-based controls are useful in specific contexts but are also routinely worked around.

Email-based MFA codes. Email is an authentication factor that’s frequently compromised when other accounts are compromised. Email-based MFA is meaningfully better than no MFA, but the assumption that the email account is independently secure often doesn’t hold, particularly for personal accounts being used as the second factor on work credentials.

What organisations are getting wrong

A few patterns I see consistently:

Treating MFA as binary across all users and applications. The right approach is graduated based on the value of the asset and the risk of the access pattern. Some applications should always require strong MFA. Some users should always require strong MFA regardless of application. Some access patterns should require additional authentication beyond MFA. The blanket approach produces both inadequate protection on high-value targets and excessive friction on low-risk patterns.

Underweighting the contractor and vendor authentication paths. The user accounts that get the most security attention are typically employee accounts. The contractor accounts, the vendor service accounts, the third-party integration accounts often get weaker controls. Attackers know this and target accordingly. The full range of authentication paths needs the same level of defensive attention.

Ignoring service account credentials. The non-human accounts — service accounts, API tokens, machine-to-machine credentials — are routinely the vector through which attackers move laterally after initial access. These credentials need rotation discipline, scope minimisation, and monitoring just as user credentials do. Many organisations have meaningful gaps here.

Failing to act on detection. The investments in detection capability often outrun the investments in operational response. Detecting a credential stuffing attempt, or a successful login from an unusual context, only matters if the operational response is fast enough to contain the damage. Many organisations have detection that fires alerts that aren’t acted on for hours or days, which often isn’t fast enough.

What I’d recommend for an organisation getting started

Three things, in priority order.

Get FIDO2/WebAuthn MFA deployed for all administrative and privileged accounts immediately. This is the single most important defensive measure available. The hardware tokens cost real money but the cost of breach is much higher. Phased rollout starting with highest-risk accounts is the standard approach.

Implement compromised credential checking. Most major identity platforms support this natively. Where they don’t, third-party vendors provide the capability. The implementation effort is moderate and the protection is substantial.

Invest in behavioural bot detection on consumer-facing authentication endpoints. The credential stuffing economics for attackers depend heavily on success rates. Reducing success rates through behavioural analysis pushes attackers toward harder targets. The investment is real but the operational benefit is sustained.

Beyond these, the broader programme — risk-based authentication, comprehensive logging and detection, response automation, third-party identity governance — represents a multi-year programme that produces sustained defensive uplift over time. The credential stuffing problem won’t be solved any time soon. The defensive maturity gap can be closed substantially with disciplined investment.