BeyondTrust Research: 75% of Cyberattacks Trace Back to Identity and Privilege Exposure
Across 400+ offensive research projects, one pattern dominated: identity and privilege issues sit at the heart of the
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
- Across 400+ offensive research projects, one pattern dominated: identity and privilege issues sit at the heart of the modern attack surface, Phantom Labs® finds
- Identity and privilege risks often don’t come from a single flaw, but from how users, machines, and AI agents connect and inherit access across cloud, SaaS, and on-premises environments
- Research findings shaped BeyondTrust’s product portfolio and led to coordinated vulnerability disclosures, including in OpenAI Codex and AWS Bedrock AgentCore
LAS VEGAS, Aug. 03, 2026 (GLOBE NEWSWIRE) — BeyondTrust, the global leader in privilege-centric identity security protecting Paths to Privilege™, today released the Phantom Labs® Research Index, an annual analysis of what’s driving today’s attacks, based on the offensive security research conducted by the team. Most notably, the report revealed that attackers are increasingly exploiting the trusted relationships between users, applications, machine identities, and AI agents rather than isolated software vulnerabilities alone.
Analyzing more than 400 research projects over the past year, Phantom Labs found that 75% of completed investigations involved identity or privilege in some way. Sorted by root cause, six problems accounted for more than half of everything the team found: credential and secret exposure (18%), identity relationships and graph exposure (11%), excessive or standing privilege (11%), identity misconfiguration (10%), and lateral movement (6%). These root causes rarely appeared in isolation. Standing privilege and privilege escalation showed up together most often, and credential exposure was the issue most likely to compound with something else.
“As organizations connect human, machine, and AI agent identities across dispersed environments, attackers don’t need to find a new vulnerability. They’re looking for the next identity relationship that leads to privileged access, and figuring out where those relationships create real exposure has become one of the harder problems in enterprise security today,” says Jonathan Johnson, Sr Manager, Research at BeyondTrust. “That’s exactly what we saw across our research this year: three out of four projects traced back to identity or privilege in some form, and standing privilege and privilege escalation showed up together more often than any other combination we tracked.”
AI Agents Are Becoming Enterprise Identities
AI and LLM security was Phantom Labs’ single largest research focus in year one, accounting for half of all projects. That work spanned cloud AI platforms (58%), AI agents and agentic systems (42%), model and data security (12%), prompt injection and jailbreak techniques (9%), and AI-specific privilege escalation (6%), with many projects touching more than one category.
As organizations deploy AI agents across cloud, SaaS, and internal workflows, BeyondTrust found that these agents increasingly authenticate to systems, invoke tools, access data, and inherit permissions much like any other enterprise identity – often with far less oversight.
Coordinated Disclosures in OpenAI Codex, AWS Bedrock AgentCore Show the Pattern Isn’t New
Beyond identity relationship mapping, Phantom Labs’ original vulnerability research included coordinated disclosures across AI platforms, including in OpenAI Codex and AWS Bedrock AgentCore — findings that show how even the newest AI ecosystems continue to inherit foundational security assumptions around identity, privilege, and trust. The pattern wasn’t confined to AI. Across all research conducted in year one, AWS (85 mentions), Microsoft Entra ID/Azure (57), GitHub (40), Okta (33), and Salesforce (33) surfaced most often — a sign that these same identity assumptions run through cloud, identity-provider, DevOps, and SaaS ecosystems alike.
Phantom Labs’ research shipped directly into BeyondTrust products, including Identity Security Insights®, published research, and coordinated disclosures, turning the offensive research into protections defenders can act on before privileges are exploited.
- To read the full Phantom Labs Research Index, visit: https://www.beyondtrust.com/blog/entry/phantom-labs-research-index
- For the latest new research, visit the Phantom Labs Research Hub: https://www.beyondtrust.com/channel/phantom-labs
About BeyondTrust
BeyondTrust is the global leader in privilege-centric identity security protecting Paths to Privilege™. Identity alone doesn’t create risk. Privilege does. As human, machine, and AI agent identities explode across every environment, BeyondTrust is the only company built to discover, control, and secure privilege across all of them from a single platform. Trusted by 20,000+ customers, including 75 of the Fortune 100, and recognized as a multi-category leader by top industry analysts, BeyondTrust reframes identity security from a management problem into a strategic advantage.
Learn more at www.beyondtrust.com.
Follow BeyondTrust:
X: https://twitter.com/beyondtrust
Blog: https://www.beyondtrust.com/blog
LinkedIn: https://www.linkedin.com/company/beyondtrust
Facebook: https://www.facebook.com/beyondtrust
For BeyondTrust:
BeyondTrust Public Relations
P: (516)-521-5582
