93% of CIOs will open up their identity AI agents. 32% believe they have it under control

👩identity become the true scope of the IT system

Two out of three ransomware attacks enter an organization’s IT system through anidentity breach. Not through a misconfigured firewall, not through a system vulnerability: through a compromised account, a stolen password, or hijacked access. Sophos’s State of Identity Security 2026 report, based on a survey of 5,000 IT and cybersecurity decision-makers in 17 countries, confirms this shift. 71% of organizations have suffered at least oneidentity attackidentity the past twelve months, with an average of three attacks per affected organization.

When an attack succeeds, the bill comes due. On average, it costs $1.64 million to resolve anidentity breach, with a median cost of $750,000. France is no exception: 66% of organizations were affected, and 14.6% were unable to detect the attack in time.

The causes are well known, and that’s what hurts. Human error: 43%; poor management of technical accounts: 41%; weak human management: 39%. And here’s the stinging statistic: in Sophos’s investigations of real-world incidents, MFA was simply not enabled on the targeted system in 59.5% of cases. Not disabled. Not bypassed. Just missing.

identity replaced the network as the primary target for attacks. User accounts, service accounts, third-party access, AI agents: every identity a point of entry. And with agent-based AI rapidly creating new machine accounts on the fly, the attack surface is expanding faster than our ability to monitor it. Only 34% of organizations regularly audit their service accounts. The entry point to the IT system is no longer the firewall; it’s the list of forgotten accounts.

‍

Source: Sophos

‍

‍

🤖 93% of CIOs will open up theiridentity infrastructureidentity AI agents by the end of 2026.

29% of organizations already have AI agents handling security tickets in their help desk —such as password resets and granting VPN access. 64% plan to take the plunge within the next twelve months. By the end of 2026, 93% of organizations will have integrated autonomous agents into theiridentity infrastructure. The Semperis study, conducted by Censuswide among 1,100 IT and security professionals in eight countries, including France, then asks the uncomfortable question. Only 32% say they are very confident in their ability to regain control if a compromised agent were to expose administrator credentials.

The scenario unfolds in a matter of seconds. An attacker compromises a workstation running a local AI agent—a scenario that applies to 92% of the organizations surveyed. The attacker instructs the agent to list all the secrets available in the environment. The agent, at lightning speed, compiles a list of credentials, SSH keys, and active sessions. What used to take hours is now done in an instant.

The underlying problem isn’t that agents access sensitive systems. It’s that they themselves are poorly tracked identities. Thirty-five percent of organizations do not record them—or only partially record them—in a dedicated system, and 6% do not track them at all. Microsoft estimated the ratio of non-human to human identities to be 10 to 1 in 2018. The trend is heading toward 100 to 1. And 80% of workload identities are reportedly already abandoned while retaining their access rights.

For European CIOs, the challenge is compounded by regulatory requirements. NIS 2 and DORA impose operational resilience obligations that include the ability to detect, contain, and recover from incidents. Deploying AI agents onidentity systemsidentity first testing their recoverability exposes organizations to both operational crises and non-compliance. The question is no longer “should we govern AI identities?” It is: before or after the first incident?

‍

Source: IT Social

‍

‍

‍

🌍 6,167 data breaches in 2025: The CNIL is shifting half of its inspections to cybersecurity

6,167 data breaches were reported to the CNIL in 2025, a 9.5% increase from 2024. The annual report, published on May 18, confirms a record that had already been broken the previous year. Hacking accounted for 50% of incidents, and the public sector accounted for 19% of reported breaches. About 40 of these breaches affected more than one million people, compared to about 30 in 2024.

The CNIL is stepping up its efforts. By 2026, 50% of its inspections and enforcement actions will focus on cybersecurity breaches, compared to one-quarter to one-third in 2025. Marie-Laure Denis put it bluntly in *Le Monde*: "The government has a special responsibility toward the data of French citizens."

For CIOs, the message is clear: when it comes to cybersecurity, the CNIL/GDPR route is becoming the primary avenue for enforcement. While ANSSI has the authority but has not exercised it, the CNIL is moving forward with €487 million in fines imposed in 2025 under its belt.

‍

Source: 01.net, Siècle Digital, Next

‍

‍

Zoom in on Youzer

Provisioning Under Control: Who Approves What, and When

Creating an account, modifying access permissions, suspending, or deleting: these routine actions leave a trail that an attacker could exploit if the system is compromised. Youzer allows you to designate an administrator for each connector, who receives a notification that must be approved before the action is executed. Provisioning is triggered only after approval is received.

In practice, each connector has a primary recipient. If that recipient does not respond within 24 hours, the notification is forwarded to a secondary recipient. After 48 hours, both recipients are sent a reminder. Creating a Salesforce account requires approval from the Salesforce manager; opening an AD account requires approval from the AD manager, and so on. And on each user’s profile, the Roles tab clearly indicates who administers what.

There are two uses depending on the organization’s maturity: security (the approval workflow blocks unapproved actions) or tracking (documented visibility into who makes decisions). In both cases, you gain what the reports mentioned above identify as missing: a record, an identified responsible party, and auditable evidence as defined by NIS 2.

I want a demo

‍

‍

Thank you for reading me this far!

Any feedback, want to discuss a project?

I'm here for that 👋.

👉Reply to this newsletter

👉Contact us on Youzer

We've sent you the newsletter and you think it's great? Sign up here 👇

Sign me up for Récap'IT

Sharing this newsletter is what keeps it alive!