Research from Sophos shows that 71 percent of the surveyed organizations had at least one identity breach in 2025.
The Sophos report ‘State of Identity Security 2026’ reveals that 71 percent of organizations experienced at least one identity breach in 2025. Human error and poor management of non-human identities (NHIs) are the primary causes, while agentic AI increases the risk.
According to the survey of 5,000 IT and cybersecurity managers across 17 countries, 5 percent even reported six or more breaches. Ransomware was often the result: 67 percent of victims saw their incident stem from an identity attack.
Financial and operational consequences
The average recovery costs amount to 1.64 million dollars, with 73 percent of organizations incurring costs of 250,000 dollars or more. Data theft (49 percent), ransomware (48 percent), and financial theft (47 percent) are the most reported consequences.
Only 24 percent of organizations continuously monitor for unusual login attempts. Smaller companies (100-250 employees) fail at detection nearly twice as often as medium-sized organizations.
NHI management and AI risks
Weak NHI management, such as API keys in code or static credentials, plays a role in 41 percent of incidents. Organizations with weak management incur $150,000 more in recovery costs and face a 22 percent higher risk of financial theft.
Agentic AI accelerates the problem: AI agents can independently create sub-agents with broad access. Only 11 percent of organizations continuously monitor NHIs.
Sophos recommends making multi-factor authentication mandatory, applying least-privilege access, and removing inactive identities. For NHIs, inventorying, short-lived credentials, and secrets management are essential.