Sophos’s State of Identity Security 2026 report shows a blunt picture: identity has moved from a supporting security concern to a primary attack surface. In a vendor-agnostic survey of 5,000 IT and cybersecurity leaders across 17 countries, Sophos found that 71% of organizations suffered at least one identity-related breach in the past year. The identity breaches affected organisations averaged 3 incidents, with 5% reporting 6 or more.
“Identity has become the primary attack surface in modern cybersecurity, and this data shows most organizations are losing ground,” said Ross McKerchar, chief information security officer at Sophos. “The non-human identity problem is particularly urgent. AI agents are being granted privileges faster than security teams can track them, and organizations that fail to get ahead of this will find it an increasingly costly gap to close.”
Sophos says these Identity breaches are being driven mainly by human error and weak management of non-human identities, including API keys, service accounts, and other machine identities.
[Related Reads: Gartner Warns 25% of Enterprise GenAI Apps to Face Frequent Security Incidents by 2028 ]
The company argues that the problem is getting worse as agentic AI speeds up the creation of new credentials and access paths faster than security teams can track them.
Sophos says 67% of ransomware victims in the survey reported that their ransomware incident stemmed from an identity attack. It puts the mean recovery cost at $1.64 million and the median at $750,000, with 73% of affected organizations spending $250,000 or more to recover.
Why is identity security becoming harder?
As organizations adopt cloud services and AI systems, they add more human and non-human identities, each of which can become a doorway for attackers. The report identities can outnumber human identities by as much as 100:1, yet only 34% of organizations regularly audit or rotate service accounts and non-human identities.
The report also points to weak visibility; Sophos found that only 24% of organizations continuously monitor for unusual login attempts, and more than half do so only every three months or less. It also says 14% of breached organizations could not stop their most significant identity attack before damage was done.
[Also Read: AI-Driven Hacking Risks Rise as Anthropic’s Mythos Raises Banking Concerns ]
What it means
For enterprises, identity security cannot be treated as a login problem. It is now a core control layer for cloud access, ransomware defense, and AI governance. Sophos explicitly recommends stronger MFA, least-privilege access, faster removal of inactive identities, better secrets management, identity threat detection and response, and Zero Trust controls.
Sophos report shows agentic AI can create new credentials and sub-agents with broad, persistent access, often without sufficient human oversight. That is a different risk profile from the older password-and-phishing model, because it expands the number of identities to secure and the speed at which they appear.
[Also Read: AI-Powered Cyberattacks Pose Threat to Financial Markets, IMF Warns ]
