54% of organizations prioritize fine-grained authorization when evaluating identity infrastructure.

32% of organizations prioritize tenant isolation when evaluating identity infrastructure.

11% of organizations rank total cost of ownership last among identity infrastructure evaluation criteria.

17% of organizations that rate themselves "not so confident" in their AI security posture have experienced a confirmed AI identity incident.

96% of companies running AI in production, using AI broadly, and operating on multi-tenant SaaS identity infrastructure face shadow AI challenges.

25.6% of identity crime victims managed two or more concurrent incidents, up from 23.5% the previous year.

62.1% of attempted misuse cases involved new account applications, and 37.9 percent involved attempted account takeovers.

By account type, credit cards accounted for 41% of all attempted misuse, checking accounts account for 17.7%, and personal loans account for 8.5%.

Unauthorized access to computers and mobile devices accounted for 27.2% of identity compromises, a 78% increase from 15.3% the previous year.

Scams involving the sharing of personal information accounted for 36.1% of identity compromises, down from 43.1% the previous year.

AI security and risk management capability gaps affect 61% of organizations globally.

One in five phishing links clicked by users went completely undetected by legacy URL filtering.

84% of adults aged 18+ in the United States, UK, Austria, Germany, and Switzerland say convincing video evidence no longer feels like proof.

68% of developers say it is extremely important to have a clear, automated system for tracking AI-generated code and measuring its impact for debugging, security, and accountability.

51% of development teams experience bottlenecks in security testing related to AI-generated code.

43% of internal authentication traffic still relies on NTLM, a legacy protocol frequently abused for credential replay and privilege escalation attacks.

12% of organizations maintain direct user-to-server administrative pathways, meaning a single compromised employee device can provide immediate access to high-value systems.

Roughly 80% of enterprises have deployed internal AI agents while two-thirds lack governance policies for those agents.

53% of development teams have grown total code volume by over 25%.

78% of organizations report more incidents after deploying AI-generated code in the past 12 months.