SpyCloud’s 2026 Identity Threat Report is based on a survey of more than 750 security professionals. It calls non-human identities, including API keys, tokens, and service accounts, the leading route for initial access.

The report calls NHI misuse or compromise the most common identity-based event type at 42%. It says 50% of affected organizations cited exposed, compromised, or overprivileged NHIs as a common access path.

AI tools or agents with internal access are used by 91% of organizations, but only 56% have formal governance and an assigned owner for AI- and NHI-related privileges.

Claim check:

  • SpyCloud’s 2026 report is based on a survey of more than 750 security professionals. (confirmed by the publication itself: evidence; «This report is based on a survey of 750 cybersecurity decision-makers and practitioners conducted in June 2026 .»)
  • The report calls non-human identities, including API keys, tokens, and service accounts, the leading route for initial access. (confirmed by the publication itself: evidence; «Non-human identities (NHIs) are now the leading route for initial access»)
  • The report names NHI misuse or compromise as the most common identity-based event type at 42%. (confirmed by the publication itself: evidence; «NHI-related misuse or compromise was the top reported identity-based event type (42%)»)
  • 50% of affected organizations cited exposed, compromised, or overprivileged NHIs as a common access path. (confirmed by the publication itself: evidence; «50% of affected organizations cited exposed, compromised, or overprivileged NHIs, including API keys, tokens, and service accounts, as common access paths»)
  • 91% of organizations use AI tools or agents with internal access, but only 56% have formal governance and an assigned owner for AI- and NHI-related privileges. (confirmed by the publication itself: evidence; «91% of organizations use AI tools or agents with internal access, but only 56% have formal governance and ownership for AI- and NHI-related privileges.»)

Publications:

Primary sources:

score 70.6 · kind research · revision 1 · stories st-am9pjc