Identity deserves executive attention, but survey results should not be presented as a universal breach rate. Sophos reports that 71% of respondents in a Q1 2026 survey said their organization suffered at least one identity-related breach in the prior year.
Current as of 2026-08-15
Sophos’s survey announcement says the study surveyed 5,000 IT and cybersecurity leaders in 17 countries at organizations with 100 to 5,000 employees. That sampling frame must stay attached to the 71% result.
Decision summary
- Treat 71% as a vendor-survey result, not a measured rate for every organization.
- Protect users, service accounts, applications, sessions, and recovery identities together.
- Prioritize phishing-resistant MFA and least privilege.
- Test session revocation and identity recovery before an incident.
Read the number in context
The survey captures respondent reports from a defined population and period. It can inform risk discussion, but it does not prove that 71% of all organizations worldwide were independently verified as breached. Keep the methodology and vendor source visible.
Secure the full identity lifecycle
- Joiner, mover, and leaver controls for human accounts.
- Unique service and workload identities with scoped permissions.
- Application consent and OAuth review.
- Privileged-role activation, approval, and monitoring.
- Protected emergency access and recovery methods.
Reduce phishing and token risk
CISA’s MFA guidance recommends aiming for phishing-resistant MFA. Also monitor sign-in risk, consent grants, session reuse, mailbox rules, and changes to authentication methods.
Build a 90-day sequence
- Inventory identities, applications, privileged roles, and weak authentication.
- Protect administrators and high-risk users first.
- Remove stale access and constrain service accounts.
- Centralize identity and endpoint telemetry.
- Exercise compromise, revocation, recovery, and evidence collection.
Next step for your environment
Measure your own control coverage instead of substituting a market survey for environment evidence. If you need a documented baseline before changing production systems, start with an ITECS technology and security assessment.
Record the current baseline, accountable owner, source date, acceptance evidence, exceptions, and review trigger. Recheck assumptions before every consequential change, preserve rollback instructions, and close the work only when the intended result and unintended effects have been verified in the real environment. Keep the decision record with the system documentation so the next review starts from evidence rather than memory.
Sources and update trigger
- Sophos — State of Identity Security 2026 survey announcement
- CISA — Require multifactor authentication
Review trigger: Recheck when Sophos releases a new methodology or CISA changes identity guidance.
continue reading
More ITECS blog articles
About ITECS Team
The ITECS team consists of experienced IT professionals dedicated to delivering enterprise-grade technology solutions and insights to businesses in Dallas and beyond.
View full profile and articles