Skip to content
ZK
ZAIN KHALIL KHAN
PORTFOLIO
All projects

Interactive build

CredGuard | Credential Stuffing Defence Modelling

Attack-economics model for credential stuffing that composes rate limiting, account backoff, breached-password screening, risk-based challenges, device fingerprinting, and MFA, quantifying both the takeovers prevented and the legitimate users inconvenienced.

Live demo readyAccount Security + Credential Stuffing
Account SecurityCredential StuffingMFARate LimitingThreat ModellingAuthenticationCase study / interactive demo

Case study

From problem to working system

Problem

Attack-economics model for credential stuffing that composes rate limiting, account backoff, breached-password screening, risk-based challenges, device fingerprinting, and MFA, quantifying both the takeovers prevented and the legitimate users inconvenienced.

My role

Security engineer and full-stack developer

Solution

Attack-economics model for credential stuffing that composes rate limiting, account backoff, breached-password screening, risk-based challenges, device fingerprinting, and MFA, quantifying both the takeovers prevented and the legitimate users inconvenienced.

Architecture

The implementation combines the following technologies and system concerns.

Account SecurityCredential StuffingMFARate LimitingThreat ModellingAuthentication

How it was built

  • Modelled stuffing as an economics problem: a breach corpus, a password reuse rate, and an attempt throughput, which is what determines whether a control actually matters.
  • Modelled distributed attacker infrastructure so per-IP rate limiting is shown failing the way it fails in reality.

Security decisions

  • Quantified user friction alongside blocking effectiveness, because a control that stops 60% of attacks and locks out 5% of customers is a business decision, not a security one.
  • Modelled distributed attacker infrastructure so per-IP rate limiting is shown failing the way it fails in reality.
  • Separated controls that slow an attacker from controls that stop them, which is the distinction that puts MFA in its own category.

Major challenges

  • Composed controls multiplicatively so each one is credited only for what the previous control let through, avoiding the double-counting that makes defence-in-depth look better on paper than in production.
  • Quantified user friction alongside blocking effectiveness, because a control that stops 60% of attacks and locks out 5% of customers is a business decision, not a security one.
  • Separated controls that slow an attacker from controls that stop them, which is the distinction that puts MFA in its own category.

Verified evidence

Results and measurable impact

  • Quantified user friction alongside blocking effectiveness, because a control that stops 60% of attacks and locks out 5% of customers is a business decision, not a security one.

Screenshots and access

Product view

Open live project

Interactive Demo

A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.

CredGuard

Security platform

CredGuardWorkspace5 updates
CredGuard · Stuffing Economicsshare of the corpus this control set stops
12,350 ATO

Credential stuffing is an economics problem: the attacker holds a breach corpus and only needs the reused pairs. Controls compose multiplicatively, and every one of them costs some legitimate users friction. The question is never whether a control works, it is what it buys against what it costs.

Valid pairs in corpus

19,000

1.9% reuse of 1M

Successful takeovers

12,350

65.0% get through

Sweep time

8.3 h

120,000 attempts/h

Users inconvenienced

8

of 4,000 daily logins

Blocked1 control
35%stopped
Residual exposure12,350 of 19,000 valid pairs
Corpus converted to takeover65.0%
Legitimate users challenged8
Control stack

Without MFA, every control here only raises the attacker's cost. A valid reused pair still authenticates, so the residual takeover count never reaches zero.

Zain Khalil Khan