71% firms face identity breaches amid rising AI risks: Sophos

Global cybersecurity leader Sophos has revealed that 71% of organisations worldwide suffered at least one identity-related cyber breach over the past year, with human error and poor management of non-human identities emerging as the leading causes behind the attacks.
The findings were disclosed in the company’s latest State of Identity Security 2026 report, a vendor-agnostic survey conducted among 5,000 IT and cybersecurity leaders across 17 countries.
According to the report, respondents experienced an average of three identity-related breaches during the year, while around 5% reported six or more incidents, indicating a growing pattern of repeated victimisation. The study also warned that the rapid rise of agentic AI is accelerating risks associated with non-human identities (NHIs).
The report found that identity compromise has become a major gateway for ransomware attacks. About 67% of ransomware victims said the attacks originated through compromised identities, a trend consistently observed by Sophos X-Ops researchers over the past year.
The financial toll of such attacks is also significant. Organisations affected by identity-related breaches reported average recovery costs of US$1.64 million, while 73% spent more than $250,000 to recover from the incidents.
The study highlighted that data theft, ransomware and financial fraud remain the most common consequences of identity-related breaches. Visibility and detection gaps also continue to pose major security challenges, with only 24% of respondents continuously monitoring suspicious login attempts. Meanwhile, 14% admitted they failed to stop attacks before damage occurred.
Critical infrastructure and government entities were found to be the most vulnerable sectors, recording the highest breach rates. The report further noted that companies struggling with regulatory compliance faced elevated cybersecurity risks.
Human error accounted for 43% of incidents, while weak management of non-human identities contributed to 41% of breaches, underscoring the growing importance of securing machine and AI-driven identities.
To reduce identity-based cyber risks, Sophos recommended adopting a multi-layered security approach for both human and non-human identities. Key measures include enforcing Multi-Factor Authentication (MFA), implementing least-privilege access policies, removing inactive identities, and deploying secrets management platforms for NHI credential protection.
The company also stressed the need for Identity Threat Detection and Response (ITDR) capabilities and broader adoption of Zero Trust security frameworks as AI-driven identities continue to expand rapidly.