Stolen credentials often remain active long before a breach. See how identity persistence drives initial access risk.