Notably, the infrastructures and industries that faced the most identity theft-based attacks were energy, oil, and gas, at eighty per cent, and central governments at seventy-eight per cent.

“Identity has become the primary attack surface in modern cybersecurity, and this data shows most organisations are losing ground,” said Ross McKerchar, chief information security officer at Sophos.

“The non-human identity problem is particularly urgent."

AI agents are being granted privileges faster than security teams can track them, and organisations that fail to get ahead of this will find it an increasingly costly gap to close.”

The survey also reported that of these businesses facing identity theft attacks, forty-nine per cent said this led to data theft, and forty-seven per cent suffered financial losses.

Nearly half (43 per cent) of the over five thousand organisations surveyed said that human error and human deception were cited in all attacks.

Poor management of ‘non-human identities’ (i.e. API keys, credentials, abandoned accounts) was cited as the cause of 41 per cent of Australian victims.

Sophos says that to reduce the risk of identity-based attacks, businesses and organisations should ensure that their approach to cybersecurity includes multi-layered, strong systems that rotate.