SpyCloud Report: 2/3 Orgs Extremely Concerned About Identity Attacks Yet Major Blind Spots Persist

According to SpyCloud, the 2025 Identity Threat Report found that while 86% of security leaders report confidence in preventing identity-based attacks, 85% of organisations were affected by a ransomware incident at least once in the past year, with over one-third affected between six and ten times.

The market survey of over 500 security leaders across North America and the UK revealed that over two-thirds of organisations are significantly or extremely concerned about identity-based cyberattacks, yet only 38% can detect historical identity exposures that create risk due to poor cyber hygiene like credential reuse. SpyCloud recaptured 63.8 billion distinct identity records from the darknet, a 24% year-over-year increase, illustrating the scale of exposed data organisations struggle to see and shut down.

Nearly 40% of organisations surveyed identified four or more identity-centric threats as “extreme” concerns, with phishing (40%), ransomware (37%), nation-state adversaries (36%), and unmanaged or unauthorized devices (36%) leading the list.

The report notes that insider threats often arise from identity compromise, with attackers assembling synthetic identities using phished cookies, malware-exfiltrated API keys, and reused credentials to pass background checks, underscoring the need to extend protection to the identity layer.