Cybersecurity statistics point to rising attack volume and breach risk

At a glance

What this is: Secureframe compiles 210-plus cybersecurity statistics that point to rising attack volume, greater breach severity, and persistent exposure across supply chain, identity, and data theft risks.

Why it matters: IAM, PAM, NHI, and security teams should treat these trends as evidence that visibility, privilege control, and third-party governance are now core resilience controls, not optional hygiene.

By the numbers:

• Today, an organization experiences about 1,900 cyber attacks per week, according to the latest data from Check Point Research cited by Secureframe.
• Cybercrime losses are projected to hit $15.63 trillion by 2029, up from $10.5 trillion in 2025, according to Secureframe’s roundup of current research.
• Third-party involvement in breaches doubled to 30%, underscoring growing supply chain risk, according to Secureframe’s summary of breach statistics.
• Data exfiltration was observed in 80% of attacks, confirming data theft as a primary objective, according to Secureframe’s source roundup.

Context

Cybersecurity statistics matter when they point to a control gap, not just a bigger headline number. This article pulls together more than 200 figures to show that attack volume, breach cost, third-party exposure, and AI-driven change are all rising at once, which makes governance harder across identity, access, data, and supply chain controls.

The identity angle is especially clear in the sections on insider risk, third-party incidents, and machine-generated code, because each of those shifts increases the number of actors and credentials that security teams must govern. For IAM, PAM, NHI, and agentic AI programmes, the practical issue is no longer whether the perimeter holds, but whether access, delegation, and revocation can keep pace with how work is actually executed.

Key questions

Q: What breaks when third-party access is not reviewed continuously?

A: The break is that access stays active long after the business relationship, vendor task, or application purpose has changed. Without continuous review, teams rely on outdated certifications that do not reflect live permissions. The result is uncontrolled delegated access, especially across SaaS and OAuth-connected systems.

Q: Why do attackers favour data exfiltration over immediate disruption?

A: Exfiltration is attractive because it can be done quietly through legitimate credentials and normal-looking access paths. If an attacker can read or copy data without triggering obvious service interruption, they preserve options for extortion, resale, or follow-on fraud. The control gap is usually not one missing tool but weak visibility into who accessed what, when, and at what scale.

Q: How do security teams know whether identity controls are keeping pace with cyber risk?

A: Look for two signals: whether access can be revoked quickly enough to matter, and whether unusual access patterns are visible before data leaves the environment. If entitlement review, vendor offboarding, and token revocation lag behind real-world usage, identity control is already behind the threat. Effective programmes show bounded access, fast revocation, and traceable data movement.

Q: What is the difference between perimeter defence and identity governance in modern attacks?

A: Perimeter defence tries to stop entry, but identity governance limits what happens after entry, especially when attackers use valid credentials or delegated access. In today’s environment, many attacks bypass the edge and move through trusted identities, partner accounts, or automation. That means the decisive control is not just blocking traffic, but constraining access scope, duration, and revocation speed.

Technical breakdown

Why attack volume now overwhelms perimeter assumptions

Cyber attack volume only becomes operationally meaningful when it outpaces the ability to detect, triage, and revoke access. A figure such as 1,900 attacks a week describes a tempo problem: defenders are forced to assume continuous probing, credential abuse, phishing, and exploit attempts rather than discrete events. That shifts the technical question from blocking every attempt to limiting blast radius when controls fail. In identity-heavy environments, standing access, overbroad entitlements, and delayed revocation turn routine attack pressure into real compromise. Practical implication: design controls for constant pressure, not occasional incidents.

Practical implication: move monitoring, entitlement review, and revocation logic toward continuous operation rather than periodic control checks.

How third-party access turns breach risk into governance debt

Third-party involvement in breaches is a governance problem because external access is often granted faster than it is retired, reviewed, or constrained. Once a vendor account, support channel, or delegated integration exists, the effective attack surface expands beyond the organisation’s own users and systems. This is where identity control matters most: lifecycle ownership, least privilege, authentication strength, and offboarding discipline determine whether partner access remains bounded or becomes a persistent exposure. The article’s breach statistics show that supply chain risk is now part of normal operating risk, not an edge case. Practical implication: third-party identity governance has to be treated as a first-class control domain.

Practical implication: map all vendor access paths to named owners, expiry conditions, and revocation triggers before they become unmanaged standing access.

Why data exfiltration is the real end state of many cyber attacks

When data exfiltration appears in 80% of attacks, the key insight is that many intrusions are not about noisy destruction but about quiet collection. Attackers may use phishing, stolen credentials, vulnerable services, or compromised partners only as entry points; the end goal is usually data movement, monetisation, or downstream fraud. That means detection must focus on unusual access patterns, bulk reads, token misuse, and abnormal egress, not only malware signatures. In NHI contexts, leaked API keys, service tokens, and unattended secrets can provide exactly the kind of access that makes exfiltration efficient and hard to see. Practical implication: treat data movement and credential abuse as a single control problem.

Practical implication: pair identity telemetry with egress and data-access monitoring so credential abuse is visible before large-scale extraction begins.

Threat narrative

Attacker objective: The attacker’s objective is usually to steal data, monetise access, or create leverage for extortion while staying inside trusted workflows long enough to avoid detection.

1. Entry often begins with phishing, vulnerable services, or compromised third-party access that gives an attacker a foothold into legitimate systems.
2. Credential access or token abuse then lets the attacker operate as an authorised user, service, or support channel rather than as obvious malware.
3. Escalation follows when standing privilege, weak offboarding, or overbroad delegation lets the attacker move toward sensitive systems and data stores.
4. Impact is usually data exfiltration, extortion, fraud, or disruption, with the article noting that data theft appears in most attacks and that ransomware remains common.

Breaches seen in the wild

• Rabbit R1 hard-coded API keys 2024: Rabbit R1 source code leaked by an employee held working ElevenLabs, Azure, Yelp and Google Maps API keys; an email key was misused, Rabbit says.
• Ledger Connect Kit npm compromise 2023: Attackers phished a former Ledger employee with unrevoked npm access and published a wallet-draining Connect Kit, stealing about $600k on 14 Dec 2023.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Attack volume has become a governance capacity problem, not just a threat-intelligence problem: organisations are now forced to manage a constant background rate of probing, misuse, and exploitation attempts. That volume exposes whether identity, access, and data controls are continuous or merely periodic. The field should stop treating security effectiveness as a point-in-time state and start treating it as a sustained control throughput problem. Practitioners need controls that fail safely when pressure rises, not only when a breach is obvious.

Third-party access is now one of the clearest sources of identity governance debt: once external users, support agents, integrations, and delegated workflows enter the environment, the lifecycle burden increases immediately. The article’s breach figures show that partner risk is no longer peripheral, and the real issue is whether access can be enumerated, scoped, and revoked with the same discipline as internal identities. The governance assumption that external access is temporary is too often false. Practitioners should model third-party identity as a permanent control domain, not an exception.

Data exfiltration is the dominant threat outcome because identity controls fail before data controls do: attackers rarely need to destroy systems if they can quietly read, copy, or move information through legitimate channels. This is where NHI governance becomes central, because service accounts, tokens, and API keys can provide machine-speed access that human review processes miss. The named concept here is exfiltration-first attack design, where theft is the objective and every preceding step exists to make extraction look normal. Practitioners need to govern access as a data-protection control.

AI-generated code and shadow AI increase the number of identities security teams must govern: the article’s statistics on AI adoption and weak visibility point to a coming mismatch between how software is built and how access is governed. If code can be generated faster than secrets, permissions, and provenance are reviewed, then identity sprawl becomes a software-supply-chain issue as well as an access-control issue. This is a signal that agentic and machine identity governance is moving from niche concern to baseline control requirement. Practitioners should fold AI-assisted development into access and secret oversight immediately.

Risk management is shifting from prevention-only thinking to resilience under compromise: the article’s figures on operational disruption, supply chain exposure, and insider incidents all point in the same direction. Teams that only measure blocked attacks will miss the more important question of how quickly they can detect misuse, contain it, and restore trust in identities and data paths. The next maturity step is not more policy language, but better control observability across identities, vendors, and automated workflows. Practitioners should make recoverability a design requirement for identity governance.

What this signals

Exfiltration-first attack design: many threat actors are optimising for quiet data movement, not immediate disruption, which means access governance and data protection now have to operate as one control plane. When service accounts, vendor identities, and automation can read sensitive data without tight telemetry, defenders are left with after-the-fact evidence instead of prevention.

The signal for practitioners is that identity programmes can no longer be scoped to workforce access alone. Third-party accounts, machine credentials, and AI-assisted development workflows now shape the real exposure profile, so review cycles, revocation processes, and logging need to reflect that broader identity estate.

Attackers are exploiting the gap between fast-moving software creation and slower-moving governance processes. Security teams should prepare for more secrets exposure, more delegated access, and more trust placed in workflows that humans no longer inspect line by line.

For practitioners

• Strengthen third-party identity governance Inventory every vendor, support, and partner account, then assign an owner, expiry condition, and revocation path to each one. Prioritise access that can reach sensitive data, production systems, or identity infrastructure.
• Treat data exfiltration as an identity problem Correlate authentication events, token use, and bulk data access so unusual reads or exports are visible before they become large-scale theft. Watch for service accounts and API keys performing human-like access patterns.
• Reduce standing privilege across high-risk workflows Remove persistent access where task-based access is sufficient, especially for administrators, support teams, and automation that can reach customer or production data. Review whether current entitlements are broader than the work actually requires.
• Build visibility into AI-generated code and secret use Track where AI-assisted code is introduced, then check whether secrets, tokens, and API keys are appearing in locations your review process does not cover. Extend policy and logging to development workflows that now move faster than manual review.

Key takeaways

• Rising attack volume is important because it exposes whether identity, access, and data controls can sustain continuous pressure.
• The article’s statistics show that third-party involvement, insider incidents, and data exfiltration are no longer edge cases but recurring threat patterns.
• Practitioners should treat external access, machine credentials, and data movement as linked controls rather than separate security tasks.

Key terms

• Third-party identity governance: Third-party identity governance is the control of how external people and organizations are granted, reviewed, monitored, and removed from access. It covers contractors, suppliers, partners, and other non-employees, using identity lifecycle controls, least privilege, periodic recertification, and evidence of accountability to reduce unauthorized access and compliance risk.
• Exfiltration-First Attack Design: Exfiltration-first attack design describes intrusion patterns where attackers aim to steal data quietly rather than immediately disrupt services. The model relies on legitimate credentials, trusted access paths, and low-noise movement so that defenders see the compromise late, often only after data has already left the environment.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Machine Credential: A machine credential is a secret or identity artifact used by software rather than a person. It includes service account credentials, API keys, tokens, and certificates. In practice, the main risk is not just exposure, but unmanaged lifecycle, unclear ownership, and overbroad access.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, secrets management, and identity lifecycle control. It helps practitioners translate identity risk into operational controls across modern security programmes.