30
SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise
SpyCloud survey of 750 security leaders finds compromised non-human identities are the top enterprise entry point, yet only 36% monitor them.
The 2026 Identity Threat Report surveyed 750 cybersecurity leaders at organizations with 500+ employees across North America and Europe. Compromised non-human identities (31%) were the most cited primary attacker entry point, nearly double phishing (17%), while only 36% of organizations monitor AI agents, service accounts and API keys. 68% of respondents reported identity-based events, averaging eight each, and 91% use AI tools but only 56% have formal governance over their privileges.
32
SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise
SpyCloud's 2026 survey of 750 security leaders finds compromised non-human identities are the top enterprise entry point, yet only 36% monitor them.
SpyCloud's Identity Threat Report, based on a survey of 750 cybersecurity leaders at organizations with 500+ employees, found compromised non-human identities (31%) were nearly twice as likely as phishing (17%) to be the primary attacker entry point. 68% of organizations reported identity-based events averaging eight each, while 95% believe they have visibility into AI and NHI exposures but only 36% actually monitor them. The report also found 91% use AI tools with internal access but only 56% have formal governance, and introduces an Identity Threat Protection Maturity Model.
30
Recorded Future Launches Digital Risk Protection, Unifying Brand and Identity Monitoring
Recorded Future launched Digital Risk Protection, unifying brand and identity monitoring across five external threat surfaces in one workflow.
Recorded Future announced Digital Risk Protection, combining brand threat monitoring and identity exposure monitoring across five use cases: malicious site, impersonation, code repository, dark web brand, and identity exposure monitoring. The platform includes an AI Triage Agent that automates alert evaluation with explicit verdicts and context, expanding social media analysis, OCR, full Telegram coverage, and infostealer log ingestion. Gartner's 2026 Magic Quadrant folded digital risk protection into cyber threat intelligence technologies, and the launch cites $15.9 billion in 2025 US fraud/scam losses, up 28% year over year.
52
55
60
60
55
60
Patch Tuesday to Pentest Wednesday: How an Equipment Rental Company Is Turning Continuous Testing Into Continuous Exposure Management
An equipment rental company uses Horizon3 NodeZero for continuous exposure management, surfacing an SSH key exposure in eight hours versus annual pentesting.
The company moved from periodic penetration testing to continuous exposure management using the NodeZero Proactive Security Platform, feeding telemetry into a Splunk-based CTEM pipeline via Horizon3 APIs. NodeZero exposed SSH RSA key pairs from a PHP web server change about eight hours after introduction and found more findings in 12 hours than a third-party engagement found in roughly 30 days. An Active Directory password audit of 15,000 passwords found about 300 identical or similar compromised passwords, driving a banned-password list, 12-character minimums, service desk changes, and self-service reset rollout; users with similar passwords later dropped from 880 to 209. NodeZero also validated a suspected Cisco vulnerability as exploitable.
15
42
55
60
CBTS brings continuous penetration testing to enterprise security
CBTS launched Penetration Testing as a Service built on Horizon3.ai's NodeZero, combining autonomous pentesting with expert review for continuous validation.
CBTS announced PTaaS, a service that runs recurring autonomous penetration tests powered by Horizon3.ai's NodeZero across cloud, SaaS, identity, and AI environments, with CBTS experts reviewing findings for exploitability and remediation guidance. The service supports daily-to-quarterly cadences and aims to support Continuous Threat Exposure Management (CTEM) programs. It cites Verizon's 2026 DBIR finding that re-exploitation likelihood drops roughly 30 days after last observed exploitation.
27
30
60
55
60
55
30
30
42
30
42
55
57
60
55
45
57
60
NHIs Now the Number One Corporate Entry Point for Hackers
SpyCloud survey finds non-human identities like AI agents and API keys were the primary entry point in 31% of intrusions, nearly double phishing.
SpyCloud's Identity Threat Report, based on a survey of 750 security leaders at organizations with 500+ employees, found non-human identities caused 31% of intrusions versus 17% for social engineering. Only 36% of organizations actually monitor NHIs although 95% believe they have adequate visibility into them. Some 68% of respondents suffered an identity-based event, with NHI-related misuse at 42%, and organizations able to see stolen session cookies reported identity incidents at a lower rate (37% vs 50%).
40
42
57
30
42
55
30
60
30