Research: 40% of Midsize Organizations Report Unauthorized Data Access
Employers with 500 to 999 workers reported the highest rate of unauthorized access to sensitive information in the survey.
- By Chelsey Arries
- Oct 14, 2026
Unauthorized access to sensitive data affected 40% of surveyed organizations with 500 to 999 employees during the previous year, the highest proportion among the workforce size categories in Netwrix’s 2026 Data and Identity Security Report.
The rate was 18% among organizations employing fewer than 500 people and 27% among those with at least 10,000 employees, according to the company.
Visibility into sensitive information and access permissions also differed by size. Among organizations with 500 to 999 employees, 80% reported lacking a consolidated picture of where that information was stored and who or what could access it. The proportion was 70% in both the smallest and largest groups.
The research drew responses from 2,317 IT and security professionals, including 1,344 working at organizations with fewer than 1,000 employees.
For employers below that threshold, 34% identified funding constraints as the leading obstacle to strengthening identity and data security. Another 28% cited shortages of personnel and expertise.
Smaller organizations also reported gaps in security reviews and oversight of automated accounts. Among employers with fewer than 500 workers, 23% had gone at least a year without assessing Active Directory security, compared with 8% of organizations employing 10,000 or more people.
In the smaller group, 18% reported no governance for identities associated with applications, services or other nonhuman users. That compared with 2% among the largest organizations.
Additionally, 26% of respondents at organizations with fewer than 500 employees described themselves as unprepared to address AI security, reporting that they lacked a formal inventory of AI data or policies governing its use.
About the Author
Chelsey Arries is assistant editor of Security Today, Campus Security Today, Occupational Health & Safety and Environmental Protection Online.