Identity research & data

Errors, social engineering, phishing, and misuse were present in 62% of breaches, up slightly from 60%, across more than 22,000 confirmed breaches in 145 countries.

Credential abuse fell from 22% to 13% as an initial access vector in the 2026 DBIR, partly because Pretexting is now tracked separately (16% on the old basis). Counted at any point in the breach, credential abuse still leads at 39%.

Within basic web application breaches, the overwhelming majority were carried out with stolen credentials rather than exploits.

Breaches with third-party involvement grew 60% year over year, reaching 48% of all breaches and underscoring supply-chain risk.

Phishing held at 16% of breaches for a second year, while mobile-centric lures such as voice and text drew 40% higher click rates than email in simulations.

More than 97% of identity attacks observed by Microsoft target passwords; identity-based attacks surged 32% in the first half of 2025.

Microsoft reports phishing-resistant MFA stops over 99% of identity attacks, even when the adversary already holds valid credentials.

FIDO Alliance said over 15 billion user accounts are equipped with the option to sign in with a passkey when it launched the Passkey Pledge in April 2025.

FIDO's 2026 Passkey Index, drawn from 15 major consumer services, found passkey sign-ins succeed more often and are nearly three times faster than passwords and traditional MFA such as SMS OTP.

FIDO estimated 7 billion passkeys in use in October 2026, up from 5 billion on World Passkey Day in May, and more than a third of successful sign-ins now use one.

Up from 26% in 2025, across 15 consumer services in FIDO's Passkey Index 2026; the share includes re-authentication and excludes account recovery, and FIDO calls year-on-year comparisons directional.

Awareness rose significantly year over year, per the FIDO Alliance State of Passkeys 2026 research; 75% have enabled a passkey on at least one account.

Workforce passwordless is moving from pilot to rollout, though account recovery and legacy systems remain the hard part.

Amazon says more than 500 million customers have enabled passkeys, a single-retailer datapoint on consumer-scale adoption.

Ransomware was present in 48% of breaches, up from 44% the prior year, even as 69% of victims declined to pay.

Flashpoint recorded 1.7 billion credentials stolen by infostealer malware from 7.4 million infected hosts and devices between January and June 2026.

Recorded Future found 276 million of 892 million malware-sourced credentials came with active session cookies, letting attackers hijack sessions and bypass MFA.

GitGuardian detected 28.65 million new hardcoded secrets in public GitHub commits in 2025, a 34% year-over-year increase and the largest single-year jump it has recorded.

Retesting credentials first confirmed valid in 2022, GitGuardian found more than 64% still worked in January 2026, down from nearly 70% a year earlier.

Machine identities, including AI agents, now outnumber humans 109 to 1, a ratio that includes 79 AI agent identities per human, per a survey of 2,930 security leaders.

CyberArk found 68% of organizations have no identity security controls for AI, even as AI creates the most new privileged identities.

IBM's global average breach cost rose 12% to a record $4.99M, driven largely by detection, escalation, and lost business costs.

IBM reports a 247-day mean time to identify and contain a breach in its 2026 Cost of a Data Breach research.