Skip to main content

Press release · September 9, 2026 · globenewswire.com

SpyCloud Identity Threat Report Finds 36% Monitor AI and Non-Human Identity Exposures

Summary

SpyCloud released its 2026 Identity Threat Report based on a survey of 750 cybersecurity leaders and practitioners, addressing how organizations monitor and govern identity exposures tied to AI and non-human identities.

The report said 95% of organizations believe they have visibility into AI- and non-human identity exposures, but only 36% monitor them. It also reported that 68% of organizations experienced an identity-based event in the same period, with those affected averaging eight events.

SpyCloud’s survey highlighted non-human identities, including AI agents, service accounts, API keys, and authentication tokens, as a common entry path for attackers. It reported compromised non-human identities at 31% versus phishing and social engineering at 17%, and it cited non-human identity-related misuse as 42% of reported identity-based event types. It also described service accounts not being off-boarded, rotating credentials, or failing MFA as reasons such exposures can remain usable for months.

In the report’s additional findings, SpyCloud said nearly all organizations (91%) use AI tools or agents with access to internal systems, applications, or data, while 56% have formal governance and ownership for resulting privileges. It also introduced an Identity Threat Protection Maturity Model with four maturity tiers—Reactive, Building, Operational, and Optimized—covering visibility, monitoring, governance, automation, and remediation. “That asymmetry is what attackers are exploiting,” said Trevor Hilligoss, SpyCloud's Chief Intelligence Officer. “Every one of these identities is a standing invitation that renews itself until someone notices.”

Our summary. The original keeps its own byline.

Read the original on globenewswire.com

Companies in this article

Topics

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "legalName": "Wiretap Labs, LLC",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/spycloud-identity-threat-report-finds-36-monitor-ai-and-non-human-identity-exposures/",
        "name": "SpyCloud Identity Threat Report Finds 36% Monitor AI and Non-Human Identity Exposures",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/spycloud-identity-threat-report-finds-36-monitor-ai-and-non-human-identity-exposures/#blogposting",
    "@type": "NewsArticle",
    "about": {
      "@id": "https://decisioninsights.ai/registry/spycloud/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/spycloud/",
      "name": "SpyCloud"
    },
    "articleSection": [
      "Cybersecurity"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Director"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Chief Information Security Officer"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Practitioner"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Decision Maker / Budget Holder"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Operational Expansion"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Information Technology / Cybersecurity / Identity Security / Identity & Access Management (Workforce IAM/SSO/MFA)"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-signals/#person",
      "@type": "Person",
      "name": "Decision Insights Record",
      "url": "https://decisioninsights.ai/author/decision-insights-signals/"
    },
    "dateModified": "2026-09-09T06:42:17-06:00",
    "datePublished": "2026-09-09T06:42:13-06:00",
    "description": "SpyCloud’s 2026 Identity Threat Report finds 95% of organizations have AI and non-human identity visibility, but only 36% monitor exposures.",
    "headline": "SpyCloud Identity Threat Report Finds 36% Monitor AI and Non-Human Identity Exposures",
    "isBasedOn": {
      "@type": "CreativeWork",
      "sourceOrganization": {
        "@type": "Organization",
        "name": "GlobeNewswire"
      },
      "url": "https://www.globenewswire.com/news-release/2026/09/09/3358565/0/en/spycloud-2026-identity-threat-report-finds-non-human-identities-are-now-the-leading-path-into-the-enterprise.html"
    },
    "keywords": [
      "IT Governance",
      "non-human identity",
      "Threats",
      "Visibility"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/spycloud-identity-threat-report-finds-36-monitor-ai-and-non-human-identity-exposures/",
      "@type": "WebPage",
      "sdDatePublished": "2026-09-09",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/spycloud/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/spycloud/",
        "name": "SpyCloud"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-signals/#person",
    "@type": "Person",
    "description": "Press releases and independent analyst research, structured into concise summaries for research and monitoring. Produced under our Standards & Methodology.",
    "name": "Decision Insights Record",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-signals/"
  }
]

Is this your company? Get structured data for your own pages