SpyCloud Survey Finds Non-Human Identity Misuse Leads Reported Identity Events
Report discovered via Awesome Annual Security Reports.
Summary
SpyCloud’s 2026 survey of 750 security professionals found 68% of organizations reported an identity-based event in the past year. Non-human identity misuse led reported event types, while visibility, governance, and remediation gaps remained common.
Key points
- The report is based on a June 2026 survey of 750 cybersecurity decision-makers and practitioners across North America, the UK, and selected European markets.
- Sixty-eight percent of organizations reported an identity-based event in the past year; affected organizations averaged eight events.
- Non-human identity misuse was the most commonly reported event type (42%); 31% ranked exposed or overprivileged non-human identities as their primary initial access vector.
- Although 91% of organizations used AI tools or agents with internal access, 56% had formal governance and ownership for AI- and NHI-related privileges.
- Organizations reporting identity events had less visibility into stolen session cookies (37% versus 50%) and personal devices with corporate access (40% versus 52%) than organizations reporting no such events.
- Organizations using manual remediation reported more customer or partner trust loss (47% versus 36%) and higher incident response costs (39% versus 32%) than those using more automated workflows.
Article Details
- Publisher
- SpyCloud
- Report Period
- Survey conducted June 2026; identity-event findings cover the preceding 12 months.
- Scope
- Survey benchmarks identity-threat practices at organizations with 500 or more employees across North America, the United Kingdom, and selected European markets.
- Sample Size
- 750 cybersecurity decision-makers and practitioners
- Key Statistics
- 68% of surveyed organizations experienced an identity-based event in the preceding 12 months.
- Among reported identity-event types, non-human identity misuse or compromise was most common at 42%.
- 31% of affected organizations identified exposed or overprivileged non-human identities as their most common initial access vector.
- 91% of organizations used AI tools or agents with internal access, while 56% had formal governance and ownership for AI- and NHI-related privileges.
- Survey results are reported at a 95% confidence level with a ±3.58% margin of error.
- Recommendations
- Expand continuous identity-exposure monitoring across human and non-human identities, devices, session cookies and tokens, AI tools, and vendors.
- Automate investigation and remediation workflows, including credential rotation, session and token revocation, and privilege reduction.
- Establish formal governance and ownership for AI- and NHI-related access.
- Verify that third-party and vendor identity exposures have been remediated.
Vendors
Industries
GovernmentThe Government sector reported experiencing a much higher frequency of identity events (92.3% vs. 68% total), and government orgs reported the highest average event volume (10 events vs. 8 total average). ManufacturingInsurancehave the highest concentration of organizations operating at the Optimized maturity level, while Insurance reports the highest share of Reactive programs (17.7%), underscoring that some industries remain earlierManufacturingand government orgs reported the highest average event volume (10 events vs. 8 total average). Manufacturing organizations, on the other hand, were significantly less likely to have experienced an identity-basedRetail & Ecommerce– which has been on the receiving end of a growing number of targeted attacks in recent years – and Retail & Ecommerce (13.4%) have the highest concentration of organizations operating at the Optimized maturity level,Technology / Softwaresectors. Telecommunications leads with the highest active validation rate at 68%, while Technology / Software organizations report the lowest rate at 38%, revealing meaningful differences in third-partyTelecommunicationsacross respondents. Vendor remediation validation is uneven, even across technology-heavy sectors. Telecommunications leads with the highest active validation rate at 68%, while Technology / Software organizations