Co-authored by Constella Intelligence and Kineviz

Most companies have no reliable way of knowing how corporate email accounts are being used, whether policies are being followed, or if critical data is being shared on unmonitored platforms. Malware does more than steal credentials. Infostealers’ bounty includes live sessions, saved credentials, browser configurations, and user interactions across infected devices throughout an organization. It reveals how employees behave, exposes how endpoints are configured, and highlights failing security policies. With such data in hand, bad actors can pinpoint an organization’s real-world weaknesses, beyond the perimeter monitored by logs or enforced by compliance checklists.  The good news is that organizations and defenders can use that same information to protect themselves and fight back.

In this third installment of the series, we explore policy violations, insecure practices, and endpoint weaknesses that silently expand the organizational attack surface. Drawing on findings from the Constella 2025 Identity Breach Report and given context by Kineviz’s visual analytics platform, we demonstrate how to use the intersection of behavioral and technical signals to expose systemic vulnerabilities before bad actors find them first.

Policy Violations: When Acceptable Use Becomes Unacceptable Risk

Acceptable Use Policies are designed to protect organizational assets by defining clear boundaries for how corporate accounts, devices, and identities should be used. But, the reality is that there is no such thing as a human firewall. Organizations can not enforce or monitor the intent or digital behavior of each employee in real time. The truth derived from infostealer data is that these boundaries are routinely ignored in day-to-day practice.

One frequently observed violation is the use of corporate email accounts to register on unauthorized platforms, whether they are social media sites, browser plugins, streaming services, or online marketplaces. In some cases, employees may be using their corporate email addresses on adult content platforms or online gambling services. Often times, these registrations are made from personal or unmanaged devices, which then become targets for malware infections. Once attackers exfiltrate credentials and session tokens, they gain access to potentially sensitive corporate resources as well as to those external services.

Whether intentional or accidental, these violations increase legal and operational risk. More importantly, they erode the boundary between internal systems and external exposure, creating opportunities for lateral compromise that security teams often cannot see until it is too late.

Password Reuse: Bridging External Infections with Internal Impact

Constella’s analysis shows that password reuse between personal and professional accounts remains one of the most common enablers of compromise. Employees frequently reuse passwords across unrelated services, often with minor variations, or use the same login combination for both internal systems and consumer applications. While this may be more convenient for the user, it opens the door to the organization if the password is compromised by a bad actor.

Organizations have no direct way to measure this behavior. Endpoint agents and IAM systems cannot detect whether a user is reusing the same password on a third-party site, nor can they prevent it unless password managers or strict vaulting practices are universally adopted and enforced. Even then, as mentioned, people find ways around them. This lack of visibility means that an employee’s compromised gaming account, shopping profile, or personal email account can silently open the door to a breach.

However, just as bad actors use the data they glean to pinpoint weaknesses for exploitation, organizations can use infostealer data to identify where and how they need to shore up their defenses. By analyzing infections at scale, companies can detect high-risk usage patterns that were invisible before.

Security teams who use Kineviz’ GraphXR can visualize data relationships, trace risk back to its origin, identify affected users and systems, and define clear priorities for containment and training.

By analyzing aggregated infections, security teams clearly see password reuse across domains and platforms. Infection analysis regularly finds credentials tied to cloud admin consoles, CI/CD tools, or customer databases side by side with consumer services or non-sanctioned applications.

Endpoint Exposure: A Reflection of Real-World Vulnerabilities

Infostealers not only extract credentials, they also capture detailed metadata about the infected environment. This includes browser versions, system configurations, running processes, antivirus products, and even clipboard contents or autofill settings. This technical context provides direct insight into which devices are most vulnerable and how malware is evading detection.

Among the findings surfaced in the 2025 report:

• Chrome, Firefox, and Edge are the most frequently targeted browsers due to their market share and extensive storage of session cookies and credentials.
• Antivirus evasion is widespread. Infostealer logs show infections on systems that report running up-to-date antivirus tools, suggesting misconfiguration, outdated signatures, or user-level bypasses.
• Infection hotspots vary significantly by geography, often correlating with weaker IT maturity or less frequent device patching and monitoring. These regions frequently include outsourced operations, contractors, or satellite offices where central control is limited.

Kineviz allows organizations to visualize these infections across office locations, endpoint types, and operating systems, enabling risk segmentation that aligns with actual exposure rather than policy assumptions.

From Static Policy to Adaptive Defense

The convergence of behavior and endpoint visibility allows organizations to shift from static security policies to contextual defense strategies. Diving into the data, gives teams the power to figure out where security policies are failing so they can focus their remediation efforts where the risk is highest.

Recommendations include:

1. Correlate identity data with device intelligence
   Combine credential exposure with endpoint metadata to understand infection conditions, identify vulnerable builds, and prioritize device-level hardening.
2. Visualize violations and usage drift
   Use graph-based analysis tools like GraphXR to group corporate identities misused on unapproved services or linked to high-risk behavioral patterns.
3. Deploy role-based awareness campaigns
   Train users on behavior as much as job function. For example, employees using the same password across services should receive targeted training and forced credential resets.
4. Monitor high-risk geographies and external partners
   Track infections across contractors, offshore teams, and unmanaged endpoints to detect weak links in distributed environments.
5. Implement policy validation with real data
   Replace static policy enforcement with continuous validation, driven by intelligence from real-world infections and endpoint activity.

Final Thoughts

Infostealers don’t just exfiltrate data. They dynamically sense policy violations, behavioral risks, and endpoint misconfigurations and can provide real benefits to the bad actors or to the organization attacked. If the information stays buried in disconnected logs, those benefits remain latent. However, if transformed into intelligence, then they can power adaptive, visual, and context-rich defense.

The absence of visibility into real employee behavior—how identities are used, where they appear, and which systems they access—creates blind spots that attackers actively exploit. No firewall can stop a user from making a poor security decision. But with deep infostealer intelligence from Constella and advanced visual analytics from Kineviz, organizations can finally see the risk for what it is, map it across users and endpoints, and act before it escalates.