Sophos highlights prevalence of identity breaches
Identity breaches are increasingly prevalent. (Image source: Adobe Stock)
The State of Identity Security 2026 survey by Sophos reveals that 71% of organisations reported at least one identity breach last year, with the energy sector particularly hard hit
The highest breach rates were found in energy, oil and gas, and other utility providers (80.3%), while the lowest breach rates occurred in organisations in IT, technology and telecoms (63.1%) and healthcare (63.4%).
State of Identity Security 2026 is a vendor-agnostic survey of 5,000 IT and cybersecurity leaders across 17 countries. Human error (43%) and poor non-human identity management have been identified as the root causes of most attacks. Weak NHI management, including API keys stored in code, static credentials, and orphaned service accounts, was cited in 41%.
AI agents can autonomously spin up subagents, each generating new credentials with broad, persistent access and inconsistent human oversight. Existing identity frameworks were not built for this, and organisations are already behind. Two thirds of the ransomware victims (67%) responding to this survey confirmed their ransomware incident stemmed from an identity
attack, establishing identity compromise as a primary delivery mechanism for ransomware.
“AI agents are being granted privileges faster than security teams can track them, and organisations that fail to get ahead of this will find it an increasingly costly gap to close,” stated Ross McKerchar, chief information security officer at Sophos. The financial consequences were actually steep as recovery cost reached US$1.64 million, with a median of US$750,000, and 73% of those affected faced costs of $250,000 or more.
The research further states that overall 10% of organisations reported an identity breach that impacted their business in the last year with the primary consequences being data theft (49%), ransomware (48%), and financial theft (47%). 14% of breached organisations could not even detect and stop their most significant identity attack before damage was done. Smaller firms were nearly twice as likely to fail at detection as mid-sized peers.
To reduce exposure to identity-related attacks, organisations should implement a multi-layered approach covering both human and non-human identities. Essential steps include enforcing Multi-Factor Authentication (MFA) for all user accounts, applying least-privilege access principles, and disabling or removing inactive identities promptly.
For non-human identities specifically, organisations should inventory and classify all NHIs, replace long-lived credentials with short lived alternatives, and manage NHI credentials at scale.
As agentic AI accelerates NHI proliferation, deploying Identity Threat Detection and Response (ITDR) capabilities and adopting a Zero Trust security model are increasingly vital layers of defence.
State of Identity Security 2026 is a vendor-agnostic survey of 5,000 IT and cybersecurity leaders across 17 countries. Human error (43%) and poor non-human identity management have been identified as the root causes of most attacks. Weak NHI management, including API keys stored in code, static credentials, and orphaned service accounts, was cited in 41%.
AI agents can autonomously spin up subagents, each generating new credentials with broad, persistent access and inconsistent human oversight. Existing identity frameworks were not built for this, and organisations are already behind. Two thirds of the ransomware victims (67%) responding to this survey confirmed their ransomware incident stemmed from an identity
attack, establishing identity compromise as a primary delivery mechanism for ransomware.
“AI agents are being granted privileges faster than security teams can track them, and organisations that fail to get ahead of this will find it an increasingly costly gap to close,” stated Ross McKerchar, chief information security officer at Sophos. The financial consequences were actually steep as recovery cost reached US$1.64 million, with a median of US$750,000, and 73% of those affected faced costs of $250,000 or more.
The research further states that overall 10% of organisations reported an identity breach that impacted their business in the last year with the primary consequences being data theft (49%), ransomware (48%), and financial theft (47%). 14% of breached organisations could not even detect and stop their most significant identity attack before damage was done. Smaller firms were nearly twice as likely to fail at detection as mid-sized peers.
To reduce exposure to identity-related attacks, organisations should implement a multi-layered approach covering both human and non-human identities. Essential steps include enforcing Multi-Factor Authentication (MFA) for all user accounts, applying least-privilege access principles, and disabling or removing inactive identities promptly.
For non-human identities specifically, organisations should inventory and classify all NHIs, replace long-lived credentials with short lived alternatives, and manage NHI credentials at scale.
As agentic AI accelerates NHI proliferation, deploying Identity Threat Detection and Response (ITDR) capabilities and adopting a Zero Trust security model are increasingly vital layers of defence.
