FusionAuth today released its 2026 State of AI and Identity Report, detailing how AI is reshaping identity infrastructure, security posture, and enterprise trust. The findings reveal a profound and counterintuitive crisis: the organizations that feel most prepared are getting hit the hardest.
Sixty-five percent of respondents reported a confirmed AI identity-related security incident in the past 12 months, with another 23% reporting a near miss. Only 12% emerged from the past year without an incident or close call. But the headline finding is not the breach rate alone; it is who is getting breached.
Among organizations that rated themselves “extremely confident” in their AI security posture, 84% had already experienced a confirmed incident. That figure drops to 64% among those “very confident,” and to just 17% among those who are “not so confident.” The gradient is near-perfect: confidence and breach rates move together.
Key Findings at a Glance
- 88% say AI deployment is outpacing their identity and security infrastructure
- 65% experienced a confirmed AI identity-related security incident in the past 12 months
- 84% of organizations that are “extremely confident” in their AI security posture also reported a confirmed incident
- 80% report shadow AI (employees connecting AI tools without security or IT review)
- 83% vs 38% confirmed incident rate for multi-tenant SaaS vs. self-hosted identity platforms
- 85% have faced customer, partner, or regulatory demands to prove tenant isolation
- 93% say AI is already a trigger for reevaluating identity infrastructure
- 91% expect identity investment to increase in the next 12–18 months
Confidence is Tracking the Wrong Thing
The report’s most striking finding has significant implications for how the industry benchmarks AI security readiness. Organizations at the top of the confidence scale share a common profile: they are deploying AI broadly, have comprehensive policies, have formalized lifecycle processes, and are investing heavily. They are doing everything a mature organization should, yet they are still being breached at high rates.
The report also notes that organizations with more mature security programs are better at detecting incidents, meaning lower-confidence organizations may not be safer, but simply have less visibility into what is already happening.
Architecture is the New First-Order Security Variable
The deployment model an organization uses for its identity platform correlates strongly with breach outcomes. Organizations using multi-tenant SaaS identity platforms report confirmed incidents at more than twice the rate of those using self-hosted or on-premises deployments: 83% versus 38%.
In a shared SaaS environment, a single compromised token or misconfigured policy does not stay contained. It cascades across every AI workflow connected to the identity layer, model access, data pipelines, automation actions, and downstream services, creating a fundamentally different blast radius than a self-hosted or isolated deployment.
The highest-risk profile in the study is not a low-maturity organization. It is the opposite: companies running AI in production, using AI broadly across the workforce, and operating on multi-tenant SaaS identity infrastructure. In this cohort, 90% reported a confirmed incident and 96% faced shadow AI challenges.
Identity is Now a Commercial Trust Problem
AI identity risk has moved beyond the security team. Eighty-five percent of respondents have faced customer, partner, or regulatory demands to demonstrate tenant isolation at least occasionally, while 56% face it frequently. Tenant isolation has shifted from a backend implementation detail to a commercial requirement that now determines whether enterprise deals close.
Among organizations where AI is the primary driver of identity reevaluation and customers frequently demand proof of isolation, 99% reported a confirmed incident, and 95% are planning significant increases in investment, pointing to a buying motion driven by urgency rather than planning.
Investment is Moving from Incremental to Structural
Ninety-three percent of respondents say AI is already causing or contributing to a reevaluation of identity infrastructure. Sixty-six percent are planning a significant increase in investment, and 91% expect some level of increase in the next 12–18 months. The top evaluation criteria reflect an architectural shift: machine identity at scale (72%), deployment flexibility (57%), fine-grained authorization (54%), and tenant isolation (32%). Total cost of ownership ranked last at 11%.
About the Research
The 2026 State of AI and Identity Report is based on a survey of 312 technology and security leaders, screened for relevance to AI, identity, and security decision-making. Respondents include CTOs, CISOs, VPs and Directors of Product, Engineering, Security, and Platform/Infrastructure across a range of company sizes and industries. The survey was conducted by FusionAuth in early 2026.
Shai-Hulud supply chain attacks: Commentary on what NIST 800-171 actually covers (and where it falls short)
Posted in Commentary with tags Shai-Hulud on June 9, 2026 by itnerdMore than 100 malicious packages dropped across npm and PyPI in the Shai-Hulud campaign this week—and the reason it’s so hard to stop is structural. The payload rides in on a dependency you’ve already authorized, running with the trust level of installed software. Your perimeter never sees it.
There is a good write up about it here: Active Exploitation Alert: Shai-Hulud Supply Chain Attack Compromises 100+ NPM and PyPI Packages with Self-Spreading Malware – Rescana
Justin Beals, CEO & Founder, Strike Graph had this to say:
“Shai-Hulud is essentially a zero-day executing from behind the firewall. The malicious code rides in on a dependency you’ve already authorized, running with the trust level of an installed package—so the perimeter and network controls most teams lean on never see it.
NIST 800-171 covers more of this surface than people realize. The workhorses are already in the Rev 2 baseline CMMC Level 2 is assessed against: application allowlisting, least privilege to contain credential theft, a maintained component inventory so you can find affected versions fast, and monitoring to catch the post-install behavior a payload generates. Rev 3 goes further—a dedicated Supply Chain Risk Management family and a shift to deny-all, allow-by-exception software control.
But the honest read: a fully compliant shop can still take this hit. Allowlisting and an SCRM plan raise the attacker’s cost and shrink the blast radius—they don’t stop a poisoned build of a package you already trust. A warning to losing too much headcount on the engineering team is that you may be able to run the deep security testing required to secure your dependencies.
Gunter Ollmann, CTO, Cobalt contributes this comment:
“Shai-Hulud highlights how supply chain attacks are evolving from isolated compromises into continuously propagating campaigns. The most dangerous aspect isn’t the initial package infection. It’s the attacker’s ability to steal credentials, abuse trusted relationships, and rapidly expand their foothold across interconnected development environments.
Security teams should assume that software dependencies are part of their attack surface and continuously test for weaknesses in build pipelines, package management processes, credential storage practices, and repository access controls. As these attacks become more automated and self-replicating, organizations will need the same level of continuous validation for their software supply chains that they already apply to cloud and production environments.”
Roman Sannikov, Global Research Coordinator, iCOUNTER adds this:
“Shai-Hulud represents an important evolution in supply chain operations because it combines credential theft, trusted-channel abuse, and autonomous propagation into a single campaign. The attackers are no longer focused solely on compromising software. They’re targeting the trust infrastructure that enables software to move through ecosystems at scale.
The malware is self propagating it doesn’t need to ping back to the command and control for instructions nearly as much as older malware, making it harder to spot by monitoring for suspicious traffic patterns.The lesson for defenders is that visibility alone is not enough. Organizations must be able to identify compromised credentials, understand how trust relationships connect repositories and development environments, and take coordinated action before a localized compromise turns into a broader ecosystem event. Countering these threats requires disrupting the pathways that allow malicious code to spread, not just detecting the code after it arrives.”
I would recommend pulling any and all permissions related to these packages. Then I would get a baseline of NIST 800-171 so that you don’t get caught with your pants down metaphorically speaking.
Leave a comment »