2025 Identity Security Landscape

Welcome to the 2025 Identity Security Landscape! This study wouldn’t be possible without the generous insights from our 2,600 security decision-makers across 20 countries around the globe—a big thank you to our contributors and researchers. If you scrolled here for the first time, welcome. This report specifically examines cyberattack trends impacting identity across modern IT ecosystems and shares insights on how security professionals can and should prepare.

Our returning readers are well aware that AI is arming both sides of the security battle, helping attackers and defenders alike. But what’s more interesting this year is how the race to adopt AI has inadvertently expanded the attack surface with a surge of machine identities. Welcome to the third dimension of AI: attackers use it to create new threats; defenders use it to defend against them—and businesses incur new identity-centric risks as they embed agentic AI across the enterprise.

On one hand, we’re seeing the most relentless and sophisticated cyberattacks of the modern age, with 9 out of 10 organizations reporting a successful identity-centric breach. Over half (51%) fell victim to phishing and vishing attacks multiple times. At the same time, respondents tell us sanctioned and unsanctioned adoption of AI is adding to cybersecurity risks. Organizations now report that 72% of employees regularly use AI tools on the job—yet 68% of organizations still lack identity security controls for these technologies. Machine identities now outnumber human identities by more than 80 to 1. Some would call this “unprecedented”— we prefer overachiever in the field of firsts.