Page 157 - Cyber Defense eMagazine September 2025

The Rise of AI‑Driven Credential Stuffing: Why Identity and

Access Management (IAM) Alone Can’t Save You

When Bots Learn to Think Like Humans

By Sandeep Dommari, Principal Architect, Ping Identity

Introduction: When Bots Learn to Think Like Humans

Security teams dismissed credential stuffing as "noisy bot traffic" in 2012. It has now developed into one
of the world's most lucrative, scalable, and AI-powered threats.

Consider the recent spate of hacks at Nintendo, Zoom, and Spotify. Attackers only needed to use
usernames and passwords that had been stolen from unrelated leaks and allow bots to test them across
millions of accounts; they didn't even need to breach the companies directly.

Attackers no longer simply spray stolen credentials thanks to generative AI. They are so good at imitating
human behavior that they are fooling even sophisticated Identity and Access Management (IAM) systems
and conventional bot detection tools.

Cyber Defense eMagazine – September 2025 Edition 157
Copyright © 2025, Cyber Defense Magazine. All rights reserved worldwide.