Identity research & data

Errors, social engineering, phishing, and misuse were present in 62% of breaches, up slightly from 60%, across more than 22,000 confirmed breaches in 145 countries.

Credential abuse fell from 22% to 13% as an initial access vector in the 2026 DBIR, partly because Pretexting is now tracked separately (16% on the old basis). Counted at any point in the breach, credential abuse still leads at 39%.

Within basic web application breaches, the overwhelming majority were carried out with stolen credentials rather than exploits.

Breaches with third-party involvement grew 60% year over year, reaching 48% of all breaches and underscoring supply-chain risk.

Phishing held at 16% of breaches for a second year, while mobile-centric lures such as voice and text drew 40% higher click rates than email in simulations.

More than 97% of identity attacks observed by Microsoft target passwords; identity-based attacks surged 32% in the first half of 2025.

Microsoft reports phishing-resistant MFA stops over 99% of identity attacks, even when the adversary already holds valid credentials.

Over 15 billion user accounts are equipped to sign in with a passkey, roughly doubling availability year over year.

FIDO's 2026 Passkey Index, drawn from 15 major consumer services, found passkey sign-ins succeed more often and are nearly three times faster than passwords and traditional MFA such as SMS OTP.

FIDO estimated 7 billion passkeys in use in October 2026, up from 5 billion on World Passkey Day in May, and more than a third of successful sign-ins now use one.

Up from 26% in 2025, across 15 consumer services in FIDO's Passkey Index 2026; the share includes re-authentication and excludes account recovery, and FIDO calls year-on-year comparisons directional.

Up sharply from roughly 75% a year earlier, per FIDO's State of Passkeys 2026 research across ten countries.

Workforce passwordless is moving from pilot to rollout, though account recovery and legacy systems remain the hard part.

A single-retailer datapoint on consumer-scale adoption, reported by Identity Week in May 2026; Amazon has not said whether it counts enrolled or active users. Amazon reports passkey sign-in about six times faster than passwords.

Ransomware was present in 48% of breaches, up from 44% the prior year, even as 69% of victims declined to pay.

Flashpoint recorded 1.7 billion credentials stolen by infostealer malware from 7.4 million infected hosts and devices between January and June 2026.

Recorded Future indexed 276 million credentials with active session cookies in 2025, letting attackers hijack sessions and bypass MFA.

GitGuardian detected 28.65 million new hardcoded secrets in public GitHub commits in 2025, a 34% year-over-year increase and the largest single-year jump it has recorded.

Retesting credentials first confirmed valid in 2022, GitGuardian found more than 64% still worked in January 2026, down from nearly 70% a year earlier.

Machine identities, including AI agents, now outnumber humans 109 to 1, a ratio that includes 79 AI agent identities per human, per a survey of 2,930 security leaders.

CyberArk found 68% of organizations have no identity security controls for AI, even as AI creates the most new privileged identities.

IBM's global average breach cost rose 12% to a record $4.99M, driven largely by detection, escalation, and lost business costs.

Organizations averaged 183 days to identify and 64 days to contain a breach, a 2.5% uptick that reversed a five-year decline.