Privileged access statistics are quoted everywhere, but most "80% of breaches involve privileged credentials" claims cannot be traced to a primary source, and that weakens every business case built on them. This page collects privilege-related figures only from the publishers' own reports and government statistics: Verizon's Data Breach Investigations Report, CISA's Risk and Vulnerability Assessment analysis, the UK government's Cyber Security Breaches Survey, the Australian Signals Directorate's Annual Cyber Threat Report and IBM's Cost of a Data Breach Report. Every figure carries its source, publisher and year, with caveats on what it does and does not measure. It is narrower than the Identity Attack Statistics Guide, which covers credential theft and MFA broadly: here the focus is administrative rights, privilege escalation, privilege misuse and the adoption of privileged access controls. It is for PAM programme owners, security leaders building a case for investment, and analysts who need numbers they can defend. Last reviewed: November 2026.
Key takeaways
- Privilege escalation through valid accounts is routine for assessors. CISA's FY23 Risk and Vulnerability Assessment analysis recorded Valid Accounts in 45% of privilege escalation instances across 143 assessments, and the US Coast Guard reached Domain Administrator by cracking password hashes in 89% of its assessments.
- Privilege Misuse is a small pattern overall but large in government. The Verizon 2026 DBIR shows Privilege Misuse falling to 3% of breaches in its executive summary chart (from 7% and 8% in the two prior editions), yet it is a top three pattern in Public Administration, where internal actors appear in 44% of breaches.
- Restricting admin rights is going backwards in UK businesses. The UK Cyber Security Breaches Survey 2025 found 68% of businesses restrict IT admin and access rights to specific users, down from 73% in 2024.
- Default and weak credentials keep handing out privilege. The US Coast Guard found default passwords at 94.4% of entities it assessed in FY23, according to CISA's analysis.
- Third parties widen the privileged surface. The 2026 DBIR records third-party involvement in 48% of breaches, and only 23% of third-party organisations fully remediated missing or weak MFA on cloud accounts in its exposure data.
How to read these numbers
Few primary sources measure "privileged access" as a category. Instead they measure adjacent things: an ATT&CK technique observed during assessments, a breach pattern, a control that survey respondents say they have. Each section below names what was measured. Three rules apply throughout:
- Datasets differ: the DBIR counts confirmed breaches contributed by many organisations; CISA counts techniques that succeeded in authorised assessments; the UK survey counts what organisations report doing. Do not add or compare them directly.
- Percentages have bases: a figure for one sector or region is not a global figure. Quote the base.
- Editions change methods: year-on-year moves in the DBIR partly reflect dataset changes. Treat them as directional.
Privilege escalation and valid accounts in assessments
CISA and the US Coast Guard (USCG) ran 143 Risk and Vulnerability Assessments in fiscal year 2023. CISA's analysis maps successful techniques to MITRE ATT&CK, which makes it the most direct public measure of how testers turn ordinary access into privilege.
| Figure | Value | Source and year |
|---|---|---|
| Valid Accounts (T1078) share of successful initial access | 41% | CISA, FY23 RVA Analysis (published 2024) |
| Valid Accounts share of persistence instances | 42% | CISA, FY23 RVA Analysis |
| Valid Accounts share of privilege escalation instances | 45% | CISA, FY23 RVA Analysis |
| Process Injection share of privilege escalation instances | 18% | CISA, FY23 RVA Analysis |
| USCG assessments where cracked password hashes gave Domain Administrator access | 89% | CISA, FY23 RVA Analysis |
| USCG-assessed entities with default passwords in place | 94.4% | CISA, FY23 RVA Analysis |
| Credential dumping share of credential access instances | 14% | CISA, FY23 RVA Analysis |
| Assessments where LLMNR/NBT-NS poisoning and SMB techniques succeeded | 13% | CISA, FY23 RVA Analysis |
What it shows: the most common route to higher privilege in these assessments was not an exploit but an existing account, consistent with ATT&CK T1078 Valid Accounts appearing across initial access, persistence and privilege escalation. The Coast Guard figures come from a subset of assessments and should be quoted as such.
Privilege misuse and internal actors in breaches
Verizon's 2026 DBIR covers more than 22,000 confirmed breaches from over 31,000 incidents between October 2024 and November 2025. Privilege Misuse is the DBIR pattern for insiders abusing legitimate access.
| Figure | Value | Source and year |
|---|---|---|
| Privilege Misuse share of breaches (executive summary chart) | 3% (2026), 7% (2025), 8% (2024) | Verizon, DBIR 2026 Executive Summary |
| Public Administration: Privilege Misuse in top three patterns, which together account for 80% of 2,410 breaches | Top three | Verizon, DBIR 2026 |
| Internal actors, Public Administration | 44% of breaches | Verizon, DBIR 2026 |
| Internal actors, Educational Services | 22% | Verizon, DBIR 2026 |
| Internal actors, Healthcare | 19% | Verizon, DBIR 2026 |
| Internal actors, Financial and Insurance | 12% | Verizon, DBIR 2026 |
| Internal actors, Manufacturing | 5% | Verizon, DBIR 2026 |
Caveat: Verizon notes that Miscellaneous Errors, especially misdelivery, drive much of the internal activity in Public Administration, so internal actor share is not the same as malicious insider share. The prior edition (DBIR 2025, 12,195 confirmed breaches) gave internal actors as 30% of Healthcare breaches, 22% of Financial and Insurance and 38% of Educational Services. For the insider angle in depth, see the Insider Threat Statistics Guide.
Credential abuse as the way in
Privileged access is usually reached after initial access, so the entry figures matter for PAM planning.
| Figure | Value | Source and year |
|---|---|---|
| Credential abuse share of initial access (19,905 non-Error, non-Misuse breaches) | 13% | Verizon, DBIR 2026 |
| Exploitation of vulnerabilities share of initial access | 31% (now first) | Verizon, DBIR 2026 |
| Exploitation share in the prior edition | 20% | Verizon, DBIR 2025 |
| Credential abuse, EMEA | 25% | Verizon, DBIR 2026 |
| Valid Accounts share of industry incidents responded to | 23% | ASD, Annual Cyber Threat Report 2024-25 |
The Australian Signals Directorate also reports that compromised credentials (Valid Accounts) were the most common initial access in data encryption incidents during FY2024-25, without giving a percentage. Its report covers about 1,253 incidents responded to in that year.
What it shows: credential abuse slipped behind exploitation in the 2026 DBIR, but valid accounts remain the leading enabler once an attacker is inside, as the CISA data shows. A falling initial access share is not a reason to relax controls on privileged credentials.
Third parties and privileged exposure
| Figure | Value | Source and year |
|---|---|---|
| Breaches with third-party involvement | 48% (a 60% increase on the prior dataset) | Verizon, DBIR 2026 |
| Third-party involvement in the prior edition | 30% (up from 15%) | Verizon, DBIR 2025 |
| Third-party organisations that fully remediated missing or improperly secured MFA on cloud accounts (n = 7,513 exposures) | 23% | Verizon, DBIR 2026 |
| Time for 50% of weak password and permission misconfiguration findings to be resolved | Almost eight months | Verizon, DBIR 2026 |
Vendor and contractor accounts often carry standing administrative rights into customer estates. A stolen credential for a vendor's remote access path can carry that privilege straight into the customer estate. See the Vendor Privileged Access Management (VPAM) Guide.
Adoption of privileged access controls
The best public measure of basic privilege control adoption is the UK government's Cyber Security Breaches Survey, an official statistic with a large sample. The 2025 edition surveyed 2,180 businesses, 1,081 charities and 574 education institutions between August and December 2024 and was published on 10 April 2025.
| Control | Businesses | Charities | Source and year |
|---|---|---|---|
| Restricting IT admin and access rights to specific users | 68% (73% in 2024) | 68% | DSIT, Cyber Security Breaches Survey 2025 |
| Any two-factor authentication for networks or applications | 40% | 35% | DSIT, Cyber Security Breaches Survey 2025 |
| Password policy ensuring strong passwords | 73% | 57% | DSIT, Cyber Security Breaches Survey 2025 |
What it shows: roughly a third of UK organisations do not limit who holds admin rights at all, before any question of vaulting, session recording or just-in-time elevation. Adoption of dedicated PAM tooling is not measured by an official statistics body that we could find; vendor surveys that claim to measure it are left out here because their samples and methods are not independently published.
Access controls for AI systems
IBM's Cost of a Data Breach Report 2025 (Ponemon Institute research covering 600 organisations breached between March 2024 and February 2025) found that 13% of organisations reported breaches of AI models or applications, and 97% of those breached lacked proper AI access controls. The global average breach cost in that report was USD 4.44 million. AI agents increasingly hold privileged tool access, so this belongs in a privileged access picture; see the AI Agent Security Statistics page.
What the numbers mean for defenders
| Finding | Implication | Control to prioritise |
|---|---|---|
| Valid Accounts in 45% of RVA privilege escalation | Escalation runs through existing accounts and groups | Remove standing admin rights; tier administration; review nested groups |
| Domain Administrator via cracked hashes in 89% of USCG assessments | Weak passwords on privileged and service accounts | Long random or managed passwords, gMSA for services, vaulting with rotation |
| Default passwords at 94.4% of USCG-assessed entities | Devices and appliances ship with privileged defaults | Change defaults at onboarding; scan for them continuously |
| Internal actors at 44% in Public Administration | Legitimate access is the risk | Session monitoring, dual control for sensitive actions, access reviews |
| Third-party involvement at 48% | Vendor access extends your privileged surface | Brokered, time-bound vendor access with recording |
| Admin rights restriction at 68% of UK businesses | Basics are missing in many organisations | Start with an inventory and least privilege before buying tools |
CISA and NSA's joint advisory on the top ten cybersecurity misconfigurations (AA23-278A) names improper separation of user and administrator privilege as one of the ten, highlighting privilege creep, highly privileged service accounts targeted through Kerberoasting, and administrators using domain admin accounts for routine tasks. Those three behaviours explain much of the assessment data above.
Metrics worth tracking internally
- Number of standing privileged accounts, human and non-human, and the trend per quarter.
- Share of privileged access granted just in time rather than standing.
- Service accounts with domain or tenant admin rights, and how many use managed or rotated credentials.
- Devices and appliances still on default credentials.
- Vendor accounts with standing access, and average session length.
- Time from leaver or role change to privileged access removal.
These measures let you produce your own primary data, which is more persuasive to a board than any industry percentage. The PAM Maturity Model helps place the results.
Framework mapping
| Theme | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | MITRE ATT&CK |
|---|---|---|---|
| Least privilege and admin rights | AC-6 | PR.AA-05 | T1078 Valid Accounts |
| Account management and reviews | AC-2 | PR.AA-05 | T1098 Account Manipulation |
| Authenticator strength and defaults | IA-5 | PR.AA-01 | T1078.001 Default Accounts |
| Domain privilege | AC-6 | PR.AA-05 | T1078.002 Domain Accounts |
Practitioner checklist
- Quote every statistic with publisher, report name, year and base; drop any figure you cannot trace to the primary report.
- Use the CISA RVA figures for the escalation case and the DBIR for breach patterns, and do not combine them into one number.
- Inventory all privileged accounts, including service accounts, device admin accounts and vendor accounts, before setting targets.
- Remove default credentials from appliances and devices and add a recurring scan for them.
- Move privileged access from standing to just in time, starting with domain and cloud tenant administrators.
- Put vendor access behind brokered, recorded, time-bound sessions.
- Track the six internal metrics above quarterly and report them alongside the external figures.
- Refresh this evidence each year when the DBIR, the UK survey and CISA's RVA analysis are updated.
Standards and references
- CISA: Analysis of Fiscal Year 2023 Risk and Vulnerability Assessments
- Verizon: 2026 Data Breach Investigations Report Executive Summary
- Verizon: 2025 Data Breach Investigations Report Executive Summary
- UK Department for Science, Innovation and Technology: Cyber Security Breaches Survey 2025
- Australian Signals Directorate: Annual Cyber Threat Report 2024-2025
- IBM: Cost of a Data Breach Report 2025
- CISA and NSA: AA23-278A Top Ten Cybersecurity Misconfigurations
- MITRE ATT&CK: T1078 Valid Accounts
Related NHI Mgmt Group resources: Privileged Access Management Guide · Identity Attack Statistics Guide · Non-Human Identity and Secrets Statistics Guide · Top 10 PAM Mistakes · PAM Maturity Model