Most breaches don’t start with malware or zero-day exploits. They start with a login.  An attacker gets hold of a password, maybe through phishing, reuse, or a leaked credential dump. They test it ...