57.87% of organizations have IAM users without MFA.

Publisher	Orca Security
Report	2026 State of Application Security Report
Published	7 April 2026
Topics	IAM , Access Control, Authentication, MFA

Published by Orca Security in 2026 State of Application Security Report , 7 April 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Compare this across sources

3 sources answer what share of organisations have deployed multi-factor authentication. They report between 40% and 66%, with a median of 60%.

See all 3 sources

Related statistics

In 2025, nearly a third of MFA spray attacks targeted identity and access management (IAM) applications.

Cisco Talos, 27/05/2026

19% find it difficult to revoke access when needed.

Wire, 12/07/2026

30% of quick service and fast casual restaurant chains had internal system credentials leaked in the past 12 months.

VikingCloud, 12/07/2026

12% of organizations maintain direct user-to-server administrative pathways, meaning a single compromised employee device can provide immediate access to high-value systems.

Zero Networks, 15/06/2026

24% of organizations say they have no AI-specific access controls

Check Point, 31/05/2026

16% of organizations enforce AI access controls consistently across the environment

Check Point, 31/05/2026

Get the newsletter

Weekly cybersecurity statistics by email.