Survey Reveals Critical Gap Between Perceived and Actual Visibility into Machine Identities
SpyCloud, a leader in identity threat protection, has released its annual 2026 Identity Threat Report, revealing that non-human identities (NHIs) — including AI agents, service accounts, API keys, and authentication tokens — have become the most common initial attack vector into enterprise systems. The report, based on a survey of 750 cybersecurity leaders and practitioners across North America, the UK, and select European markets, underscores a dangerous disconnect: while 95% of organizations believe they have adequate visibility into AI- and NHI-related exposures, only 36% actually monitor these identities.
Key Findings: NHIs Outpace Phishing as Top Entry Point
The survey found that compromised NHIs were the primary entry point for attacks in 31% of cases — nearly double the rate of phishing and social engineering (17%), which ranked second. NHI-related misuse also surfaced as the most common identity-based event type, reported by 42% of organizations. Yet, despite this prevalence, machine identities remain the least-monitored category of identity risk. In the same period, 68% of organizations experienced at least one identity-based event, with affected organizations averaging eight incidents each.
Organizations typically maintain clear inventories of their human workforce, but few extend that oversight to service accounts, API keys, and AI agents. These identities are often provisioned for convenience, hold substantial privilege, and lack the lifecycle management that human accounts have. As Trevor Hilligoss, SpyCloud’s Chief Intelligence Officer, noted: “Every one of these identities is a standing invitation that renews itself until someone notices.”
AI Adoption Outpaces Governance
While 91% of organizations now use AI tools or agents with access to internal systems, only 56% have formal governance and ownership for the privileges these identities hold. Another 41% rely on informal processes or partial ownership, creating “shadow access” — privileged connections that operate outside normal governance and monitoring.
Session Hijacking and Stolen Cookies Pose Growing Risk
The report highlights that exposed session cookies and authentication tokens are becoming a preferred attack vector, allowing cybercriminals to bypass multi-factor authentication (MFA). Organizations with visibility into stolen session data experienced identity-based events at a meaningfully lower rate (37%) compared to those without such visibility (50%). SpyCloud research confirms that session data has now overtaken passwords as the top target for attackers.
Supply Chain Vulnerabilities Remain a Concern
Third-party exposures are also a major concern. Malware-infected third-party devices (23%) and exposed API keys or application access involving vendors (22%) were the leading causes of supply chain identity events. Surprisingly, nearly 40% of organizations have no consistent process to confirm that third-party exposures are fully resolved, even as 32% plan to enhance supply chain and vendor risk management in the next 12 to 18 months.
Automation and Continuous Monitoring Are Key Differentiators
The report introduces SpyCloud’s Identity Threat Protection Maturity Model, categorizing organizations into four tiers: Reactive, Building, Operational, and Optimized. Findings show that organizations with high levels of automation report lower incident response costs (32% vs. 39%) and less loss of customer trust (36% vs. 47%) compared to those relying on manual remediation.
“Most identity programs are still measured on whether an exposure happened. That’s the wrong scoreboard,” said Damon Fleury, Chief Product Officer at SpyCloud. “Organizations that pair continuous identity monitoring with automated remediation create the greatest friction for criminals and gain the biggest edge in preventing follow-on attacks.”
About the Report
The full 2026 SpyCloud Identity Threat Report is available without registration, and organizations can benchmark their security posture against the maturity model via a free assessment. SpyCloud, headquartered in Austin, TX, serves 7 of the Fortune 10 and hundreds of global enterprises, mid-sized companies, and government agencies.
This is a paid press release published via CyberNewswire, a PR newswire syndication platform for cybersecurity companies.