Where do these identity statistics come from?

Every figure links to the publisher's own report, press release or official page: 49 publishers in total, including standards bodies, governments, security vendors and analyst firms. We do not cite statistics roundups or aggregators, and we drop any number we cannot read on its source.

How current are the statistics?

Each statistic shows the date its publisher released it and the date we last checked it against the source. The latest check across all 8 topic pages was 2026-11-05. We prefer the newest edition of each recurring report and replace figures when a new edition ships.

Can I use these statistics in an article or a deck?

Yes. Cite the original publisher for each number (each card has a ready-made citation) and link the Start with Identity page as the compilation. The compilation is CC BY 4.0 and downloadable as CSV or JSON.

Statistics · primary sources only · last checked 2026-11-05

Identity security statistics 2026

Name: Identity Security Statistics
Creator: Start with Identity
License: https://creativecommons.org/licenses/by/4.0/
Keywords: Passkeys, MFA, Credential attacks, Identity breaches, Non-human identity, Customer identity (CIAM), Digital identity, Identity market

As of November 2026: 186 sourced statistics on identity security from 49 primary publishers, grouped into 8 topics. Each one is a single sentence with its publisher, release date, method and a link to the original source, plus a citation you can copy. Each topic also carries live figures computed from our own datasets.

186

sourced statistics

primary publishers

topic pages

2026-11-05

last checked

Passkeys
24 stats
7 billion
The FIDO Alliance estimates that 7 billion passkeys were in use worldwide in October 2026.
FIDO Alliance
Adoption and scale · Sign-in performance · Consumer services · Workforce and enterprise
MFA
22 stats
70%
Okta found that 70% of workforce users at Okta Workforce Identity customers signed in with MFA as of January 2025, leaving nearly a third without it.
Okta
Adoption · Effectiveness · Bypass, fatigue and gaps · Mandates and policy
Credential attacks
24 stats
16%
Phishing was the initial access vector in 16% of breaches in Verizon's 2026 DBIR, unchanged from the previous year.
Verizon
Phishing and AiTM kits · Vishing and help desk attacks · Password attacks and credential stuffing · Infostealers and session cookie theft
Identity breaches
25 stats
13%
Credential abuse was the initial access vector in 13% of breaches in Verizon's 2026 DBIR, down from 22% a year earlier, partly because Pretexting is now tracked as a separate vector.
Verizon
Root cause and initial access · Cost and response time · Identity and cloud intrusions · Third parties and ransomware
Non-human identity
22 stats
109:1
Machine identities, including AI agents, outnumber human identities by 109:1 in the organizations Palo Alto Networks surveyed for its 2026 Identity Security Landscape.
Palo Alto Networks
Scale and machine-to-human ratio · AI agents and agentic identity · Secrets sprawl · Governance gaps and breaches
Customer identity (CIAM)
23 stats
74%
74% of consumers say they would abandon a site or app if asked to create an account before seeing key information, per Auth0's 2026 Customer Identity Trends Report.
Auth0 (Okta)
Sign-up and login friction · Security expectations and habits · Fraud and attacks on consumer accounts · Consumer trust and privacy
Digital identity
21 stats
145.32 crore
India's UIDAI reports 145.32 crore Aadhaar numbers generated in total (1 crore is 10 million).
Unique Identification Authority of India (UIDAI)
National eID schemes · Government login and digital residency · EU eID and the EUDI Wallet · Mobile IDs and digital wallets
Identity market
25 stats
$213 billion
Gartner projected worldwide end-user spending on information security at $213 billion in 2025, up from $193 billion in 2024.
Gartner
Market size and spending · Public vendor results · Mergers and acquisitions · Funding rounds

What qualifies as a statistic

Primary (the publisher's own page, never an aggregator), dated (the publisher's release date), and with a stated method (survey sample, telemetry or official count). Every number was read on its source page on the last-checked date shown on its card. For our own data, see the research hub, the Identity Breach Database and the MFA support matrix.

How to cite

Cite each figure to its original publisher and link the topic page. Download everything as CSV or JSON (CC BY 4.0).

Start with Identity, "Identity security statistics 2026," https://startwithidentity.com/statistics/ (last checked 2026-11-05). Cite each figure to its original publisher.

About these statistics

Where do these identity statistics come from?: Every figure links to the publisher's own report, press release or official page: 49 publishers in total, including standards bodies, governments, security vendors and analyst firms. We do not cite statistics roundups or aggregators, and we drop any number we cannot read on its source.
How current are the statistics?: Each statistic shows the date its publisher released it and the date we last checked it against the source. The latest check across all 8 topic pages was 2026-11-05. We prefer the newest edition of each recurring report and replace figures when a new edition ships.
Can I use these statistics in an article or a deck?: Yes. Cite the original publisher for each number (each card has a ready-made citation) and link the Start with Identity page as the compilation. The compilation is CC BY 4.0 and downloadable as CSV or JSON.