News Summary

91% of IT and security leaders surveyed experienced workforce identity fraud or a near miss in the past two years, highlighting the rising impact of employee identity fraud and insider risk.
96% of organizations consider insider risk a significant concern, reflecting its evolution from a niche security issue to a boardroom-level priority.
Attackers are targeting employee identities through phishing and social engineering (46%) and compromised credentials (43%) to gain trusted access.
Entrust report exposes a growing workforce identity crisis and the need for modern fraud prevention approaches as AI-driven fraud increases and non-human identities reshape the workforce.

Entrust, a global leader in identity-centric security solutions, today released the findings from The KYE & Workforce Identity Crisis Report. The research found that nine out of 10 (91%) organizations have experienced a workforce identity incident or near miss in the past two years, while almost all respondents (96%) now consider insider risk a significant threat. The findings suggest workforce identity risk has become a mainstream security challenge as attackers increasingly target employee identities to gain trusted access.

This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20261014874684/en/

Identity-Related Threats That Concern IT and Security Leaders Most

Entrust commissioned a survey of more than 1,000 IT and security leaders in the U.S. and UK to understand the growing workforce identity challenge in the era of AI-driven fraud and how organizations are approaching workforce identity verification and authentication. Social engineering, credential compromise, privileged access misuse, employee impersonation, onboarding fraud, and candidate fraud are putting workforce identity controls under pressure, driving organizations to adopt Know Your Employee (KYE) principles as part of their security strategies.

“The voices of IT and security leaders in this survey make it clear why workforce identity is now a boardroom-level security conversation,” said Adam Dimopoulos, Chief Information Security Officer at Entrust. “Organizations have long understood the risks of identity-based attacks, but AI is accelerating the scale and sophistication of these threats while employee verification and access management have not kept pace. As enterprises deploy agentic AI in their environments, they introduce non-human identities that require the same level of trust and protection as human users. Organizations will need identity and authentication frameworks that ensure human and non-human access is verified, authorized, and governed.”

Other key findings from The KYE & Workforce Identity Crisis Report include:

Candidate fraud is infiltrating the hiring pipeline: The hiring process has become a target for corporate espionage and fraud, as over a quarter of respondents (28%) report that they have experienced or investigated candidate fraud in the past 12-24 months. Nearly one-third (30%) of IT and security leaders report that they are concerned about identity fraud involving fraudulent new hires.
Phishing and credential compromise are the biggest workforce identity concerns, yet passwords remain the primary defense: Phishing and social engineering (46%) and compromised credentials (43%) were the most cited workforce identity threats. Yet usernames and passwords were the leading primary authentication method their organization relies on (45%). Other threats included privileged access misuse (34%), employee account takeover or impersonation (33%), negligent employee security behavior (32%), and malicious insider activity (32%).
KYE is gaining ground, but less than half are confident they can verify employee identity: Nearly 3 in 5 (59%) say KYE programs are now a core part of their identity strategy. Even so, fewer than half are very confident they can reliably verify identity during everyday access to systems and data (46%), employee onboarding (43%), or first login and device enrollment (42%). Confidence is lowest for verifying contractor and temporary access (31%).
AI-enabled impersonation is outpacing measurement, creating a critical identity security gap: More than half of respondents (54%) measure AI-driven impersonation, such as deepfakes and synthetic identities, in some way, while 46% do not currently measure it at all. The number of organizations that measure and regularly report these attacks drops to 28% for fully remote organizations, compared with 40% of hybrid organizations, and 39% of in-office organizations.
Ownership is concentrated but not fully settled: 45% of respondents say the CISO or security team has primary responsibility for workforce identity security. Others point to the IT team (22%), Chief Information Officer (20%), Chief Human Resources Officer or HR team (8%), while 4% say that there is no single owner. Fragmented ownership can complicate coordination across the security, IT, and HR teams responsible for workforce identity.

“For years, organizations have been verifying credentials, devices, and access rights, but many still struggle to verify the person behind them,” added Dimopoulos. “Know Your Employee, or KYE, is about establishing confidence that employees, contractors, and partners are who they claim to be throughout their workforce lifecycle. As identity-based attacks continue to rise, KYE is a strong framework for strengthening trust at critical moments such as onboarding, account recovery, privileged access requests, and remote work.”

Download The KYE & Workforce Identity Crisis Report for further research findings and to learn more about insider risks and how organizations are establishing confidence in workforce identity assurance. Learn more about KYE here.

Methodology

The research was conducted by Censuswide among a sample of 1,002 UK and U.S. senior IT and security decision-makers at medium-to-large-sized enterprises (500+ employees) with an annual revenue of $50 million+ (min. 50 CISOs per market), aged 25+. Respondents: UK – 500; U.S. – 502. The data was collected between August 6, 2026, and August 13, 2026. Censuswide is a member of the Market Research Society (MRS) and the British Polling Council (BPC), and a signatory of the Global Data Quality Pledge. We adhere to the MRS Code of Conduct and ESOMAR principles.

About Entrust

Entrust fights fraud and cyber threats with identity-centric security that protects people, devices, and data. Our comprehensive solutions help organizations secure every step of the identity lifecycle, from verifying identity at onboarding to securing connections and fighting fraud in everyday transactions. Ongoing monitoring supports compliance and safeguards keys, secrets, and certificates. With a foundation of identity-centric security, our customers can transact and grow with confidence. Entrust has a global partner network and supports customers in over 150 countries. Learn more at entrust.com.

View source version on businesswire.com: https://www.businesswire.com/news/home/20261014874684/en/

ken.kadet@entrust.com

Logo

Images

Tags

More Like This

Deepfakes, Social Engineering, and Injection Attacks on the Rise: Entrust 2026 Identity Fraud Report Reveals Surging Attacks and Diversifying Tactics

Deepfake Attacks Strike Every Five Minutes Amid 244% Surge in Digital Document Forgeries

Identity Fraud Costs Organizations an Average of $7 Million Annually, Says New Research From Docusign and Entrust

IBM Report: Identity Comes Under Attack, Straining Enterprises' Recovery Time from Breaches

Entrust and Mastercard Transform Account Onboarding With Intelligent Fraud Defense

UK Reports Worse Data Breaches and Greater Concern for IT Help Desk Risk: RSA ID IQ Report Unveils Top Identity Threats

Entrust Named in the 2025 Gartner® Magic Quadrant™ for Access Management

Entrust Receives “Midsize US Investment in the UK” Award at 2025 Transatlantic Growth Awards