Mid-sized firms hit hardest by unauthorised data access

Netwrix has published research showing that 40% of organisations with 500 to 999 employees reported unauthorised access to sensitive data in the past year, the highest rate among all company size groups surveyed.

The findings come from Netwrix's 2026 Data and Identity Security Report, based on a survey of 2,317 IT and security professionals across organisations in 110 countries. Of the 363 respondents from organisations with 500 to 999 employees, 315 answered the question on unauthorised access and 126 said unauthorised identities had accessed sensitive data in the previous 12 months.

The 40% figure compares with 18% for organisations with fewer than 500 employees and 27% for those with 10,000 or more employees. The research also found that 80% of organisations with 500 to 999 employees could not get a single view of where sensitive data is stored and which identities can access it, compared with 70% in both the smallest and largest groups.

The data points to particular strain on mid-sized organisations as they expand systems and user access without the staffing levels or budgets of larger peers. Budget was the biggest barrier to improving identity and data security among organisations with fewer than 1,000 employees, cited by 34% of respondents, followed by skills and staffing at 28%.

Other findings for organisations with fewer than 1,000 employees showed fragmented oversight of security practices. Some 76% said identity and data security were not unified under a single strategy.

Privileged access remained a concern. Seven in 10 respondents in the sub-1,000 employee bracket said they had privileged accounts with standing access to sensitive systems or data, while only 18% said that access was automatically removed when no longer needed.

The report also pointed to the effect of AI and automation on access sprawl. Among organisations with fewer than 1,000 employees, 67% said AI and automation had increased the number of identities able to access sensitive data, compared with 50% of organisations with fewer than 500 employees.

Management of third-party privileged access also appeared uneven. The study found that 28% of organisations with fewer than 1,000 employees used home-grown or ad hoc tools for that task.

Confidence gap

The survey highlighted what appears to be a mismatch between security confidence and outcomes among mid-sized organisations that experienced unauthorised access. Among those respondents, 87% said they were confident their Active Directory was free of misconfigurations that could allow privilege escalation, while 85% said they could detect risky combinations of user access.

At the same time, 56% of organisations in that affected group estimated the financial impact of unauthorised access at more than USD $100,000. Operational disruption and damage to customer trust were each cited by 47% of respondents.

Smaller organisations showed a different pattern of risk. Among companies with fewer than 500 employees, 23% said they had not conducted an Active Directory security assessment in the past year, compared with 8% of organisations with 10,000 or more employees.

The report also found that 18% of the smallest organisations said non-human identities were not governed at all, versus 2% among the largest companies surveyed. In addition, 26% of organisations with fewer than 500 employees said they were unprepared for AI security, with no formal AI data inventory or usage policies in place.

"Companies at this stage of growth are in an awkward spot," said Grady Summers, Chief Executive Officer of Netwrix.

"They're big enough that access has become complicated, but they don't necessarily have the people or tools of a large enterprise. That's how you end up with a lot of access that nobody has a complete picture of," Summers said.

Survey scope

The respondent pool included IT managers, system administrators, security practitioners and C-level executives. Some 57% were based in the United States.

Results were broken down across five organisation size bands: fewer than 500 employees, 500 to 999 employees, 1,000 to 4,999 employees, 5,000 to 9,999 employees, and 10,000 or more employees. The analysis suggests the middle tier faced a higher reported incidence of unauthorised access than both smaller businesses and much larger enterprises.

Netwrix also used the announcement to highlight its 1Secure software, aimed at organisations that have outgrown basic security tools and do not run a full security operations centre. The product includes an initial data and security risk assessment, more than 200 security checks and AI-based remediation guidance, with pricing starting at USD $24 per identity per year.

The central finding, however, remained the level of reported unauthorised access in the 500 to 999 employee group, where four in 10 respondents said sensitive data had been accessed by unauthorised identities in the previous 12 months.