Cybersecurity statistics / Cost of Breach

Organizations with weak NHI management pay approximately $150,000 more to recover from incidents than average.

Publisher	Sophos
Report	The State of Identity Security 2026
Published	12 May 2026
Topics	Cost of Breach, Non-Human Identities

Published by Sophos in The State of Identity Security 2026, 12 May 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Related statistics

Mean recovery cost for identity-related incidents reached $1.64 million, with a median of $750,000, and 73% of affected organizations facing costs of $250,000 or more.

Sophos, 27/05/2026

Non-human identities outnumber human users in 83% of organizations.

JumpCloud Inc., 18/07/2026

Only 21% of organizations have implemented controls for non-human identities (NHIs).

JumpCloud Inc., 18/07/2026

Only 19% of organizations fully govern non-human identities.

Netwrix, 15/06/2026

76% of organizations do not fully govern or monitor non-human identities.

Netwrix, 15/06/2026

Organizations with weak NHI management are 22% more likely to experience financial theft.

Sophos, 27/05/2026

Get the newsletter

Weekly cybersecurity statistics by email.