40% of Mid-Sized Organizations Report Unauthorized Access to Sensitive Data, Netwrix Research Finds

Organizations with 500 to 999 employees reported more unauthorized access than any other size group surveyed

FRISCO, Texas, Oct. 14, 2026 /PRNewswire/ -- Netwrix, a recognized leader in identity and data security, today released new findings from its 2026 Data and Identity Security Report looking at results by company size.

Organizations with 500 to 999 employees reported the highest rate of unauthorized access to sensitive data in the past year at 40%. That compares with 18% of organizations with fewer than 500 employees and 27% of those with 10,000 or more.

Eighty percent said they can't get a single view of where sensitive data lives and which identities can access it. That figure was 70% for both organizations under 500 employees and those with 10,000 or more.

"Companies at this stage of growth are in an awkward spot," said Grady Summers, CEO of Netwrix. "They're big enough that access has become complicated, but they don't necessarily have the people or tools of a large enterprise. That's how you end up with a lot of access that nobody has a complete picture of."

The 2026 report surveyed 2,317 IT and security professionals, including 1,344 at organizations with fewer than 1,000 employees. For that group, the Netwrix Security Research Team also found:

• 76% said identity and data security aren't unified under one strategy.
• 70% have privileged accounts with standing access to sensitive systems or data. Only 18% automatically remove that access when it's no longer needed.
• 67% said AI and automation have increased the number of identities that can access sensitive data, compared with 50% of organizations with fewer than 500 employees.
• 28% use home-grown or ad hoc tools to manage third-party privileged access.
• Among those that experienced unauthorized access, 87% were confident their Active Directory was free of misconfigurations that could allow privilege escalation, and 85% were confident they could detect risky combinations of user access.
• 56% of organizations that experienced unauthorized access estimated the financial impact at more than $100,000. Operational disruption and damage to customer trust were each reported by 47%.

The findings looked different among organizations with fewer than 500 employees:

• 23% hadn't conducted an Active Directory security assessment in the past year. Among organizations with 10,000 or more employees, that figure was 8%.
• 18% said non-human identities aren't governed at all, compared with 2% of organizations with 10,000 or more employees.
• 26% said they were unprepared for AI security, with no formal AI data inventory or usage policies in place.

For organizations with fewer than 1,000 employees, budget was the most commonly cited barrier to improving identity and data security at 34%, followed by skills and staffing at 28%.

Netwrix 1Secure™ is built for organizations that have outgrown basic security tools but don't have a full security operations center. The platform delivers an initial data and security risk assessment within an hour, includes more than 200 PingCastle-powered security checks, and equips lean IT and security teams with time saving capabilities like the Netwrix Neo AI assistant and AI-driven remediation guidance. 1Secure is available directly and through managed service providers, with pricing starting at $24 per identity per year.

Netwrix will explore the research during Netwrix Innovation Week, Oct. 19–23, with practitioner sessions, live demonstrations and expert conversations on securing data and identities as AI changes how organizations work. A live 1Secure demonstration on Oct. 20 will show how mid-size teams can identify and address risky access. More information is available here.

Additional Resources

Download the Netwrix 2026 Data and Identity Security Report

Assess Active Directory security risks with Netwrix PingCastle

Data, Identity & AI Security Assessment: a free benchmarking tool that evaluates organizations across 12 security dimensions and five maturity tiers for AI readiness

Methodology

Netwrix surveyed 2,317 IT and security professionals at organizations headquartered in 110 countries, with 57% based in the United States, in April 2026. Respondents included IT managers, system administrators, security practitioners and C-level executives.

The analysis compares organizations with fewer than 500 employees (981 respondents), 500 to 999 employees (363), 1,000 to 4,999 employees (416), 5,000 to 9,999 employees (180) and 10,000 or more employees (377). Percentages are based on respondents who answered each question and may not total 100% due to rounding.

Of the 363 respondents at organizations with 500 to 999 employees, 315 answered the question on unauthorized access; 126 of those (40%) reported that unauthorized identities had accessed sensitive data in the previous 12 months. The confidence and incident-impact findings for this group are based on those 126 respondents.

About Netwrix

Netwrix's vision is to create a world where every organization has secured its data and identities. The 1Secure™ SaaS platform unifies identity and data security to provide complete visibility into where data lives, who can access it, and how it's governed. With Netwrix, security teams strengthen data protection, safeguard identities, and stay ahead of evolving threats. Today, more than 13,000 customers, including nearly 25% of the Fortune 500, rely on Netwrix solutions across hybrid and AI-driven environments. With a 95% customer satisfaction rating, Netwrix offers flexible delivery models that are quick to deploy, easy to use, and built to scale for organizations of all sizes. For more information visit www.netwrix.com.

Media contacts

Natalie Reina
Director of Public Relations, Netwrix
natalie.reina@netwrix.com

© 2026 Netwrix Corporation. All rights reserved. This page expresses the results of research conducted by Netwrix and the information herein is subject to change. The Netwrix name, logo, products, service names, slogans and all Netwrix trademarks are the property of Netwrix Corporation or its affiliates. The other names and identifying marks are trademarks of and owned by each represented company and/or its affiliates. Such companies are not sponsors of this press release or otherwise affiliated with Netwrix.