2026 Data and Identity Security Report

70% of organizations with fewer than 500 employees cannot get a single view of where sensitive data lives and which identities can access it.

70% of organizations with 10,000 or more employees cannot get a single view of where sensitive data lives and which identities can access it.

70% of organizations with fewer than 1,000 employees have privileged accounts with standing access to sensitive systems or data.

Only 18% of organizations with fewer than 1,000 employees automatically remove privileged standing access when it is no longer needed.

50% of organizations with fewer than 500 employees say AI and automation have increased the number of identities that can access sensitive data.

28% of organizations with fewer than 1,000 employees use home-grown or ad hoc tools to manage third-party privileged access.

Among organizations with 500 to 999 employees that experienced unauthorized access, 85% are confident they can detect risky combinations of user access.

56% of organizations with 500 to 999 employees that experienced unauthorized access estimate the financial impact at more than $100,000.

47% of organizations with 500 to 999 employees that experienced unauthorized access report operational disruption.

47% of organizations with 500 to 999 employees that experienced unauthorized access report damage to customer trust.

Organizations with fewer than 500 employees reported 18% unauthorized access to sensitive data in the past year.

76% of organizations with fewer than 1,000 employees say identity and data security aren't unified under one strategy.

23% of organizations with fewer than 500 employees have not conducted an Active Directory security assessment in the past year.

67% of organizations with fewer than 1,000 employees say AI and automation have increased the number of identities that can access sensitive data.

18% of organizations with fewer than 500 employees say non-human identities are not governed at all.

2% of organizations with 10,000 or more employees say non-human identities are not governed at all.

26% of organizations with fewer than 500 employees say they are unprepared for AI security, with no formal AI data inventory or usage policies in place.

34% of organizations with fewer than 1,000 employees cite budget as the most commonly cited barrier to improving identity and data security.

28% of organizations with fewer than 1,000 employees cite skills and staffing as a barrier to improving identity and data security.

Organizations with 10,000 or more employees report 27% unauthorized access to sensitive data in the past year.

Among organizations with 500 to 999 employees that experienced unauthorized access, 87% are confident their Active Directory is free of misconfigurations that could allow privilege escalation.

80% of IT and security professionals say they cannot get a single view of where sensitive data lives and which identities can access it.

Organizations with 500 to 999 employees reported the highest rate of unauthorized access to sensitive data in the past year at 40%.

8% of organizations with 10,000 or more employees have not conducted an Active Directory security assessment in the past year.

70% of healthcare organizations say their data access governance is behind the speed of AI adoption.

79% of healthcare organizations say their non-human identities are not fully governed.

61% of healthcare organizations say determining who has access to a specific piece of sensitive data takes hours and multiple tools.

77% of healthcare organizations cannot immediately determine who has access to a specific piece of sensitive data.

75% of healthcare organizations say AI and automation have increased identity-related risk to sensitive data over the past two years.

31% of healthcare organizations experienced unauthorized identities accessing sensitive data in the past year, compared with 24% in other industries.

Among healthcare organizations that experience an identity-related incident, 33% incur costs above $250,000, compared with 21% in other industries.

48% of healthcare organizations say a compromised identity is the most common starting point for unauthorized access to sensitive data.

86% of healthcare organizations lack full confidence that their Active Directory environments are free of privilege escalation risks.

Only 14% of healthcare organizations are fully confident in their Active Directory security, compared with 26% across all industries.

70% of organizations have no unified strategy connecting identity and data visibility.

17% of organizations remain entirely unprepared for AI security.

75% of sensitive data exposures begin with compromised identities or misconfigured permissions.

45% of organizations are still developing AI governance programs.

74% of organizations lack a unified view of sensitive data and the identities that can access it.

Only 11% of organizations report full AI security readiness.

Among organizations where AI significantly expanded identities requiring access, breach rates reached 43% over the past twelve months. In contrast, where AI had not materially changed access patterns, breach rates were 11% over the past twelve months.

Only 11% of organizations have operationalized AI governance through continuous enforcement and monitoring.

76% of organizations cannot immediately revoke standing access when it is no longer needed.

Only 19% of organizations fully govern non-human identities.

Only 20% of organizations fully monitor employee use of shadow AI.

Only 23.5% of organizations can respond at the speed attackers move.

Organizations with 500 to 999 employees reported a 40.3% breach rate, the highest of any size segment.

In North America, 24% of breached organizations reported losses of at least $100,000 in the past year.

Nearly 63% of organizations require between one and three days to remediate identified risks.

76% of organizations do not fully govern or monitor non-human identities.

In North America, 12% of breached organizations reported losses above $250,000 in the past year.