SpyCloud Report: 2/3 Orgs Extremely Concerned About Identity Attacks Yet Major Blind Spots Persist

According to SpyCloud, the 2025 Identity Threat Report reveals a dangerous disconnect between perceived security readiness and actual exposure, with 86% of security leaders confident in preventing identity-based attacks yet 85% of organisations affected by ransomware at least once in the past year.

The survey of over 500 security leaders across North America and the UK found that over two-thirds are significantly or extremely concerned about identity-based cyberattacks, while only 38% can detect historical identity exposures caused by poor cyber hygiene like credential reuse. The report highlights expanding identity sprawl and notes SpyCloud has recaptured 63.8 billion distinct identity records from the dark web, a 24% year-over-year increase.

Phishing was cited as the leading entry point for ransomware in 2025, accounting for 35% of incidents, with insider threats often tracing back to identity compromise, including cases involving North Korean IT operatives. Defences fall short in responding to identity-based threats, with 57% lacking strong capabilities to invalidate exposed sessions, about two-thirds lacking repeatable remediation workflows or formal investigation protocols, and less than 20% able to automate identity remediation across systems.