You can tell the story of the current state of stolen credential-based attacks in three numbers:

Stolen credentials were the #1 attacker action in 2023/24, and the breach vector for 80% of web app attacks. (Source: Verizon).
Cybersecurity budgets grew again in 2024, with organizations now spending almost $1,100 per user (Source: Forrester). 
Stolen credentials on criminal forums cost as