A new report from RSA, the 2026 IDIQ (Identity IQ) Report, paints a stark picture of the modern threat landscape, revealing that identity-related breaches are surging while progress toward passwordless authentication has stalled. The findings, based on a global survey of over 2,100 cybersecurity and IT experts, underscore a critical disconnect between rising threats and defensive postures.
According to the report, 69 percent of organizations experienced an identity-related breach within the past three years, marking a dramatic 27-percentage-point increase from the previous year. This trend was even more pronounced in Germany, where 75 percent of firms reported such a breach. The financial consequences of these failures are mounting significantly. Nearly half (45 percent) of respondents stated their last identity breach cost more than the industry average, with 24 percent— nearly one in four— reporting losses exceeding $10 million.
The report identified a new, top-of-mind threat: the social engineering of IT service desks. A significant majority of respondents (65 percent) expressed serious concern that their IT support staff would fall victim to an MFA bypass or social engineering attack, and 51 percent ranked this specific vector as their single greatest identity risk. The concern follows high-profile breaches at MGM Resorts, Caesars Entertainment Group, and Marks & Spencer that originated at organizations’ IT help desks.
Despite these threats, organizations are struggling to eliminate the root cause of many attacks: passwords. The report found that passwordless adoption is stalling, with 90 percent of organizations reporting significant obstacles in their transition. These challenges include mixed hybrid environments, concerns about a poor user experience, and gaps in native platform support. As a result, 57 percent of users still rely on passwords as their primary method for logging in.
On a more optimistic note, the vast majority of CISOs (83 percent) believe AI will ultimately provide more benefits to cyber defense than to offense. In response, 91 percent of all respondents plan to deploy AI-driven security tools within the current year, marking a 12-percentage-point increase year-over-year, indicating a strong organizational commitment to leveraging new technology to combat the escalating identity crisis.
“The 2026 RSA ID IQ Report underscores that identity simply fails too many organizations too often,” said RSA CEO Greg Nelson. “The likelihood of a breach – and the cost of inaction – are too high for leaders to tolerate the status quo.”
Sources: RSA, RSA Press Release, TechNewsWorld.
—
By the ID Tech Editorial Team
