HYPR Survey Finds AI Attacks Top Identity Security Concern as Passwordless Adoption Stalls
Summary
A HYPR-commissioned survey of 950 IT security decision-makers found generative AI and agentic AI were leading identity security concerns, while passwordless adoption plateaued and identity verification remained unevenly deployed.
Key points
- The November 2025 survey found generative AI (53%) and agentic AI (45%) were respondents’ top identity-specific security concerns, ahead of stolen or compromised credentials (38%).
- Nearly 40% of respondents said their organization experienced a GenAI-related security incident in the prior 12 months; among those reporting AI-based attacks, 65% cited personalized phishing.
- Phishing was the most commonly reported cyberattack in the prior year (43%), followed by malware and ransomware (37%).
- Passwordless adoption had plateaued: 76% of respondents’ organizations still relied on usernames and passwords, while 43% reported enterprise use of passwordless authentication.
- Financial constraints were the leading reported barrier to passwordless adoption (40%); user experience was cited by 23%.
- About 65% of organizations reported using identity verification, but deployment was concentrated in limited use cases and user groups.
- The study was commissioned by HYPR and produced by 451 Research; it surveyed 950 global IT security decision-makers in November 2025.
Article Details
- Publisher
- HYPR; produced by 451 Research from S&P Global Energy Horizons
- Report Period
- Survey conducted November 2025; report published for 2026
- Scope
- Global survey of IT security decision-makers on identity security, AI-based attacks, passwordless adoption, and identity verification.
- Sample Size
- 950 global IT security decision-makers in managerial positions or higher, engaged in identity lifecycle and security measures.
- Key Statistics
- Generative AI (53%) and agentic AI (45%) were the leading identity-specific security concerns; stolen or compromised credentials were cited by 38%.
- Nearly 40% of organizations reported a GenAI-related security incident in the previous 12 months; among respondents impacted by AI-based attacks, 65% cited personalized phishing.
- Phishing was the most common cyberattack experienced in the previous 12 months (43%), followed by malware and ransomware (37%), AI-generated attacks (36%), and identity impersonation (35%).
- FIDO passkeys were identified as phishing-resistant by 64% of respondents, up from 40% in the 2025 study; hardware keys rose to 54% from 34%, and smartcards to 52% from 37%.
- 65% of respondent organizations used identity verification; usernames and passwords remained the dominant authentication method for 76% of respondents.
- Recommendations
- Operationalize identity security across workflows, including hiring and onboarding, sensitive application access, account recovery, device replacement, and help desk interactions.
- Coordinate identity governance across HR, IT, Legal, and Security, and address legacy dependencies and fragmented ownership when scaling deployments.
People
Vendors
Countries
AustraliaConducted in November 2025, the global survey included respondents from the US, UK, France, Germany, Australia/New Zealand, Japan and Singapore.Francesecurity measures. Conducted in November 2025, the global survey included respondents from the US, UK, France, Germany, Australia/New Zealand, Japan and Singapore.Germanymeasures. Conducted in November 2025, the global survey included respondents from the US, UK, France, Germany, Australia/New Zealand, Japan and Singapore.Japan2025, the global survey included respondents from the US, UK, France, Germany, Australia/New Zealand, Japan and Singapore.New Zealandin November 2025, the global survey included respondents from the US, UK, France, Germany, Australia/New Zealand, Japan and Singapore.Singaporeglobal survey included respondents from the US, UK, France, Germany, Australia/New Zealand, Japan and Singapore.United Kingdomand security measures. Conducted in November 2025, the global survey included respondents from the US, UK, France, Germany, Australia/New Zealand, Japan and Singapore.United Statescycle and security measures. Conducted in November 2025, the global survey included respondents from the US, UK, France, Germany, Australia/New Zealand, Japan and Singapore.