2026 SANS State of Identity Threats & Defenses Survey Insights Event: How Identity Became the New Security Perimeter—And What’s Next

The 2026 SANS State of Identity Threats & Defenses Survey Insights Event, published by SANS Institute in March 2026, examines why widespread adoption of identity threat detection and response (ITDR) tools has not translated into fewer identity breaches. The survey drew on a global cohort of cybersecurity professionals, predominantly US-based, spanning technical practitioners and strategic decision-makers, and covers non-human identity governance, authentication gaps, attack techniques, and the business impact of identity compromise.

Key findings:

• 85% of organizations report actively deploying ITDR tools, yet 55% experienced at least one identity-related cyberattack leading to unauthorized access in the past 12 months, and 21% reported multiple incidents
• 68% of organizations detect identity attacks within 24 hours, but only 55% contain them in that same window, a lag the report calls the "deployment vs. resilience" gap
• 76% of organizations report growth in non-human identities (NHIs) such as service accounts and API keys, yet 92% fail to rotate the majority of their NHI credentials on a 90-day cycle, and only 8% rotate more than 75% of NHI credentials that often
• Credential phishing accounts for only 35% of identity attacks; the majority now involve techniques that bypass the login entirely, including compromised browsers (27%), MFA fatigue (26%), and session token hijacking (23%)
• 73% of organizations are deploying agentic AI or automations that require credentials, but no single governance control, such as approvals, audit trails, or sandboxing, is used by more than 40% of organizations
• 73% of organizations fail to enforce MFA on all contractor and partner accounts, despite contractors often holding elevated access outside the corporate device trust boundary
• Only 7% of organizations report broad passkey or FIDO2 support across business-critical apps, while 36% report no or almost no support for phishing-resistant authentication
• 44% of organizations cite reputation or brand damage as the primary business impact of identity attacks, ranking above service disruption (40%) and loss of shareholder value (30%)
• 38% of organizations cite budget constraints as the top barrier to effective ITDR deployment
• 79% of organizations plan to increase ITDR investment over the next 12 months, with 44% planning increases of 10–25%

The survey's central argument is that identity security has entered a new phase where the challenge is no longer buying tools but operationalizing them. Organizations successfully hardened human login security with MFA and SSO, but the attack surface shifted to what happens after authentication succeeds: ungoverned sessions, static service account credentials, and autonomous AI agents entering production faster than governance frameworks can be built. Closing the gap between detection and containment, not further tool adoption, is what the data points to as the defining challenge for 2026. Respondents were primarily based in the United States (85%), with additional representation from Europe, Canada, Africa, Asia, and Australia. The top industries represented were cybersecurity, technology, banking and finance, and government, with the largest organizational segment falling in the 100–1,000 employee range. Respondents spanned the organizational hierarchy, from security engineers and SOC analysts to CISOs and security VPs.