Most breaches now begin with a valid login. Attackers phish credentials, buy them from criminal marketplaces, or reuse passwords exposed in earlier
