Workforce identity attacks hit 91% of firms, study says

Entrust has published research showing that 91% of organisations have faced a workforce identity incident or near miss in the past two years. The study surveyed more than 1,000 IT and security leaders in the UK and US.

The findings point to growing concern over attacks targeting employee identities through phishing, social engineering and compromised credentials. Some 96% of respondents now see insider risk as a significant threat, suggesting the issue has moved beyond specialist security teams into wider corporate oversight.

Phishing and social engineering were the most commonly cited workforce identity threats, named by 46% of those surveyed. Compromised credentials followed at 43%, while 34% pointed to privileged access misuse and 33% to employee account takeover or impersonation.

The figures come as retailers and other large employers face greater scrutiny over how staff credentials are used to access sensitive systems and customer data. In the survey, 45% of respondents said usernames and passwords remain their organisation's primary authentication method.

That reliance is coupled with low confidence in identity checks for external workers and temporary users. Only 31% of IT leaders said they were very confident they could reliably verify the identity of contractors, partners or temporary access users, the weakest area measured in the study.

Confidence was also limited in other routine parts of the employment cycle. Just 46% said they were very confident in verifying identity during everyday access to systems and data, while 43% said the same for employee onboarding and 42% for first login and device enrolment.

Hiring risks

The research also highlighted concerns in recruitment. More than a quarter of respondents, 28%, said they had experienced or investigated candidate fraud in the past 12 to 24 months, while 30% said they were concerned about identity fraud involving fraudulent new hires.

Entrust described that trend as part of a broader shift in which attackers seek trusted access by posing as legitimate employees, applicants or third parties. The study also examined the effect of artificial intelligence on this pattern, including deepfakes and synthetic identities.

More than half of respondents, 54%, said they measure AI-driven impersonation in some way, but 46% do not measure it at all. The share that both measure and regularly report these attacks was lower in fully remote organisations at 28%, compared with 40% in hybrid organisations and 39% in office-based organisations.

Responsibility for workforce identity security also appears spread across several parts of the business. Some 45% said the chief information security officer or security team holds primary responsibility, while 22% pointed to the IT team and 20% to the chief information officer. A smaller share assigned responsibility to HR, and 4% said there was no single owner.

Adam Dimopoulos, chief information security officer at Entrust, said the findings showed why the subject is receiving attention at senior level. "The voices of IT and security leaders in this survey make it clear why workforce identity is now a boardroom-level security conversation," he said.

"Organisations have long understood the risks of identity-based attacks, but AI is accelerating the scale and sophistication of these threats while employee verification and access management have not kept pace. As enterprises deploy agentic AI in their environments, they introduce non-human identities that require the same level of trust and protection as human users. Organisations will need identity and authentication frameworks that ensure human and non-human access is verified, authorized, and governed."

Verification gap

The report found that 59% of respondents said Know Your Employee programmes are now a core part of their identity strategy. Even so, the survey suggests many organisations still struggle to verify that the person using a credential, device or account is who they claim to be.

Dimopoulos said that gap remains central to the problem. "For years, organizations have been verifying credentials, devices, and access rights, but many still struggle to verify the person behind them," he said.

"Know Your Employee, or KYE, is about establishing confidence that employees, contractors, and partners are who they claim to be throughout their workforce lifecycle. As identity-based attacks continue to rise, KYE is a strong framework for strengthening trust at critical moments such as onboarding, account recovery, privileged access requests, and remote work."

The survey was conducted among 1,002 senior IT and security decision-makers at medium to large enterprises in the UK and US, each with more than 500 employees and annual revenue above USD $50 million. Respondents were split almost evenly between the two markets, with 500 in the UK and 502 in the US.