Kristen Smith 
- The survey covered 750 cybersecurity leaders at organizations with 500 or more employees
- Compromised non-human identities were cited as the primary entry point
- Nearly all respondents use AI tools with internal access, but only 56 percent have formal governance for those privileges
Compromised non-human identities have become the most common route attackers take into enterprises, according to a SpyCloud survey of cybersecurity leaders.
Respondents cited compromised machine identities as the primary entry point at 31 percent, nearly twice the rate of phishing and social engineering at 17 percent. Non-human identity misuse was also the most frequently reported identity event type at 42 percent.
The Austin, Texas, company released the findings Wednesday in its annual Identity Threat Report, based on responses from 750 cybersecurity leaders and practitioners at organizations with 500 or more employees in North America and several European markets.
SpyCloud is a sponsor of the Potomac Officers Club’s 2026 Intel Summit, set for Sept. 24. Phil Fuster, the company’s vice president for government markets, will moderate the lunch panel, titled “Agentic AI and Quantum Risk: The Blast Radius Problem in Classified Environments.” The day will also feature an afternoon panel on cybersecurity in the age of agentic AI. Register now to hear from intelligence community leaders.
What Gap Did the SpyCloud Survey Identify?
While 95 percent of organizations said they have adequate visibility into AI and machine identity exposures, only 36 percent monitor them. That makes machine identities the least-watched category of identity risk in the survey.
SpyCloud defines non-human identities as the AI agents, service accounts, API keys and authentication tokens that connect to internal systems. An exposed service account can remain usable for months, according to SpyCloud, because the routines that catch compromised employees — offboarding, forced credential rotation, multifactor prompts — do not apply to it.
Trevor Hilligoss, chief intelligence officer at SpyCloud, said each of those identities amounts to a “standing invitation that renews itself until someone notices.”
What Did the Report Find on AI Governance?
Only a little more than half of respondents — 56 percent — said they have assigned ownership and formal rules governing what their AI tools are permitted to access, even though 91 percent run AI tools or agents with access to internal systems, applications or data.
A further 41 percent operate with partial ownership or informal arrangements. SpyCloud said those privileged connections end up outside the reach of standard oversight.
Identity-based events hit 68 percent of respondents.
What Did the Report Say About Session Data and Supply Chains?
Visibility into stolen session cookies tracked with fewer incidents. Respondents with visibility reported identity-based events at 37 percent, compared with 50 percent among those without it.
Stolen cookies and tokens hand an attacker a live session, sidestepping multifactor authentication entirely rather than defeating it. SpyCloud said that data now attracts more attacker interest than passwords and accounts.
Vendor-related exposures showed a similar pattern. Malware on third-party devices drove 23 percent of supply chain identity events and exposed API keys or vendor application access accounted for another 22 percent. Nearly 40 percent of respondents said they have no reliable way to verify that a third-party exposure was truly resolved.
What Is SpyCloud’s Maturity Model?
SpyCloud introduced an Identity Threat Protection Maturity Model alongside the report, scoring identity programs across five dimensions: exposure visibility, monitoring, governance, automation and remediation. Respondents land in one of four tiers, from reactive at the bottom to optimized at the top.
Continuous monitoring and automated remediation appear more often in the top tiers, according to SpyCloud, noting that the combination resulted in lower incident rates.
