73% of APJ organisations suffered one or more identity breaches in the past year: Sophos

- Human error and poor non-human identity management are the root causes of most attacks

- Agentic AI accelerates the risk  

Sophos, a global cybersecurity provider, has released the State of Identity Security 2026, a vendor-agnostic survey of 5,000 IT and cybersecurity leaders across 17 countries*. The survey found that 71% of organisations globally suffered at least one identity-related breach in the past year, and on average, organisations reported three separate incidents. 

Identity attacks are rarely one-off events with repeat victimisation reaching a notable level, with 5% even reporting six or more breaches globally, Sophos said. These attacks are driven primarily by human error and weak management of non-human identities (NHIs), a challenge that is accelerating rapidly as agentic AI accelerates attack processes. According to the company, NHIs can include API keys, service accounts, and AI agents, and often outnumber human identities by ratios as high as 100:1.

Two thirds of the ransomware victims (67%) responding to this survey confirmed their ransomware incident stemmed from an identity attack, establishing identity compromise as a primary delivery mechanism for ransomware. Sophos X-Ops researchers have observed this consistently over the past year. The financial consequences are steep: the mean recovery cost reached US$1.64 M, with a median of US$750,000, and 73% of those affected faced costs of US$250,000 or more.

Regionally, identity breaches were slightly higher than the global average, with 73% of organisations in Asia Pacific and Japan (APJ) reporting at least one identity-related security breach in the past 12 months, compared with 71% globally.

The report also found that breached organisations in APJ had a 15% rate for detection failure, in contrast to the global rate of 14%. These organisations were unable to detect and stop their most significant identity attack before damage was done.

“Identity has become the primary attack surface in modern cybersecurity, and this data shows most organisations are losing ground,” said Ross McKerchar, CISO, Sophos. 

“The non-human identity problem is particularly urgent. AI agents are being granted privileges faster than security teams can track them, and organisations that fail to get ahead of this will find it an increasingly costly gap to close.” 

Other global highlights include:

Data and financial theft dominate

Overall, 10% of organisations reported an identity breach that impacted their business in the last year with the primary consequences being data theft (49%) and ransomware (48%), and financial theft (47%)

Visibility remains a critical weakness

Only 24% of organisations continually monitor for unusual login attempts, and more than half check every three months or less.

Detection gaps persist

Fourteen percent of breached organisations could not detect and stop their most significant identity attack before damage was done. Smaller organisations (100–250 employees) were nearly twice as likely to fail at detection compared to those with over 1,000 employees. 

Critical infrastructure is the most exposed

Energy, oil/gas, and utilities (80%) and federal/central government (78%) reported the highest breach rates across all industries surveyed. IT and technology organisations reported the lowest at 63%.

Compliance struggles signal broader risk

Organisations that found compliance requirements very challenging had a breach rate of 82.4%, 14 percentage points higher than those with lower compliance difficulty (68.3%).

Human error (employees tricked into providing credentials) was cited in nearly 43% of incidents. Weak NHI management, including API keys stored in code, static credentials, and orphaned service accounts, was mentioned in 41%. Organisations with weak NHI management are 22% more likely to experience financial theft and pay approximately US$150,000 more to recover than average.

The NHI management problem is intensifying. AI agents can autonomously spin up sub-agents, each generating new credentials with broad, persistent access and inconsistent human oversight. Existing identity frameworks were not built for this, and organisations are already behind: only one in three organisations regularly rotate or audits service accounts and non-human identities, and just 11% do so continuously. 

Sophos' recommendations to reduce exposure to identity-related attacks include: 

Organisations should implement a multilayered approach covering both human and non-human identities. Essential steps include enforcing multifactor authentication (MFA) for all user accounts, applying least-privilege access principles, and disabling or removing inactive identities promptly.  

Organisations should also inventory and classify all NHIs, replace long-lived credentials with short-lived alternatives, and implement secrets management platforms to manage NHI credentials at scale. As agentic AI accelerates NHI proliferation, deploying identity threat detection and response (ITDR) capabilities and adopting a Zero Trust security model are increasingly critical layers of defence. 

Details

Get The State of Identity Security 2026 at https://www.sophos.com/en-us/resources/report/the-state-of-identity-security-2026 

*The State of Identity Security 2026 report comes from a vendor-agnostic survey conducted in Q126 of 5,000 IT and cybersecurity leaders across 17 countries, including the US, UK, Germany, France, Australia, Japan, India, and Brazil, in organisations with 100 to 5,000 employees across 14 industries.