Netwrix released new findings from its 2026 Data and Identity Security Report looking at results by company size.
Organizations with 500 to 999 employees reported the highest rate of unauthorized access to sensitive data in the past year at 40%. That compares with 18% of organizations with fewer than 500 employees and 27% of those with 10,000 or more.
Eighty percent said they can’t get a single view of where sensitive data lives and which identities can access it. That figure was 70% for both organizations under 500 employees and those with 10,000 or more.
“Companies at this stage of growth are in an awkward spot,” said Grady Summers, CEO of Netwrix. “They’re big enough that access has become complicated, but they don’t necessarily have the people or tools of a large enterprise. That’s how you end up with a lot of access that nobody has a complete picture of.”
The 2026 report surveyed 2,317 IT and security professionals, including 1,344 at organizations with fewer than 1,000 employees. For that group, the Netwrix Security Research Team also found:
- 76% said identity and data security aren’t unified under one strategy.
- 70% have privileged accounts with standing access to sensitive systems or data. Only 18% automatically remove that access when it’s no longer needed.
- 67% said AI and automation have increased the number of identities that can access sensitive data, compared with 50% of organizations with fewer than 500 employees.
- 28% use home-grown or ad hoc tools to manage third-party privileged access.
- Among those that experienced unauthorized access, 87% were confident their Active Directory was free of misconfigurations that could allow privilege escalation, and 85% were confident they could detect risky combinations of user access.
- 56% of organizations that experienced unauthorized access estimated the financial impact at more than $100,000. Operational disruption and damage to customer trust were each reported by 47%.
The findings looked different among organizations with fewer than 500 employees:
- 23% hadn’t conducted an Active Directory security assessment in the past year. Among organizations with 10,000 or more employees, that figure was 8%.
- 18% said non-human identities aren’t governed at all, compared with 2% of organizations with 10,000 or more employees.
- 26% said they were unprepared for AI security, with no formal AI data inventory or usage policies in place.
For organizations with fewer than 1,000 employees, budget was the most commonly cited barrier to improving identity and data security at 34%, followed by skills and staffing at 28%.
Netwrix 1Secure™ is built for organizations that have outgrown basic security tools but don’t have a full security operations center. The platform delivers an initial data and security risk assessment within an hour, includes more than 200 PingCastle-powered security checks, and equips lean IT and security teams with time saving capabilities like the Netwrix Neo AI assistant and AI-driven remediation guidance. 1Secure is available directly and through managed service providers, with pricing starting at $24 per identity per year.
Netwrix will explore the research during Netwrix Innovation Week, Oct. 19–23, with practitioner sessions, live demonstrations and expert conversations on securing data and identities as AI changes how organizations work. A live 1Secure demonstration on Oct. 20 will show how mid-size teams can identify and address risky access.
