12% of organizations maintain direct user-to-server administrative pathways, meaning a single compromised employee device can provide immediate access to high-value systems.

On average, only 39% of privileged access is managed through a just-in-time (JIT) or zero standing privilege (ZSP) model.

72% of organizations do not detect credential misuse in real time, often taking hours or sometimes days or weeks to identify unauthorized privileged access.

46% of cybersecurity professionals report that AI-powered tools have access to critical systems and data.

76% of cybersecurity professionals say non-human identities are not consistently governed under privileged access policies.

88% of organizations are concerned about autonomous AI agents operating as non-human insiders with privileged access.

54% of U.S. organizations uncover unmanaged privileged accounts and secrets every week.

Only 1% of U.S. organizations have fully implemented a modern Just-in-Time (JIT) privileged access model.

66% of U.S. organizations say traditional privileged access reviews delay projects.

63% of U.S. organizations admit employees bypass controls to move faster.

91% of U.S. organizations report that at least half of their privileged access is always-on, providing unrestricted access to sensitive systems.

13% of organisations audit privileged access only once a year or less

Nearly half (42%) of machine identities have sensitive or privileged access.

88% of respondents say that, in their organization, the definition of a ‘privileged user’ applies solely to human identities.