Reports
Independent, sourced analysis of where identity security stands. Every figure is attributed to a primary source. Free to read and cite with attribution, no email required and no sponsorship.
123 identity breaches from January 2021 to November 2026, classified by initial access, MFA status, failed control, actor and blast radius
In 2025-2026, 13 of the 34 breaches on human accounts in Start with Identity's Identity Breach Database (38.2%) began with social engineering of a person, up from 7 of 30 (23.3%) in 2023-2024, while stolen, stuffed or sprayed passwords fell from 16 of 30 (53.3%) to 7 of 34 (20.6%).
101 identity-security funding rounds from January 2025 to October 2026, every amount classified as disclosed, reported or undisclosed, with stage benchmarks and the companies sold after they raised
SWI recorded 99 identity-security equity rounds announced from January 1, 2025 to October 31, 2026, with $4.24 billion in priced capital across the 89 that carry an amount: $2.18 billion in 2025 (60 rounds) and $2.07 billion in 2026 to October 31 (39 rounds).
Which of 95 business SaaS apps support passkeys and security keys, which let admins require them, and what SSO costs
Of 95 widely used business SaaS apps, 51 (53.7%) document passkeys or FIDO2 security keys on their own login, but only 12 (12.6%) let an admin require them; 31 of the 51 (60.8%) leave the phishing-resistant factor optional, per vendor documentation checked October 31, 2026.
What is specified, what is drafted, and what is still missing for AI agent authentication, delegation and authorization
Of 11 agent identity problems mapped, 7 are covered by a published standard today, 3 only by working-group drafts, and 1 (an agent lifecycle registry that ties each agent to an accountable owner) has no working-group draft at all.
65 identity acquisitions, every price classified as disclosed, reported or undisclosed, and an independence rate for 17 vendor categories
SWI's record holds 65 identity-market acquisitions, and 35 of the 56 announced since January 2023 came in 2025 and 2026 alone (19 in 2025, 16 in 2026 to October 31).
Which identity vendors publish a price, which make you ask, and how to get a real number from the ones that hide it
Only 28% of the 295 identity vendors in SWI's directory still on sale (82 vendors) publish a price for any paid tier, and 54% (158) are quote-only, in SWI's snapshot of October 30, 2026, updated November 5, 2026.
137 identity CVEs, checked against CISA KEV and NVD: which products get exploited, which bug classes, and how fast
39% of the identity CVEs in Start with Identity's catalog (53 of 137) are on CISA's Known Exploited Vulnerabilities list, against 0.37% of all CVEs published from 2022 to 2026.
Where identity security actually stands, in the numbers, and what to do about it
Credentials remain the dominant attack path: 22% of breaches start with stolen credentials and 88% of web-app attacks use them.