What Cloudflare actually measured
Published on March 3, 2026, Cloudflare's first Threat Report describes a shift in some tactics toward identity abuse, session-token theft, and misuse of trusted cloud tools. In its report introduction, Cloudflare says that during the previous three months, 63% of logins it observed involved credentials already compromised elsewhere, while 94% of login attempts originated from bots.
These figures describe Cloudflare's network telemetry, not all logins across the Internet. The 94% figure measures automated origin; it does not mean every bot or attempt was malicious. Likewise, 63% does not mean that 63% of accounts were hacked.
Why credentials and sessions matter
Compromised credentials can enable logins that resemble normal activity. Attackers may also target active session tokens: the report describes token theft as a way to bypass some multifactor protections after authentication. That does not make MFA useless; it shows why it should be combined with device protection, access monitoring, and the session controls provided by each service.
Password reuse can turn a breach at one service into a risk for other accounts. A unique password limits that path, while phishing-resistant MFA adds a separate barrier. Neither measure automatically revokes an existing session.
Practical priorities for a small business
Start with email, administrator, remote-access, and file-storage accounts, since they may unlock access to other services. For each account:
- replace reused passwords with unique secrets;
- enable MFA, preferring a phishing-resistant method when the service offers one;
- check where the service displays active sessions and how to close them after suspected compromise;
- separate administrator accounts from those used for routine work.
Closing or revoking a session depends on the options offered by the service: changing a password does not guarantee that every existing session is invalidated everywhere.
What the report cannot establish
Cloudflare's observations do not show that every organization experiences the same distribution of attacks, nor that password theft explains every login counted. The report summarizes one network provider's telemetry; it does not replace reviewing your own organization's logs and incidents.
Soclyde's role
Soclyde keeps encrypted vaults on the user's devices rather than in a centralized password vault operated by Soclyde. This means the vault contents are not entrusted to a central repository at the provider; it does not protect a compromised device or close sessions in other services. Learn how to create strong, unique passwords or talk to Soclyde.
Key takeaways
Cloudflare's 2026 report highlights the importance of identities and sessions, but its statistics are specific to Cloudflare's telemetry. For practical ways to reduce password reuse, read the strong, unique password guide and the guide to recognizing and limiting infostealers.
