Compromised non-human identities (NHIs), including AI agents, service accounts and API keys, are nearly twice as likely to provide the primary entry point into an organisation as phishing and social engineering, according to new research from SpyCloud.

The threat protection firm’s 2026 SpyCloud Identity Threat Report found that compromised NHIs accounted for 31% of primary intrusion entry points, compared with 17% for phishing and social engineering.

The findings are based on a survey of 750 cyber security leaders and practitioners at organisations with more than 500 employees across the US, Canada, the UK, Spain, Germany, the Netherlands, Austria and Switzerland.

Overall, 68% of organisations said they had experienced an identity-based event during the reporting period, with affected organisations averaging eight events each. NHI-related misuse was the most commonly reported type of identity-based incident, cited by 42% of respondents.

Despite the apparent scale of the risk, SpyCloud found a significant gap between organisations’ perceived visibility into machine identities and the extent to which they are actively monitoring them.

While 95% of respondents said they had adequate visibility into AI- and NHI-related exposures, just 36% said they monitored them, making machine identities the least-monitored category of identity risk covered by the report.

NHIs can include AI agents, service accounts, API keys and authentication tokens used to connect with internal systems and applications. SpyCloud said these identities can hold significant privileges but often lack the ownership and lifecycle management applied to human accounts.

Service accounts may not be properly offboarded, for example, while credentials may remain unchanged for extended periods, potentially leaving compromised access usable by attackers.

“That asymmetry is what attackers are exploiting,” said Trevor Hilligoss, SpyCloud’s chief intelligence officer.

“Every one of these identities is a standing invitation that renews itself until someone notices.”

AI adoption outpaces identity governance

The report also identified gaps between the adoption of AI systems and the controls organisations have introduced to manage their access.

Some 91% of respondents said their organisation uses AI tools or agents with access to internal systems, applications or data. However, only 56% said formal governance and ownership processes were in place for the privileges associated with them.

A further 41% relied on informal processes or partial ownership, potentially leaving privileged connections operating outside established governance and monitoring processes.

The research also pointed to the importance of visibility into stolen session cookies and authentication tokens.

Organisations able to identify stolen session cookies experienced identity-based events at a rate of 37%, compared with 50% among those without that visibility.

Session cookies and tokens can allow attackers to resume an already-authenticated session, potentially enabling access to applications and data without having to overcome authentication controls such as multi-factor authentication.

Phishing and social engineering nevertheless remain significant components of the identity threat landscape. Some 37% of respondents cited them as a common access path for identity-related events, while 40% reported incomplete visibility into successful phishing attacks.

Meanwhile, 53% said they were only able to see malware exposures affecting managed devices.

Supply chain identity risk was another area of concern. Malware-infected third-party devices were cited as the leading cause of supply chain identity events at 23%, followed by exposed API keys or application access involving vendors and partners at 22%.

Nearly 40% of organisations said they did not have a consistent process for confirming whether third-party identity exposures had been resolved.

This comes despite 32% of respondents identifying improved supply chain and vendor risk management as an investment priority for the next 12 to 18 months.

“Every control that works pushes attackers toward what it doesn’t cover – we hardened passwords, so they targeted sessions; we tightened employee accounts, so they looked to service accounts and vendor connections,” added Hilligoss. “SpyCloud continues to track threat actor behavior closely to understand where attackers are moving, what data they value, and how those patterns evolve over time.”

The report also found differences between organisations relying heavily on manual remediation and those using greater levels of automation.

Among respondents using manual, case-by-case remediation, 39% reported higher incident response costs, compared with 32% among organisations with high levels of automation. Loss of customer or partner trust was reported by 47% of organisations relying on manual approaches, compared with 36% among those with higher automation levels.

Recommended reading

• New Scottish Centre of Excellence For Digital Trust Launches
• How Important Are Digital Trust Frameworks to Firms?
• DIGIT Expo 2025 | Is Digital Consumer Trust on The Brink?

SpyCloud’s report introduces an Identity Threat Protection Maturity Model, grouping organisations into four tiers — Reactive, Building, Operational and Optimized — based on factors including identity exposure visibility, monitoring, governance, automation and remediation.

According to the company, more mature identity security programmes were more likely to combine continuous exposure monitoring with automated remediation.

“Most identity programs are still measured on whether an exposure happened. That’s the wrong scoreboard,” said Damon Fleury, Chief Product Officer at SpyCloud.

“Organizations that pair continuous identity monitoring with automated remediation of workforce exposures create the greatest friction for criminals and gain the biggest edge in preventing follow-on attacks.”