News Summary
-
91% of IT and security leaders surveyed experienced workforce identity fraud or a near miss in the past two years, highlighting the rising impact of employee identity fraud and insider risk.
-
96% of organizations consider insider risk a significant concern, reflecting its evolution from a niche security issue to a boardroom-level priority.
-
Attackers are targeting employee identities through phishing and social engineering (46%) and compromised credentials (43%) to gain trusted access.
-
Entrust report exposes a growing workforce identity crisis and the need for modern fraud prevention approaches as AI-driven fraud increases and non-human identities reshape the workforce.
Entrust, a global leader in identity-centric security solutions, released the findings from The KYE & Workforce Identity Crisis Report. The research found that nine out of 10 (91%) organizations have experienced a workforce identity incident or near miss in the past two years, while almost all respondents (96%) now consider insider risk a significant threat. The findings suggest workforce identity risk has become a mainstream security challenge as attackers increasingly target employee identities to gain trusted access.
Also Read: CIO Influence Interview with Srinivasan Panchapakesan, Chief Platform Officer at Hexaware
For years, organizations have been verifying credentials, devices, and access rights, but many still struggle to verify the person behind them. As identity-based attacks rise, KYE is a strong framework for strengthening trust at critical moments.
Entrust commissioned a survey of more than 1,000 IT and security leaders in the U.S. and UK to understand the growing workforce identity challenge in the era of AI-driven fraud and how organizations are approaching workforce identity verification and authentication. Social engineering, credential compromise, privileged access misuse, employee impersonation, onboarding fraud, and candidate fraud are putting workforce identity controls under pressure, driving organizations to adopt Know Your Employee (KYE) principles as part of their security strategies.
“The voices of IT and security leaders in this survey make it clear why workforce identity is now a boardroom-level security conversation,” said Adam Dimopoulos, Chief Information Security Officer at Entrust. “Organizations have long understood the risks of identity-based attacks, but AI is accelerating the scale and sophistication of these threats while employee verification and access management have not kept pace. As enterprises deploy agentic AI in their environments, they introduce non-human identities that require the same level of trust and protection as human users. Organizations will need identity and authentication frameworks that ensure human and non-human access is verified, authorized, and governed.”
Other key findings from The KYE & Workforce Identity Crisis Report include:
- Candidate fraud is infiltrating the hiring pipeline: The hiring process has become a target for corporate espionage and fraud, as over a quarter of respondents (28%) report that they have experienced or investigated candidate fraud in the past 12-24 months. Nearly one-third (30%) of IT and security leaders report that they are concerned about identity fraud involving fraudulent new hires.
- Phishing and credential compromise are the biggest workforce identity concerns, yet passwords remain the primary defense: Phishing and social engineering (46%) and compromised credentials (43%) were the most cited workforce identity threats. Yet usernames and passwords were the leading primary authentication method their organization relies on (45%). Other threats included privileged access misuse (34%), employee account takeover or impersonation (33%), negligent employee security behavior (32%), and malicious insider activity (32%).
- KYE is gaining ground, but less than half are confident they can verify employee identity: Nearly 3 in 5 (59%) say KYE programs are now a core part of their identity strategy. Even so, fewer than half are very confident they can reliably verify identity during everyday access to systems and data (46%), employee onboarding (43%), or first login and device enrollment (42%). Confidence is lowest for verifying contractor and temporary access (31%).
- AI-enabled impersonation is outpacing measurement, creating a critical identity security gap: More than half of respondents (54%) measure AI-driven impersonation, such as deepfakes and synthetic identities, in some way, while 46% do not currently measure it at all. The number of organizations that measure and regularly report these attacks drops to 28% for fully remote organizations, compared with 40% of hybrid organizations, and 39% of in-office organizations.
- Ownership is concentrated but not fully settled: 45% of respondents say the CISO or security team has primary responsibility for workforce identity security. Others point to the IT team (22%), Chief Information Officer (20%), Chief Human Resources Officer or HR team (8%), while 4% say that there is no single owner. Fragmented ownership can complicate coordination across the security, IT, and HR teams responsible for workforce identity.
“For years, organizations have been verifying credentials, devices, and access rights, but many still struggle to verify the person behind them,” added Dimopoulos. “Know Your Employee, or KYE, is about establishing confidence that employees, contractors, and partners are who they claim to be throughout their workforce lifecycle. As identity-based attacks continue to rise, KYE is a strong framework for strengthening trust at critical moments such as onboarding, account recovery, privileged access requests, and remote work.”
Catch more CIO Insights: The Overlooked Security Risk Behind Enterprise AI Rollouts
[To share your insights with us, please write to psen@itechseries.com ]
