Security scenario analysis: credential concentration risk — failure modes, real-world examples, indicators and defensive countermeasures.