Identity failures are increasingly costly and widespread, revealing a gap between perceived maturity and real-world outcomes, according to RSA’s 2026 ID IQ Report. Based on 2,120 responses across seven countries and sectors, 69 percent of organizations reported an identity-related breach over the past three years, up 27 points compared to last year. Nearly one in four said a breach cost more than ten million dollars, and 70 percent rated the impact as severe.
Breach prevalence varies by sector and country. Automotive leads with 80 percent, followed by finance, energy and utilities, and technology (71 to 72 percent). Retail and manufacturing fall to 64 and 62 percent. Nationally, Australia reported 92 percent, Germany 75 percent, the United Kingdom 71 percent, the United States 69 percent, and Japan and Canada at 56 and 55 percent respectively.
Many organizations express confidence in Zero Trust identity strategies, but outcomes indicate overconfidence. While a majority self-classify as “Advanced,” only 7 percent satisfy CISA’s optimal maturity benchmarks. Breach outcomes suggest that implementation progress continues to lag behind stated confidence levels, consistent with findings discussed in Zero Trust adoption gap research.
Help desk social engineering aimed at bypassing multi-factor authentication remains a key threat. Fifty-one percent of respondents identified IT or service desk impersonation as their most significant identity risk. The report highlights limited adoption of modern assurance methods such as bi-directional verification and risk-based controls, while older techniques, including passwords, one-time codes, and shared secrets, remain prevalent. The trend parallels the rise of authentication-in-the-middle attacks, where adversaries exploit MFA relay tools to compromise credentials.
The transition to passwordless authentication remains uneven. Ninety percent of organizations cite difficulties with adoption, and 57 percent continue to use passwords as their primary authentication method. RSA’s data links higher passwordless adoption with lower breach frequency and impact. Japan, which reports higher passwordless usage, also shows lower breach rates. Australia, with lower adoption, reports heavier losses. The report notes that hybrid IT estates, spanning Microsoft and non-Microsoft systems, legacy applications, air-gapped networks, and varied user groups, complicate rollout, a challenge seen in enterprise passkey deployments using Microsoft Entra.
Artificial intelligence is becoming a central element of defense. Eighty-three percent of respondents believe AI will help defenders more than attackers, and 91 percent plan to integrate AI into their security stacks within a year. Among the most prioritized capabilities are “agentic AI for security” and identity security posture management, both designed to convert entitlement and machine-identity telemetry into actionable risk reduction. These developments reflect the acceleration seen across AI-driven identity security posture management initiatives.
RSA’s recommendations include phishing-resistant passwordless authentication, bi-directional identity proofing for help desk workflows, comprehensive coverage across hybrid estates, and deployment of identity security posture management to prioritize fixes. The data suggests that identity programs classified as “Advanced” but still facing frequent, severe incidents will achieve the next gains by removing shared-secret logins, closing help desk MFA bypass paths, and applying AI-driven decisioning at scale.
–
By Cass Kennedy
