2026 SANS State of Identity Threats & Defenses Survey Insights Event: How Identity Became the New Security Perimeter—And What’s Next

For a decade, the cybersecurity industry operated on a tacit assumption that modernizing authentication stacks with single sign-on (SSO) and multi-factor authentication (MFA) would suffocate the breach epidemic. The 2026 SANS Identity Threat Detection and Response (ITDR) Survey proves this assumption is dangerous. The defining finding is what we call the “deployment vs. resilience” gap: Although 68% of organizations detect identity attacks within 24 hours, only 55% contain them in that same window. Organizations have invested in the sensors to hear the alarm but have not yet built the operational muscle to put out the fire.