Growing firms hit hardest by unauthorised data access

Netwrix research shows that 40% of organisations with 500 to 999 employees reported unauthorised access to sensitive data in the past year, the highest rate among the company size groups examined.

The figures come from the 2026 Data and Identity Security Report, based on a survey of 2,317 IT and security professionals across 110 countries. Of those, 363 worked at organisations with 500 to 999 employees, and 315 of that group answered the question on unauthorised access.

Among respondents in the 500 to 999 employee bracket, 80% said they could not get a single view of where sensitive data resides and which identities can access it. That compared with 70% at organisations with fewer than 500 employees and 70% at organisations with 10,000 or more staff.

The study also found that 76% of organisations with fewer than 1,000 employees did not unify identity and data security under a single strategy. In the same group, 70% said they had privileged accounts with standing access to sensitive systems or data, while only 18% said that access was removed automatically when no longer needed.

The findings point to the strain on growing companies with increasingly complex IT estates but without the staffing levels or budgets often seen at larger businesses. Budget was the main barrier to improving identity and data security for 34% of organisations with fewer than 1,000 employees, followed by skills and staffing at 28%.

AI and automation also featured in the responses. Some 67% of organisations with fewer than 1,000 employees said they had increased the number of identities able to access sensitive data, compared with 50% of organisations with fewer than 500 employees.

Access gaps

Other findings from organisations with fewer than 1,000 employees pointed to weaknesses in governance and oversight. More than a quarter, 28%, said they used home-grown or ad hoc tools to manage third-party privileged access.

Among organisations with 500 to 999 employees that had experienced unauthorised access, 87% said they were confident their Active Directory was free of misconfigurations that could allow privilege escalation. Another 85% said they were confident they could detect risky combinations of user access.

The report also examined the cost of incidents. Among organisations in the 500 to 999 employee category that reported unauthorised access, 56% estimated the financial impact at more than USD $100,000.

Operational disruption and damage to customer trust were each cited by 47% of that group. These incident-impact findings were based on the 126 respondents in the 500 to 999 employee segment who said unauthorised identities had accessed sensitive data in the previous 12 months.

Responses from smaller organisations showed different pressures. Among businesses with fewer than 500 employees, 23% said they had not conducted an Active Directory security assessment in the past year, compared with 8% of organisations with 10,000 or more employees.

Netwrix also found that 18% of organisations with fewer than 500 employees said non-human identities were not governed at all. The comparable figure for organisations with 10,000 or more employees was 2%.

Readiness for AI-related security risks also appeared uneven. Among organisations with fewer than 500 employees, 26% said they were unprepared for AI security and had no formal AI data inventory or usage policies in place.

The survey covered IT managers, system administrators, security practitioners and C-level executives. Respondents were spread across five company size bands: fewer than 500 employees, 500 to 999 employees, 1,000 to 4,999 employees, 5,000 to 9,999 employees, and 10,000 or more employees.

Grady Summers, Chief Executive Officer of Netwrix, said: "Companies at this stage of growth are in an awkward spot. They're big enough that access has become complicated, but they don't necessarily have the people or tools of a large enterprise. That's how you end up with a lot of access that nobody has a complete picture of."