Identity compromise is no longer primarily an employee-account problem, and government organizations are feeling it harder than any other sector, according to a recently released report by cybersecurity provider SpyCloud.
Non-human identities like bots, AI agents, API keys and other machine identities have become the leading route for initial access, as attackers increasingly look for trusted access into systems rather than trying to defeat traditional security controls like passwords and multi-factor authentication. For government organizations in particular, that expanding attack surface also extends to third parties, making visibility into contractor and vendor identity exposures — along with verification that known compromises have been remediated — especially important.
In an interview with WashingtonExec, SpyCloud Vice President of Government Markets Phil Fuster said the company’s recently-released 2026 Identity Threat Report reveals that government organizations are feeling the reality of certain shifts harder than any other sector in the study.
More than nine out of 10 government organizations surveyed experienced an identity-based event in the past year, with an average of 10 events. Most organizations in other sectors experienced only eight. Government agencies deal with identity exposure not just within but across contractors, vendors, personal devices, session tokens, API keys, service accounts and AI agents, Fuster said.
“An attacker only needs to find one exposed path into the environment,” he said. “The practical response is to expand visibility beyond the traditional user account, monitor those exposures continuously rather than periodically, and shorten the time between discovering a compromise and actually closing it.”
Year-to-Year Changes
The biggest change from the 2025 report is that identity risk has expanded out of compromised human credentials and into the broader ecosystem of machine identities, authenticated sessions, AI tools and third parties, Fuster said.
Last year’s SpyCloud Identity Threat Report highlighted how phishing had become the leading entry point for ransomware, driven partly by phishing-as-a-service and techniques designed to steal credentials, multi-factor authentication tokens and active sessions, he said. But this year, the attack surface widened. Non-human identity misuse became the most commonly reported identity-based event at 42%. Of organizations that were affected, NHIs were nearly twice as likely to be the primary initial access vector as phishing or social engineering — 31% versus 17%.
Compared to last year, third-party identity risk has become a bigger issue facing government, which depends on a sprawling system of contractors, technology providers, integrators and other partners.
“An organization can have strong internal controls and still inherit identity risk from somewhere else in the chain,” he said.
Those risks show up across malware-infected third-party devices and exposed API or application access among others. Further, trusted access paths are expanding with attackers increasingly going after session cookies, tokens, API keys, service accounts and other identity assets that already have access to applications, systems and data.
“Once those assets are compromised, an attacker may be able to bypass authentication controls, hijack an active session, or operate through access the organization already trusts,” Fuster said. “That creates a difficult visibility problem for government environments, particularly when you consider how many users, applications, machines, contractors, and partners may have legitimate access.”
The more connections an organization has, the more important identity exposure awareness and repair becomes.
The Evolving Threatscape
Other aspects of the threatscape are changing, too. Fuster said it is becoming less about breaking through a perimeter and more about finding legitimate access that skirts traditional security controls.
“Attackers are looking for exposed credentials, active sessions, machine identities, vendor access, and other trusted connections because those paths are often easier to exploit and harder for defenders to distinguish from legitimate activity,” he said.
This year, 42% of organizations reported an identity event involving an NHI while nearly 40% reported ransomware enabled by a compromised identity and 38% reported employee or contractor account takeover, he said.
“When an adversary is operating with legitimate-looking access, getting into the environment is only the beginning,” Fuster said. “The bigger concern is what they can reach, how long they can maintain access, and which other trusted relationships they can use to move through the environment.”
Shadow Access
As news of rogue AI becomes more prominent, Fuster said shadow access remains a real problem that reflects the need for attention to identity governance.
SpyCloud’s surveys show 91% of organizations admit to using AI tools or agents with access to internal systems, applications or data but only slightly more than half have formal policy and clear ownership related to AI- and NHI-related privileges. Nearly all organizations believe they have adequate visibility into exposure while just over one-third report actually continuously monitoring those exposures.
“For government, the concern isn’t that every AI deployment is inherently dangerous,” Fuster said. “It’s that AI makes it very easy to create another privileged connection into an environment without creating the same visibility and accountability that would normally accompany a human user.”
An agency can end up with an agent, application, API key, or service account that has meaningful access but no clearly accountable owner and no defined process for rotation or removal, he said. Instead, security teams need to ask what each tool has access to, who owns the access, what credentials and tokens it uses, when access expires and what happens when that identity is compromised.
Fighting Back
But the SpyCloud report also says identity exposure is measurable and fixable. There are advances in combating identity threats, too.
“Organizations are getting better at identifying and addressing identity exposures, and we’re also seeing progress in disrupting the criminal infrastructure that enables these attacks at scale,” he said.
This year, SpyCloud developed an Identity Threat Protection Maturity Trail that assigns one of four stages of maturity depending on capabilities across identity security, including visibility, monitoring, governance, automation and remediation. They are categorized as reactive, building, operational or optimized — the latter only when they have continuous monitoring and highly automated response.
One interesting finding, he said, is that when organizations initially improve visibility, they find more instances of exposure and reflect higher reported events rates. But those numbers go down significantly the closer they get to optimized maturity where they monitor and remediate more consistently and effectively. The biggest challenge is that only 9% of organizations reached the optimized stage.
SpyCloud has also contributed intelligence and tooling to several global law enforcement takedowns, including Euroboss and Operations Serengeti I and II, Fuster said. More recently, SpyCloud helped disrupt Tycoon 2FA and EvilTokens, two phishing-as-a-service operations designed to steal credentials and authenticated sessions at scale.
“There’s no finish line here, but we are getting better at shrinking the window between exposure and remediation while also disrupting some of the infrastructure criminals rely on to operate at scale,” Fuster said.
What’s Next
Looking ahead, Fuster said it’s important to expand the definition of what counts as an identity that needs protection.
“Federal agencies have invested years in ICAM and in the identity pillar of zero trust, and that foundation is sound,” he said. “But most of it was designed around human users. The same governance discipline – inventory, ownership, least privilege access, credential lifecycle – has to extend to contractors and vendors, personal devices accessing government resources, session cookies and tokens, API keys, service accounts, and AI agents. Attackers are already operating across that broader ecosystem.”
He also recommends prioritizing continuous visibility and shortening remediation windows. The latter is one place automation can come in, such as revoking sessions and tokens, reducing privileges and rotating credentials. Finally, Fuster said it’s important to close the loop with third parties, including having a process to verify that vendors affected by incidents remediated and fixed the problem.