# SaaS Statistics 2026: Shadow IT, Shadow AI, SaaS Sprawl and License Waste

Page: https://www.toriihq.com/saas-statistics
Publisher: Torii. Author: John Baker. Last updated: 7 October 2026. Sources last re-checked: 2026-10-07.
709 statistics from 107 publishers. Every number links to the organization that published it.
Full data with method and sample for each statistic: https://www.toriihq.com/assets/files/saas-statistics-2026.csv

## How this data was gathered

Figures labelled Torii come from the Torii SaaS Benchmark Annual Report 2026 (https://www.toriihq.com/reports/saas-benchmark-annual-report-2026): aggregated, anonymized discovery data covering January to December 2025. Every other figure links to the page or PDF where the organization that ran the research published it, and was confirmed on that page. Each is labelled as observed data, a survey or a forecast. The page is re-checked twice a week; the change log below records every change.

## SaaS sprawl statistics

The average organization runs 831 apps, and every one of them lands on someone's screen.

### How many apps a company runs

- The average organization runs 831 SaaS apps, according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- Enterprises with 4,000+ employees run 2,191 apps on average (median 2,323), according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- Across all company sizes, the average employee interacts with 40 apps, according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- BetterCloud's 2026 State of SaaS report found the average number of apps per organization rose 11% year over year, ending two years of consolidation. Source: BetterCloud, 2026 State of SaaS (2026); Survey. https://www.bettercloud.com/monitor/the-2026-state-of-saas-report/
- According to MuleSoft's 2026 Connectivity Benchmark Report, the average organization now manages 957 applications. Source: MuleSoft (Salesforce), 2026 Connectivity Benchmark Report (2026); Survey. https://blogs.mulesoft.com/agentic-perspectives/connectivity-benchmark-report/
- According to Okta's Businesses at Work 2025 report, the average company now deploys 101 apps, crossing 100 for the first time after years of flat growth. Source: Okta, Businesses at Work 2025 (2025); Observed data. https://www.okta.com/newsroom/articles/businesses-at-work-2025/
- According to Productiv data reported by CIO Dive, organizations cut their app portfolios 10% in 2023, but the average still stood at 342 apps, down from 374. Source: Productiv (reported by CIO Dive), State of SaaS 2024 (2024); Observed data. https://www.ciodive.com/news/chatgpt-generative-ai-shadow-it-saas-spending/713250/
- The median organization runs 682 SaaS apps, according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- Companies under 100 employees run 448 apps on average (median 392), according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- Mid-market organizations saw their average app count jump 41% in a single year, from 116 to 164, according to BetterCloud. Source: BetterCloud, 2026 State of SaaS (2026); Survey. https://www.bettercloud.com/monitor/the-2026-state-of-saas-report/
- Only 27% of an organization's applications are connected to each other on average, according to MuleSoft's 2026 Connectivity Benchmark Report. Source: MuleSoft (Salesforce), 2026 Connectivity Benchmark Report (2026); Survey. https://blogs.mulesoft.com/agentic-perspectives/connectivity-benchmark-report/
- Okta's Businesses at Work 2025 data shows US companies deploy an average of 114 apps, up 9% year over year, the highest of any country Okta reports. Source: Okta, Businesses at Work 2025 (infographic) (2025); Observed data. https://www.okta.com/sites/default/files/2025-03/Businesses-at-Work-Infographic.pdf
- According to Okta, the average EMEA organization deploys 74 apps, up from 69 a year earlier, while the global average reached 101. Source: Okta, Businesses at Work 2025 (infographic) (2025); Observed data. https://www.okta.com/sites/default/files/2025-03/Businesses-at-Work-Infographic.pdf
- Security and collaboration apps together make up 60% of the most widely deployed apps, according to Okta's Businesses at Work 2025. Source: Okta, Businesses at Work 2025 (2025); Observed data. https://www.okta.com/newsroom/articles/businesses-at-work-2025/
- BetterCloud's 2025 State of SaaS report found companies used an average of 106 SaaS apps, down from 112 the year before. Source: BetterCloud, 2025 State of SaaS (2025); Survey. https://www.bettercloud.com/monitor/2025-state-of-saas-trends/
- According to MuleSoft's 2025 Connectivity Benchmark Report, organizations use 897 applications on average. Source: MuleSoft (Salesforce), 2025 Connectivity Benchmark Report (2025); Survey. https://www.salesforce.com/news/stories/connectivity-report-announcement-2025/
- The average tool count per company jumped 23% in a year, driven by AI-powered tools, according to Spendflo's State of SaaS Procurement 2025 report. Source: Spendflo, State of SaaS Procurement 2025 (2025); Vendor or analysis. https://www.spendflo.com/blog/insights-from-the-state-of-saas-buying-survey
- Okta's 2024 Businesses at Work report found the average company's app count grew 4% to 93, after stalling at 89 for two years. Source: Okta, Businesses at Work 2024 (2024); Observed data. https://www.okta.com/sites/default/files/2024-04/Okta-2024_Businesses_at_Work.pdf
- According to Okta, large companies with 2,000 or more employees deploy an average of 231 apps each, up 10% from 211 a year earlier. Source: Okta, Businesses at Work 2024 (2024); Observed data. https://www.okta.com/sites/default/files/2024-04/Okta-2024_Businesses_at_Work.pdf
- Okta's data shows companies with fewer than 2,000 employees deploy an average of 72 apps, up from 69 a year earlier. Source: Okta, Businesses at Work 2024 (2024); Observed data. https://www.okta.com/sites/default/files/2024-04/Okta-2024_Businesses_at_Work.pdf
- Tech startups (100 or fewer employees) grew their app count 15% in a year to an average of 47 apps, according to Okta. Source: Okta, Businesses at Work 2024 (2024); Observed data. https://www.okta.com/sites/default/files/2024-04/Okta-2024_Businesses_at_Work.pdf
- Okta found US companies deploy an average of 105 apps, while Canadian companies deploy just 66. Source: Okta, Businesses at Work 2024 (2024); Observed data. https://www.okta.com/sites/default/files/2024-04/Okta-2024_Businesses_at_Work.pdf
- According to Okta's SMBs at Work 2024 report, SMBs (500 or fewer employees) deploy an average of 58 apps and small businesses (50 or fewer) about 36. Source: Okta, SMBs at Work 2024 (2024); Observed data. https://www.okta.com/sites/default/files/2024-04/Okta%20SMB%20Report%202024.pdf
- According to BetterCloud, the average company's SaaS app count peaked at 130 in 2022, then fell 14% to 112 in 2023, the first decline in over a decade. Source: BetterCloud, State of SaaSOps 2024 (2024); Survey. https://www.prnewswire.com/news-releases/the-number-of-saas-applications-at-companies-declined-for-the-first-time-in-over-a-decade-302199899.html

### Every app lands on someone's screen

- Employees lose nearly seven hours a week, almost a full workday, to complicated processes and fragmented tools, according to Freshworks. Source: Freshworks, The Cost of Complexity Report (2025); Survey. https://www.freshworks.com/pressrelease/software-budgets-wasted-on-unnecessary-business-complexity-freshworks-survey-finds/
- Workers toggle between apps and websites roughly 1,200 times a day, losing just under four hours a week (about 9% of work time) to reorienting, according to a Harvard Business Review study. Source: Harvard Business Review, How Much Time and Energy Do We Waste Toggling Between Applications? (Murty, Dadlani, Das) (2022); Observed data. https://hbr.org/2022/08/how-much-time-and-energy-do-we-waste-toggling-between-applications
- According to CFO Connect's 2026 CFO tools report, run by Spendesk, 91% of finance teams use six finance tools or fewer. Source: CFO Connect (Spendesk), CFO Connect Top Finance Tools Report 2026 (The CFO tech stack in 2026) (2026); Survey. https://www.cfoconnect.eu/resources/reports/best-cfo-tools-2026/
- According to CFO Connect's 2026 CFO tools report, 23% of finance leaders expect to actively consolidate their technology stack, while only 3% plan to expand it significantly. Source: CFO Connect (Spendesk), CFO Connect Top Finance Tools Report 2026 (The CFO tech stack in 2026) (2026); Survey. https://www.cfoconnect.eu/resources/reports/best-cfo-tools-2026/
- Okta found that 48% of its Microsoft 365 customers also run Google Workspace, up from 33% five years earlier, a sign of duplicate productivity suites. Source: Okta, Businesses at Work 2025 (infographic) (2025); Observed data. https://www.okta.com/sites/default/files/2025-03/Businesses-at-Work-Infographic.pdf
- Only 33% of companies consolidated redundant apps or accounts in the past year, according to BetterCloud. Source: BetterCloud, 2025 State of SaaS (2025); Survey. https://www.bettercloud.com/monitor/2025-state-of-saas-trends/
- Workers juggle an average of 15 different software tools and four communication channels every day, according to Freshworks. Source: Freshworks, The Cost of Complexity Report (2025); Survey. https://www.freshworks.com/pressrelease/software-budgets-wasted-on-unnecessary-business-complexity-freshworks-survey-finds/
- 36% of customer experience teams name toggling between too many tools as a top frustration, according to Freshworks. Source: Freshworks, The Cost of Complexity Report (2025); Survey. https://www.freshworks.com/pressrelease/software-budgets-wasted-on-unnecessary-business-complexity-freshworks-survey-finds/
- Workers switch between tabs, apps or platforms an average of 33 times a day, and 17% switch more than 100 times, according to a 2025 Lokalise survey. Source: Lokalise, Tool Fatigue Productivity Report (2025); Survey. https://lokalise.com/blog/blog-tool-fatigue-productivity-report/
- Workers lose an average of 51 minutes a week to tool fatigue, more than 44 hours a year, according to Lokalise. Source: Lokalise, Tool Fatigue Productivity Report (2025); Survey. https://lokalise.com/blog/blog-tool-fatigue-productivity-report/
- 79% of employees say their company hasn't taken steps to reduce tool fatigue or consolidate platforms, according to Lokalise. Source: Lokalise, Tool Fatigue Productivity Report (2025); Survey. https://lokalise.com/blog/blog-tool-fatigue-productivity-report/
- 74% of IT professionals see clear evidence of technology overlaps and redundancies in their organizations, yet 63% say consolidating tools is not a high priority, according to Ivanti. Source: Ivanti, 2025 Digital Employee Experience Report (2025); Survey. https://www.ivanti.com/resources/research-reports/2025-digital-employee-experience-report
- A Gartner survey found the average desk worker uses 11 applications for work, up from six in 2019, and 5% use 26 or more. Source: Gartner, Gartner Survey Reveals 47% of Digital Workers Struggle to Find the Information Needed to Effectively Perform Their Jobs (2023); Survey. https://www.gartner.com/en/newsroom/press-releases/2023-05-10-gartner-survey-reveals-47-percent-of-digital-workers-struggle-to-find-the-information-needed-to-effectively-perform-their-jobs
- At one Fortune 500 company, a single supply-chain transaction meant switching about 350 times between 22 apps and websites, adding up to more than 3,600 toggles per employee per day. Source: Harvard Business Review, How Much Time and Energy Do We Waste Toggling Between Applications? (2022); Observed data. https://hbr.org/2022/08/how-much-time-and-energy-do-we-waste-toggling-between-applications
- US employees switch between an average of 13 apps 30 times a day, according to Asana's Anatomy of Work Index 2021. Source: Asana (reported by CIO Dive), Anatomy of Work Index 2021 (2021); Survey. https://www.ciodive.com/news/app-switching-enterprise-asana-report/594233/
- Context switching between digital tools hurts productivity for 45% of workers, according to a Qatalog study run with Cornell University's Ellis Idea Lab. Source: Qatalog with Cornell University Ellis Idea Lab (reported by Construction Dive), Workgeist report (2021); Survey. https://www.constructiondive.com/news/app-switching-enterprise-productivity-software-qatalog/602654/

### AI is where the stack grows fastest

- Organizations now deploy an average of 27 AI-powered SaaS apps, about 22% of their total portfolio, according to BetterCloud's 2026 State of SaaS report. Source: BetterCloud, 2026 State of SaaS (2026); Survey. https://www.bettercloud.com/monitor/the-2026-state-of-saas-report/
- Organizations that have fully adopted agentic AI manage an average of 1,057 applications, 10% more than the overall average, according to MuleSoft. Source: MuleSoft (Salesforce), 2026 Connectivity Benchmark Report (2026); Survey. https://blogs.mulesoft.com/agentic-perspectives/connectivity-benchmark-report/
- Anthropic was the fastest-growing software vendor across SMB, mid-market and enterprise buyers in Q2 2026, the first time one vendor topped all three segments, according to Tropic. Source: Tropic, The State of Software Procurement in 2026 (2026); Observed data. https://www.tropicapp.io/blog/state-of-software-procurement-2026
- 67% of organizations now pay for AI-native tools, up from 12% in January 2023, according to Tropic's spend data. Source: Tropic, AI Spending and Pricing Trends H1 2026 (2026); Observed data. https://www.tropicapp.io/blog/ai-pricing-trends
- Mid-market companies use an average of 4.2 AI tools, but only 33% have a formal, consistently applied AI governance framework, according to Freshworks. Source: Freshworks, The Global Cost of Complexity Report: The Mid-Market AI Complexity Trap (2026); Survey. https://www.freshworks.com/pressrelease/freshworks-mid-market-companies-lose-an-average-of-25-of-their-ai-budget-before-seeing-a-single-return-new-freshworks-research-finds/
- Google Gemini adoption among organizations rose from 46% to 69% in a year, a sign that companies increasingly pay for multiple overlapping generative AI apps, according to Netskope. Source: Netskope Threat Labs, Cloud and Threat Report: 2026 (2026); Observed data. https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- According to Guild.ai's 2026 AI Agent Management Gap report, conducted by Morning Consult, 47% of organizations with AI agents are already running dozens or more. Source: Guild.ai (survey by Morning Consult), The AI Agent Management Gap Report (2026); Survey. https://www.globenewswire.com/news-release/2026/09/22/3366611/0/en/the-ai-agent-management-gap-is-growing.html
- According to Guild.ai's 2026 AI Agent Management Gap report, 61.2% of engineering and IT teams lose at least some time to duplicative agent work, rebuilding or maintaining agents that already exist elsewhere in the organization. Source: Guild.ai (survey by Morning Consult), The AI Agent Management Gap Report (2026); Survey. https://www.globenewswire.com/news-release/2026/09/22/3366611/0/en/the-ai-agent-management-gap-is-growing.html
- According to Guild.ai's 2026 AI Agent Management Gap report, 81% of IT decision makers consider a centralized hub for managing and deploying AI agents extremely or very important. Source: Guild.ai (survey by Morning Consult), The AI Agent Management Gap Report (2026); Survey. https://www.globenewswire.com/news-release/2026/09/22/3366611/0/en/the-ai-agent-management-gap-is-growing.html
- Security tools make up 40% of the fastest-growing apps in Okta's Businesses at Work 2025 report. Source: Okta, Businesses at Work 2025 (2025); Observed data. https://www.okta.com/newsroom/articles/businesses-at-work-2025/
- OpenAI was the fastest-growing software vendor of 2024 at 146% year-over-year growth, and 19 of the 20 fastest-growing vendors prominently featured AI, according to Tropic. Source: Tropic, 2025 Software Buying Trends for Effective Spend Management (2025); Observed data. https://www.tropicapp.io/newsroom/2025-software-spending
- Salesforce is the most widely used software tool, found at 62% of companies, according to Tropic's 2024 buying data. Source: Tropic, 2025 Software Buying Trends (blog summary) (2025); Observed data. https://www.tropicapp.io/blog/saas-benchmarks
- Compliance tool Vanta was the fastest-growing app in Okta's 2024 report, with 338% year-over-year growth in customers deploying it. Source: Okta, Businesses at Work 2024 (2024); Observed data. https://www.okta.com/sites/default/files/2024-04/Okta-2024_Businesses_at_Work.pdf

## Shadow IT statistics

Most apps never pass through IT. In Torii's data, 61.3% of the average portfolio is shadow IT.

### Most apps arrive without IT

- 61.3% of apps in the average portfolio are shadow IT, discovered through usage, browser activity or direct signup rather than procurement, according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- Only 15.5% of applications are formally sanctioned tools, according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- 98% of executives admit to bypassing IT when buying technology, according to Capgemini Research Institute. Source: Capgemini Research Institute, On-Demand Tech (FinOps) report (2025); Survey. https://www.capgemini.com/us-en/news/press-releases/on-demand-tech-is-on-the-rise-but-spiraling-costs-complexity-and-governance-gaps-are-putting-returns-at-risk/
- Shadow IT, purchased by business units without IT oversight, represents 24% of total IT budgets, according to IBM Institute for Business Value research. Source: IBM Institute for Business Value, Intelligent IT automation (2025); Survey. https://www.ibm.com/thought-leadership/institute-business-value/report/intelligent-it-automation
- Businesses underestimate their software usage by 40% on average: for every 10 tools a company thinks it uses, 14 are actually in play, according to Cledara. Source: Cledara, The 2025 Software Spend Report (2024); Observed data. https://www.cledara.com/blog/2025-software-spend-report
- Gartner predicts that by 2027, 75% of employees will acquire, modify or create technology outside IT's visibility, up from 41% in 2022. Source: Gartner, Top Predictions for Cybersecurity 2023-2024 (Gartner analyst presentation at RSAC 2024) (2023); Forecast. https://static.rainfocus.com/rsac/us24/sess/1696259875533001nHab/finalwebsite/2024_USA24_HUM-T01_01_Gartner's-Top-Predictions-for-Cybersecurity-2023-2024_1713998014692001HxlK.pdf
- More apps are blocked (17.1%) than approved (15.5%), according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- Productivity, Developer Tools, Design, and Sales and Marketing tools account for about 70% of all shadow apps, according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- Productivity tools are the largest shadow IT category at 23.0% of all shadow apps, according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- Only 56% of the apps in use at organizations carry IT approval, according to BetterCloud's 2026 State of SaaS report. Source: BetterCloud, 2026 State of SaaS (2026); Survey. https://www.bettercloud.com/monitor/the-2026-state-of-saas-report/
- 21% of organizations discovered new, unsanctioned SaaS and AI tools in use over the past 12 months, according to BetterCloud. Source: BetterCloud, 2026 State of SaaS (2026); Survey. https://www.bettercloud.com/monitor/the-2026-state-of-saas-report/
- According to the Cloud Security Alliance's State of SaaS Security Report 2025, 55% of employees adopt SaaS without security's involvement. Source: Cloud Security Alliance (commissioned by Valence Security), State of SaaS Security Report 2025 (2025); Survey. https://cloudsecurityalliance.org/artifacts/state-of-saas-security-report-2025
- Business units, not IT, now drive 48% of SaaS spending, according to a 2025 Capgemini Research Institute survey of 1,000 large-company executives. Source: Capgemini Research Institute, On-Demand Tech (FinOps) report (2025); Survey. https://www.capgemini.com/us-en/news/press-releases/on-demand-tech-is-on-the-rise-but-spiraling-costs-complexity-and-governance-gaps-are-putting-returns-at-risk/
- 47% of IT professionals are frustrated at not being consulted earlier in the tool procurement process, according to Auvik's 2025 IT Trends Report. Source: Auvik, 2025 IT Trends Report (2025); Survey. https://www.auvik.com/media-room/media-releases/auviks-2025-it-trends-report-highlights-rise-of-it-generalist/
- Grip Security's 2025 SaaS Security Risks report found 90% of SaaS applications inside organizations are unmanaged. Source: Grip Security, 2025 SaaS Security Risks Report (2024); Observed data. https://www.globenewswire.com/news-release/2024/10/23/2967715/0/en/grip-security-releases-2025-saas-security-risks-report-reveals-90-of-saas-applications-and-91-of-ai-tools-are-unmanaged.html
- The number of SaaS applications used in an enterprise grew 40% over two years, with an 85% increase in SaaS accounts per user, according to Grip Security. Source: Grip Security, 2025 SaaS Security Risks Report (2024); Observed data. https://www.globenewswire.com/news-release/2024/10/23/2967715/0/en/grip-security-releases-2025-saas-security-risks-report-reveals-90-of-saas-applications-and-91-of-ai-tools-are-unmanaged.html
- Productiv's 2024 State of SaaS analysis found shadow IT made up 48% of the average enterprise app portfolio in 2023, down from 53% the year before. Source: Productiv (via CIO Dive), 2024 State of SaaS (2024); Observed data. https://www.ciodive.com/news/chatgpt-generative-ai-shadow-it-saas-spending/713250/
- ChatGPT became the most prevalent shadow IT application in 2023, overtaking LinkedIn, Canva and Adobe Acrobat, according to Productiv. Source: Productiv (via CIO Dive), 2024 State of SaaS (2024); Observed data. https://www.ciodive.com/news/chatgpt-generative-ai-shadow-it-saas-spending/713250/
- 68% of IT leaders say business units are buying more SaaS and cloud than IT is aware of, according to Flexera's 2025 IT Priorities Report. Source: Flexera, 2025 IT Priorities Report (2024); Survey. https://www.flexera.com/about-us/press-center/artificial-intelligence-redefining-it-leaders-priorities
- Capterra found 57% of small and midsize businesses have had high-impact shadow IT efforts, and 85% of those have a shadow IT team operating right now. Source: Capterra (Gartner Digital Markets), Shadow IT Teams Cost Your SMB Time and Money (2023); Survey. https://www.capterra.com/resources/shadow-it-teams-cost-your-smb-time-and-money-but-they-dont-have-to/
- Cledara's State of Shadow IT study found 65% of all SaaS applications accessed at 200 companies were shadow IT, an average of 75 unapproved tools per company. Source: Cledara, The State of Shadow IT (2023); Observed data. https://resources.cledara.com/hubfs/eBooks%20PDF/The%20State%20of%20Shadow%20IT%20-%20Cledara.pdf
- Only 3.5% of companies in Cledara's study had shadow IT making up less than 20% of their tool usage. Source: Cledara, The State of Shadow IT (2023); Observed data. https://resources.cledara.com/hubfs/eBooks%20PDF/The%20State%20of%20Shadow%20IT%20-%20Cledara.pdf
- In 2022, 65% of SaaS apps were unsanctioned, adopted by users without IT's knowledge or approval, according to BetterCloud's State of SaaSOps survey. Source: BetterCloud, 2023 State of SaaSOps (2023); Survey. https://pages.bettercloud.com/rs/719-KZY-706/images/2023-StateofSaaSOps-report-final.pdf
- Gartner research found 41% of employees are 'business technologists' who build technology or analytics capabilities outside of IT departments. Source: Gartner, Gartner Survey Finds Rise in Business Technologists is Driving Funding for Tech Purchases Outside of IT (press release) (2022); Survey. https://www.gartner.com/en/newsroom/press-releases/2022-03-13-gartner-survey-finds-rise-in-business-technologists-is-driving-funding-for-tech-purchases-outside-of-it
- Gartner found 74% of technology purchases are funded at least partly by business units outside of IT; only 26% are funded entirely by the IT organization. Source: Gartner, Gartner Survey Finds Rise in Business Technologists is Driving Funding for Tech Purchases Outside of IT (press release) (2022); Survey. https://www.gartner.com/en/newsroom/press-releases/2022-03-13-gartner-survey-finds-rise-in-business-technologists-is-driving-funding-for-tech-purchases-outside-of-it

### Why employees go around IT

- According to 1Password's 2025 Access-Trust Gap report, 52% of employees have downloaded apps without IT approval. Source: 1Password, Annual Report 2025: The Access-Trust Gap (2025); Survey. https://1password.com/reports/annual-report-2025
- 1Password's 2025 Access-Trust Gap report found 42% of employees bypass IT to boost their productivity. Source: 1Password, Annual Report 2025: The Access-Trust Gap (press release) (2025); Survey. https://1password.com/press/2025/oct/annual-report-2025-the-access-trust-gap
- Shadow IT varies by country: 55% of employees in Singapore admit downloading apps without IT approval, versus 46% in Germany, 44% in the U.S., 43% in the UK and 33% in France, per 1Password's 2025 report. Source: 1Password, Annual Report 2025: The Access-Trust Gap (press release) (2025); Survey. https://1password.com/press/2025/oct/annual-report-2025-the-access-trust-gap
- 27% of office workers say they regularly use unauthorized tools and apps out of frustration with their employer-provided tools, according to Ivanti's 2025 Digital Employee Experience Report. Source: Ivanti, 2025 Digital Employee Experience (DEX) Report (2025); Survey. https://www.ivanti.com/resources/research-reports/2025-digital-employee-experience-report
- Nearly 40% of office workers say they bypass employer-provided tech support entirely when they hit a technology problem, usually because they can fix it faster themselves, per Ivanti. Source: Ivanti, 2025 Digital Employee Experience (DEX) Report (2025); Survey. https://www.ivanti.com/resources/research-reports/2025-digital-employee-experience-report
- A Gartner survey found 69% of employees had bypassed their organization's cybersecurity guidance in the past 12 months. Source: Gartner (via Help Net Security), Gartner Predicts Nearly Half of Cybersecurity Leaders Will Change Jobs by 2025 (coverage) (2023); Survey. https://www.helpnetsecurity.com/2023/02/24/bypass-cybersecurity-guidance/
- 74% of employees told Gartner they would bypass cybersecurity guidance if it helped them or their team achieve a business objective. Source: Gartner (via Help Net Security), Gartner Predicts Nearly Half of Cybersecurity Leaders Will Change Jobs by 2025 (coverage) (2023); Survey. https://www.helpnetsecurity.com/2023/02/24/bypass-cybersecurity-guidance/
- Across 200 companies, Cledara counted 23.6 million instances of shadow IT usage over 30 days: an employee opened an unauthorized app every 4.9 seconds of the workday. Source: Cledara, The State of Shadow IT (2023); Observed data. https://resources.cledara.com/hubfs/eBooks%20PDF/The%20State%20of%20Shadow%20IT%20-%20Cledara.pdf

### Personal accounts, devices and extensions

- Per LayerX's Browser Security Report 2025, 68% of logins to SaaS apps using corporate accounts happen without single sign-on. Source: LayerX Security, Browser Security Report 2025 (2025); Observed data. https://go.layerxsecurity.com/hubfs/Browser_Security_Report_2025.pdf
- Where BYOD is banned, 78% of employees use personal devices for work anyway, according to Ivanti's Securing the Borderless Digital Landscape report. Source: Ivanti, Securing the Borderless Digital Landscape (2025); Survey. https://www.ivanti.com/resources/research-reports/borderless-security
- According to Netskope's Cloud and Threat Report 2026, 31% of users in the average organization upload data to personal cloud apps every month. Source: Netskope, Cloud and Threat Report: 2026 (2026); Observed data. https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- Netskope reports the share of users uploading data to personal cloud apps grew 21% over the past year. Source: Netskope, Cloud and Threat Report: 2026 (2026); Observed data. https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- Google Drive is the personal app organizations most often control, with 43% applying real-time protections, followed by Gmail (31%) and OneDrive (28%), per Netskope. Source: Netskope, Cloud and Threat Report: 2026 (2026); Observed data. https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- LayerX's Browser Security Report 2025 found 43% of SaaS applications in organizational networks are accessed with personal (non-corporate) credentials. Source: LayerX Security, Browser Security Report 2025 (2025); Observed data. https://go.layerxsecurity.com/hubfs/Browser_Security_Report_2025.pdf
- LayerX telemetry shows 83% of logins to ERP systems and 71% of logins to CRM systems happen without SSO. Source: LayerX Security, Browser Security Report 2025 (2025); Observed data. https://go.layerxsecurity.com/hubfs/Browser_Security_Report_2025.pdf
- 87% of employee activity in chat and instant-messaging apps happens through personal, non-corporate accounts, according to LayerX's Browser Security Report 2025. Source: LayerX Security, Browser Security Report 2025 (2025); Observed data. https://go.layerxsecurity.com/hubfs/Browser_Security_Report_2025.pdf
- Even in Salesforce, 77% of logins observed by LayerX came from non-corporate accounts, as did 68% of Microsoft Online and 64% of Zoom logins. Source: LayerX Security, Enterprise AI and SaaS Data Security Report 2025 (2025); Observed data. https://go.layerxsecurity.com/hubfs/LayerX_Enterprise_AI_and_SaaS_Data_Security_Report.pdf
- 38% of file uploads to file storage and sharing platforms are made through personal accounts, and 41% of files uploaded there contain PII or payment card data, per LayerX. Source: LayerX Security, Enterprise AI and SaaS Data Security Report 2025 (2025); Observed data. https://go.layerxsecurity.com/hubfs/LayerX_Enterprise_AI_and_SaaS_Data_Security_Report.pdf
- 99% of enterprise users have at least one browser extension installed, and 53% have more than 10, according to LayerX's Enterprise Browser Extension Security Report 2025. Source: LayerX Security, Enterprise Browser Extension Security Report 2025 (press release) (2025); Observed data. https://www.globenewswire.com/news-release/2025/04/15/3061792/0/en/LayerX-Security-Enterprise-Browser-Extension-Security-Report-2025-Finds-Widespread-Usage-Makes-Nearly-Every-Employee-an-Attack-Vector.html
- 53% of enterprise users have installed browser extensions with 'high' or 'critical' permission scopes, able to access cookies, passwords and browsing data, per LayerX. Source: LayerX Security, Enterprise Browser Extension Security Report 2025 (press release) (2025); Observed data. https://www.globenewswire.com/news-release/2025/04/15/3061792/0/en/LayerX-Security-Enterprise-Browser-Extension-Security-Report-2025-Finds-Widespread-Usage-Makes-Nearly-Every-Employee-an-Attack-Vector.html
- 17% of browser extensions installed by enterprise users come from non-official stores and 26% are side-loaded by external applications, according to LayerX's Browser Security Report 2025. Source: LayerX Security, Browser Security Report 2025 (2025); Observed data. https://go.layerxsecurity.com/hubfs/Browser_Security_Report_2025.pdf
- 54% of browser extension publishers use a free webmail account, and 79% have published only a single extension, per LayerX. Source: LayerX Security, Enterprise Browser Extension Security Report 2025 (press release) (2025); Observed data. https://www.globenewswire.com/news-release/2025/04/15/3061792/0/en/LayerX-Security-Enterprise-Browser-Extension-Security-Report-2025-Finds-Widespread-Usage-Makes-Nearly-Every-Employee-an-Attack-Vector.html
- 51% of all browser extensions haven't received an update in over a year, LayerX reports. Source: LayerX Security, Enterprise Browser Extension Security Report 2025 (press release) (2025); Observed data. https://www.globenewswire.com/news-release/2025/04/15/3061792/0/en/LayerX-Security-Enterprise-Browser-Extension-Security-Report-2025-Finds-Widespread-Usage-Makes-Nearly-Every-Employee-an-Attack-Vector.html
- Verizon's 2025 Data Breach Investigations Report found 46% of systems compromised by infostealer malware that held corporate logins were non-managed devices, most likely personal devices or devices used outside policy. Source: Verizon, 2025 Data Breach Investigations Report (2025); Observed data. https://www.verizon.com/business/resources/Te3/reports/2025-dbir-data-breach-investigations-report.pdf
- Three in four IT workers say BYOD is a regular occurrence at their organization, though only 52% say it is explicitly allowed, per Ivanti. Source: Ivanti, Securing the Borderless Digital Landscape (2025); Survey. https://www.ivanti.com/resources/research-reports/borderless-security
- 84% of organizations say employees access company networks from unmanaged devices, according to Cisco's 2025 Cybersecurity Readiness Index. Source: Cisco, 2025 Cybersecurity Readiness Index (2025); Survey. https://newsroom.cisco.com/c/dam/r/newsroom/en/us/interactive/cybersecurity-readiness-index/2025/documents/2025_Cisco_Cybersecurity_Readiness_Index.pdf
- One in two office workers use personal devices to log into work networks and software, and 32% of them say their employer doesn't know, according to Ivanti research. Source: Ivanti, Digital Employee Experience (DEX) Security Research Report (2024); Survey. https://www.ivanti.com/resources/research-reports/dex-security
- 47% of companies let employees access company resources from unmanaged devices using credentials alone, according to Kolide's (now 1Password) Shadow IT report. Source: 1Password (Kolide), The Shadow IT Report (2024); Survey. https://1password.com/blog/unmanaged-devices-run-rampant
- 49% of developers report doing software development on personal devices, and 35% of security professionals use personal devices to manage cloud infrastructure, per Kolide's Shadow IT report. Source: 1Password (Kolide), The Shadow IT Report (2024); Survey. https://1password.com/blog/unmanaged-devices-run-rampant
- 35% of IT respondents said users had forwarded work email to their personal email accounts, per BetterCloud's 2023 State of SaaSOps report. Source: BetterCloud, 2023 State of SaaSOps (2023); Survey. https://pages.bettercloud.com/rs/719-KZY-706/images/2023-StateofSaaSOps-report-final.pdf
- Companies with more than 2,000 employees have an average of 1,454 different browser extensions installed, according to Spin.AI's analysis of its customers. Source: Spin.AI, Browser Extension Risk Report (2023); Observed data. https://spin.ai/blog/browser-extension-risk-report/

### What shadow IT costs

- Netskope's Cloud and Threat Report 2026 found that 60% of insider threat incidents involve personal cloud app instances. Source: Netskope, Cloud and Threat Report: 2026 (2026); Observed data. https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- Regulated data (personal, financial and healthcare information) accounts for 54% of data policy violations linked to personal cloud apps, per Netskope's Cloud and Threat Report 2026. Source: Netskope, Cloud and Threat Report: 2026 (2026); Observed data. https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- 77% of organizations now place real-time controls on data being sent to personal apps, up from 70% a year earlier, according to Netskope. Source: Netskope, Cloud and Threat Report: 2026 (2026); Observed data. https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- In 1Password's 2025 survey, 49% of security and IT professionals said employee use of unapproved software has compromised their ability to maintain adequate protections. Source: 1Password, Annual Report 2025: The Access-Trust Gap (press release) (2025); Survey. https://1password.com/press/2025/oct/annual-report-2025-the-access-trust-gap
- 56% of organizations say employees upload sensitive data to unauthorized SaaS apps, per the Cloud Security Alliance's 2025 State of SaaS Security Report. Source: Cloud Security Alliance (commissioned by Valence Security), State of SaaS Security Report 2025 (2025); Survey. https://cloudsecurityalliance.org/artifacts/state-of-saas-security-report-2025
- In JumpCloud's Q1 2025 SME IT Trends survey, 90% of SME IT professionals said they worry about employees using unauthorized apps, yet 38% have no full app discovery process. Source: JumpCloud, SME IT Trends Report Q1 2025 (2025); Survey. https://jumpcloud.com/blog/sme-it-report-q1-2025
- 38% of SME IT professionals say they don't have a full process for discovering the apps employees use, according to JumpCloud's Q1 2025 SME IT Trends report. Source: JumpCloud, SME IT Trends Report Q1 2025 (2025); Survey. https://jumpcloud.com/blog/sme-it-report-q1-2025
- Nearly 60% of IT professionals remain concerned about the risks of shadow IT, according to BetterCloud's State of SaaS 2025 report. Source: BetterCloud, State of SaaS 2025 (2025); Survey. https://www.prnewswire.com/news-releases/state-of-saas-2025-report-reveals-operational-complexity-and-risk-concerns-as-economic-uncertainty-and-ai-apply-spending-pressure-on-technology-investments-302441868.html
- 45% of IT professionals say they lack sufficient data about shadow IT, and 38% lack sufficient data about the devices accessing their network, per Ivanti. Source: Ivanti, Securing the Borderless Digital Landscape (2025); Survey. https://www.ivanti.com/resources/research-reports/borderless-security
- 58% of IT leaders have encountered issues due to unsanctioned SaaS usage, according to Flexera's 2026 IT Priorities Report. Source: Flexera, 2026 IT Priorities Report (2025); Survey. https://www.flexera.com/about-us/press-center/flexera-report-reveals-priorities-driving-it-strategy-for-2026-ai-takes-the-lead
- IBM's Cost of a Data Breach Report 2024 found more than one-third of breaches involved shadow data stored in unmanaged data sources. Source: IBM / Ponemon Institute, Cost of a Data Breach Report 2024 (2024); Observed data. https://newsroom.ibm.com/2024-07-30-ibm-report-escalating-data-breach-disruption-pushes-costs-to-new-highs
- SME IT leaders surveyed by JumpCloud attributed 37% of the breaches their organizations suffered in the first half of 2024 to shadow IT. Source: JumpCloud, SME IT Trends Report (Q3 2024) (2024); Survey. https://jumpcloud.com/blog/sme-it-report-q3-2024
- 84% of SMEs are concerned about shadow IT, according to JumpCloud's mid-2024 SME IT Trends survey. Source: JumpCloud, SME IT Trends Report (Q3 2024) (2024); Survey. https://jumpcloud.com/blog/sme-it-report-q3-2024
- Kaspersky research found 11% of companies worldwide suffered cyber incidents caused by employees' use of shadow IT over two years; in the IT industry, 16% of incidents were due to shadow IT. Source: Kaspersky, In the shadows: the risks unauthorised IT products pose to business (press release; data from Kaspersky Human Factor 360 report 2023) (2023); Survey. https://www.kaspersky.co.uk/about/press-releases/in-the-shadows-the-risks-unauthorised-it-products-pose-to-business
- In the U.S., 13% of cyber incidents companies suffered over two years were caused by the use of shadow IT, according to Kaspersky. Source: Kaspersky, Kaspersky uncovers the risks unauthorized IT products pose to businesses (press release) (2023); Survey. https://usa.kaspersky.com/about/press-releases/kaspersky-uncovers-the-risks-unauthorized-it-products-pose-to-businesses
- 76% of SMBs that had high-impact shadow IT efforts say the effort posed a moderate to severe cybersecurity threat, per Capterra. Source: Capterra (Gartner Digital Markets), Shadow IT Teams Cost Your SMB Time and Money (2023); Survey. https://www.capterra.com/resources/shadow-it-teams-cost-your-smb-time-and-money-but-they-dont-have-to/
- 89% of SMBs with high-impact shadow IT efforts report negative financial consequences, yet 80% also report a positive long-term financial impact, Capterra found. Source: Capterra (Gartner Digital Markets), Shadow IT Teams Cost Your SMB Time and Money (2023); Survey. https://www.capterra.com/resources/shadow-it-teams-cost-your-smb-time-and-money-but-they-dont-have-to/
- 91% of SMBs that had high-impact shadow IT efforts report challenges integrating the shadow IT work into their official environments, according to Capterra. Source: Capterra (Gartner Digital Markets), Shadow IT Teams Cost Your SMB Time and Money (2023); Survey. https://www.capterra.com/resources/shadow-it-teams-cost-your-smb-time-and-money-but-they-dont-have-to/
- Cledara's analysis of SaaS spend data finds shadow IT accounts for about 35-40% of total SaaS spend at the median company, and as much as 60-70% at some. Source: Cledara, The True Cost of Shadow IT (blog); Observed data. https://www.cledara.com/blog/shadow-it-costs-saas

## Shadow AI statistics

AI is now the quickest way around IT: 26 of the top 50 shadow IT apps are pure-play AI tools.

### Employees bring their own AI

- According to the University of Melbourne and KPMG's 2025 global study, 57% of employees admit to hiding their AI use or presenting AI-generated content as their own. Source: University of Melbourne and KPMG, Trust, attitudes and use of Artificial Intelligence: A global study 2025 (2025); Survey. https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2025/05/trust-attitudes-and-use-of-ai-global-report.pdf
- According to Microsoft and LinkedIn's 2024 Work Trend Index, 78% of AI users at work are bringing their own AI tools to work (BYOAI). Source: Microsoft and LinkedIn, 2024 Work Trend Index Annual Report (2024); Survey. https://news.microsoft.com/source/2024/05/08/microsoft-and-linkedin-release-the-2024-work-trend-index-on-the-state-of-ai-at-work/
- ChatGPT leads Torii's AI Leaders of 2025 with a 95.3% adoption rate, followed by Zapier (93.9%) and Grammarly (93.3%), according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- Grok has a 76% shadow rate against 65% adoption, compared with ChatGPT's 28% shadow rate, according to Torii's 2026 SaaS Benchmark LLM adoption vs shadow IT chart. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- According to Netskope's Cloud and Threat Report 2026, 47% of genAI users at work use personal AI apps, down from 78% a year earlier. Source: Netskope Threat Labs, Cloud and Threat Report: 2026 (2026); Observed data. https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- According to Netskope's AI Report 2026, the share of enterprise users using AI apps weekly rose from 34% to 59% in the median organization over the past year. Source: Netskope Threat Labs, Netskope AI Report: 2026 (2026); Observed data. https://www.netskope.com/resources/threat-labs-reports/netskope-ai-report-2026
- According to Netskope's AI Report 2026, 30% of AI users use only personal AI apps and another 14% mix personal and organization-managed apps. Source: Netskope Threat Labs, Netskope AI Report: 2026 (2026); Observed data. https://www.netskope.com/resources/threat-labs-reports/netskope-ai-report-2026
- According to Cyberhaven's 2026 AI Adoption & Risk Report, 32.3% of ChatGPT usage and 24.9% of Gemini usage at work happens through personal accounts. Source: Cyberhaven Labs, 2026 AI Adoption & Risk Report (2026); Observed data. https://www.cyberhaven.com/press-releases/cyberhaven-2026-ai-adoption-risk-report
- According to Harmonic Security's analysis of 22.4 million enterprise AI prompts in 2025, 16.9% of all sensitive data exposures flowed through personal free-tier AI accounts where IT has no visibility. Source: Harmonic Security, What 22 Million Enterprise AI Prompts Reveal About Shadow AI in 2025 (AI Usage Index) (2026); Observed data. https://www.harmonic.security/resources/what-22-million-enterprise-ai-prompts-reveal-about-shadow-ai-in-2025
- According to LayerX's State of AI Usage Report 2026, 47% of enterprise AI conversations are done through personal identities rather than corporate accounts. Source: LayerX Security, State of AI Usage Report 2026 (2026); Observed data. https://layerxsecurity.com/library/reports/state-of-ai-usage-report-2026/
- According to ISACA's 2026 AI Pulse Poll, 90% of digital trust professionals believe employees are using AI in their organization, but only 22% say AI ROI has met or exceeded expectations. Source: ISACA, 2026 AI Pulse Poll (2026); Survey. https://www.isaca.org/about-us/newsroom/press-releases/2026/ai-use-accelerates-while-governance-and-roi-lag-says-new-isaca-research
- According to Deloitte UK's 2026 GenAI Workforce Survey of 25,000 UK workers, 31% of GenAI users use GenAI without their employer's knowledge and bring their own tools to work. Source: Deloitte UK, GenAI Workforce Survey 2026 (inaugural edition) (2026); Survey. https://www.deloitte.com/uk/en/about/press-room/british-workers-spend-one-billion-pounds-of-their-own-money-on-gen-ai-for-work.html
- According to Deloitte UK's 2026 GenAI Workforce Survey, UK workers spend an estimated £958 million a year of their own money on GenAI tools for work, with one in six GenAI users paying for at least one tool themselves. Source: Deloitte UK, GenAI Workforce Survey 2026 (inaugural edition) (2026); Survey. https://www.deloitte.com/uk/en/about/press-room/british-workers-spend-one-billion-pounds-of-their-own-money-on-gen-ai-for-work.html
- According to Harmonic Security's Q1 2025 research, 45.4% of sensitive AI interactions came from personal email accounts. Source: Harmonic Security, The AI Tightrope: Balancing Innovation and Exposure in the Enterprise (Q1 2025) (2025); Observed data. https://www.harmonic.security/resources/how-many-ai-tools-are-employees-using-more-than-you-think-and-often-with-personal-accounts
- According to a TELUS Digital survey, nearly 68% of enterprise employees who use GenAI at work access public AI assistants through personal accounts. Source: TELUS Digital, AI at Work survey (shadow AI) (2025); Survey. https://www.telusdigital.com/about/newsroom/telus-digital-survey-reveals-enterprise-employees-use-of-shadow-ai
- According to the University of Melbourne and KPMG's 2025 global study, 56% of employees say they have used AI tools at work without knowing if it is allowed. Source: University of Melbourne and KPMG, Trust, attitudes and use of Artificial Intelligence: A global study 2025 (2025); Survey. https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2025/05/trust-attitudes-and-use-of-ai-global-report.pdf
- According to UpGuard's State of Shadow AI report, 8 out of 10 employees use unauthorized AI tools, and 68% of security leaders admit to incorporating unauthorized AI into their daily workflows. Source: UpGuard, State of Shadow AI (2025); Survey. https://www.upguard.com/press/new-research-from-upguard-reveals-68-of-security-leaders-admit-to-unauthorized-ai-usage
- According to UpGuard's State of Shadow AI report, 8 out of 10 employees worldwide use unauthorized AI tools. Source: UpGuard, State of Shadow AI (2025); Survey. https://www.upguard.com/press/new-research-from-upguard-reveals-68-of-security-leaders-admit-to-unauthorized-ai-usage
- According to Ivanti's 2025 Technology at Work Report, nearly a third (32%) of employees who use GenAI tools at work keep it a secret from their employer. Source: Ivanti, 2025 Technology at Work Report: Reshaping Flexible Work (2025); Survey. https://www.ivanti.com/company/press-releases/2025/nearly-a-third-of-employees-are-keeping-their-ai-driven-productivity-a-secret-finds-ivanti-research
- According to Ivanti's 2025 Technology at Work Report, 42% of employees admit to using GenAI at work in 2025, up from 26% in 2024. Source: Ivanti, 2025 Technology at Work Report: Reshaping Flexible Work (2025); Survey. https://www.ivanti.com/company/press-releases/2025/nearly-a-third-of-employees-are-keeping-their-ai-driven-productivity-a-secret-finds-ivanti-research
- According to MIT NANDA's State of AI in Business 2025 report, only 40% of companies say they purchased an official LLM subscription, yet workers at over 90% of companies surveyed reported regular use of personal AI tools for work. Source: MIT NANDA (Project NANDA, MIT Media Lab), The GenAI Divide: State of AI in Business 2025 (2025); Survey. https://mlq.ai/media/quarterly_decks/v0.1_State_of_AI_in_Business_2025_Report.pdf
- According to 1Password's 2025 Access-Trust Gap report, 73% of employees are encouraged to use AI at work, but 37% say they follow their company's AI policies only 'most of the time.' Source: 1Password, 2025 Annual Report: The Access-Trust Gap (2025); Survey. https://1password.com/reports/annual-report-2025
- Menlo Ventures found that 27% of all AI application spend enters companies through product-led growth (individual users), nearly 4x the 7% rate in traditional software, and close to 40% when personal-card shadow AI is counted. Source: Menlo Ventures, 2025: The State of Generative AI in the Enterprise (2025); Survey. https://menlovc.com/perspective/2025-the-state-of-generative-ai-in-the-enterprise/
- According to Microsoft and LinkedIn's 2024 Work Trend Index, 75% of knowledge workers now use AI at work. Source: Microsoft and LinkedIn, 2024 Work Trend Index Annual Report (2024); Survey. https://news.microsoft.com/source/2024/05/08/microsoft-and-linkedin-release-the-2024-work-trend-index-on-the-state-of-ai-at-work/
- According to a Software AG study of 6,000 knowledge workers, half of all employees use shadow AI, and 46% would refuse to stop even if their organization banned it. Source: Software AG, Shadow AI study (press release) (2024); Survey. https://news.europawire.eu/software-ag-study-finds-half-of-employees-use-shadow-ai-urging-businesses-to-strengthen-ai-strategies/eu-press-release/2024/10/22/18/51/00/142707/
- According to a Software AG study, half of all employees are using shadow AI, meaning AI tools not provided by their companies. Source: Software AG, Shadow AI study (press release) (2024); Survey. https://news.europawire.eu/software-ag-study-finds-half-of-employees-use-shadow-ai-urging-businesses-to-strengthen-ai-strategies/eu-press-release/2024/10/22/18/51/00/142707/
- According to Salesforce's 2023 Generative AI Snapshot research, 28% of workers use generative AI at work, and over half of them do so without formal approval from their employer. Source: Salesforce, Generative AI Snapshot Research Series: The Promises and Pitfalls of AI at Work (2023); Survey. https://www.salesforce.com/news/stories/ai-at-work-research/

### What goes into the prompt

- According to the University of Melbourne and KPMG's 2025 global study of 48,000 people in 47 countries, about half (48 to 49%) of employees have uploaded sensitive company information or copyrighted material into public AI tools. Source: University of Melbourne and KPMG, Trust, attitudes and use of Artificial Intelligence: A global study 2025 (2025); Survey. https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2025/05/trust-attitudes-and-use-of-ai-global-report.pdf
- According to Netskope's Cloud and Threat Report 2026, the average organization sees 223 incidents per month of users sending sensitive data to genAI apps, double the year before. Source: Netskope Threat Labs, Cloud and Threat Report: 2026 (2026); Observed data. https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- According to Netskope's Cloud and Threat Report 2026, source code (42%), regulated data (32%) and intellectual property (16%) were the top data types in genAI data policy violations. Source: Netskope Threat Labs, Cloud and Threat Report: 2026 (2026); Observed data. https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- According to Cyberhaven's 2026 AI Adoption & Risk Report, 39.7% of all data movements into AI tools involve sensitive data. Source: Cyberhaven Labs, 2026 AI Adoption & Risk Report (2026); Observed data. https://www.cyberhaven.com/press-releases/cyberhaven-2026-ai-adoption-risk-report
- According to Cyberhaven's 2026 AI Adoption & Risk Report, the average employee enters sensitive data into AI tools once every three days. Source: Cyberhaven Labs, 2026 AI Adoption & Risk Report (2026); Observed data. https://www.cyberhaven.com/press-releases/cyberhaven-2026-ai-adoption-risk-report
- According to Harmonic Security, 12.8% of sensitive data exposures in AI coding tools contain API keys, tokens or other credentials. Source: Harmonic Security, What 22 Million Enterprise AI Prompts Reveal About Shadow AI in 2025 (AI Usage Index) (2026); Observed data. https://www.harmonic.security/resources/what-22-million-enterprise-ai-prompts-reveal-about-shadow-ai-in-2025
- According to LayerX's State of AI Usage Report 2026, more than 1 in 12 ChatGPT conversations in the enterprise contains sensitive information. Source: LayerX Security, State of AI Usage Report 2026 (2026); Observed data. https://layerxsecurity.com/library/reports/state-of-ai-usage-report-2026/
- According to Zscaler's ThreatLabz 2026 AI Security Report, enterprise data transfers to AI/ML applications surged 93% in 2025 to 18,033 terabytes. Source: Zscaler ThreatLabz, ThreatLabz 2026 AI Security Report (2026); Observed data. https://www.zscaler.com/press/zscaler-2026-ai-threat-report-83-year-over-year-surge-ai-activity-creates-growing-oversight
- According to Zscaler's ThreatLabz 2026 AI Security Report, ChatGPT alone was tied to 410 million data loss prevention policy violations in 2025. Source: Zscaler ThreatLabz, ThreatLabz 2026 AI Security Report (2026); Observed data. https://www.zscaler.com/press/zscaler-2026-ai-threat-report-83-year-over-year-surge-ai-activity-creates-growing-oversight
- According to Cyberhaven's 2025 AI Adoption and Risk Report, 34.8% of the corporate data employees put into AI tools is sensitive, up from 10.7% two years earlier. Source: Cyberhaven Labs, 2025 AI Adoption and Risk Report (2025); Observed data. https://www.cyberhaven.com/press-releases/cyberhaven-report-majority-of-corporate-ai-tools-present-critical-data-security-risks
- According to Cyberhaven's 2025 AI Adoption and Risk Report, 71.7% of AI tools used in workplaces are high or critical risk, and 83.8% of enterprise data going to AI flows to these risky tools. Source: Cyberhaven Labs, 2025 AI Adoption and Risk Report (2025); Observed data. https://www.cyberhaven.com/press-releases/cyberhaven-report-majority-of-corporate-ai-tools-present-critical-data-security-risks
- According to Harmonic Security's Q3 2025 analysis, 26.38% of files uploaded to GenAI tools contained sensitive information, up from 22% in Q2. Source: Harmonic Security, GenAI in the Enterprise: It's Getting Personal (Q3 2025) (2025); Observed data. https://www.harmonic.security/resources/genai-in-the-enterprise-its-getting-personal
- According to LayerX's Enterprise AI and SaaS Data Security Report 2025, 40% of files uploaded to GenAI tools contain sensitive PII or PCI data. Source: LayerX Security, Enterprise AI and SaaS Data Security Report 2025 (2025); Observed data. https://layerxsecurity.com/blog/ai-is-now-the-1-data-exfiltration-vector-in-the-enterprise-and-nobodys-watching/
- According to LayerX's Enterprise AI and SaaS Data Security Report 2025, GenAI tools account for 32% of all corporate-to-personal data transfers, making AI the top data exfiltration channel. Source: LayerX Security, Enterprise AI and SaaS Data Security Report 2025 (2025); Observed data. https://layerxsecurity.com/blog/ai-is-now-the-1-data-exfiltration-vector-in-the-enterprise-and-nobodys-watching/
- According to a TELUS Digital survey, 57% of enterprise employees who use GenAI at work admit to entering sensitive information into public AI assistants. Source: TELUS Digital, AI at Work survey (shadow AI) (2025); Survey. https://www.telusdigital.com/about/newsroom/telus-digital-survey-reveals-enterprise-employees-use-of-shadow-ai
- According to UpGuard's State of Shadow AI report, 70% of employees know of sensitive data being shared with AI tools at their workplace. Source: UpGuard, State of Shadow AI (2025); Survey. https://www.upguard.com/press/new-research-from-upguard-reveals-68-of-security-leaders-admit-to-unauthorized-ai-usage
- According to Varonis' 2025 State of Data Security Report, 99% of organizations have exposed sensitive data that can easily be surfaced by AI. Source: Varonis, 2025 State of Data Security Report: Quantifying AI's Impact on Data Risk (2025); Observed data. https://www.varonis.com/blog/state-of-data-security-report
- According to Cisco's 2025 Data Privacy Benchmark Study, 64% of privacy and security professionals worry about inadvertently sharing sensitive information through GenAI, yet nearly half admit inputting personal employee or non-public data into GenAI tools. Source: Cisco, 2025 Data Privacy Benchmark Study (2025); Survey. https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2025/m04/cisco-2025-data-privacy-benchmark-study-privacy-landscape-grows-increasingly-complex-in-the-age-of-ai.html
- According to Cisco's 2024 Data Privacy Benchmark Study, 48% of privacy and security professionals admit entering non-public company information into GenAI tools. Source: Cisco, 2024 Data Privacy Benchmark Study (2024); Survey. https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m01/organizations-ban-use-of-generative-ai-over-data-privacy-security-cisco-study.html

### AI apps multiply faster than reviews

- In 2025, 26 of the top 50 shadow IT apps were pure-play AI tools, according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- Torii discovered 694 new AI-native applications in 2025, more than double the 2023 figure of 317, according to its 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- According to Harmonic Security's Q1 2025 research, the average company interacted with 254 distinct AI applications, not counting mobile or API access. Source: Harmonic Security, The AI Tightrope: Balancing Innovation and Exposure in the Enterprise (Q1 2025) (2025); Observed data. https://www.harmonic.security/resources/how-many-ai-tools-are-employees-using-more-than-you-think-and-often-with-personal-accounts
- New AI-native apps discovered per year grew from 11 in 2020 to 694 in 2025, according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- According to Netskope's Cloud and Threat Report 2026, the amount of data sent to SaaS genAI apps grew sixfold in a year, from 3,000 to 18,000 prompts per month per organization, while user counts tripled. Source: Netskope Threat Labs, Cloud and Threat Report: 2026 (2026); Observed data. https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- According to Netskope's Cloud and Threat Report 2026, the number of genAI apps it tracks grew fivefold to more than 1,600, while the average organization uses 8 AI apps, up from 6. Source: Netskope Threat Labs, Cloud and Threat Report: 2026 (2026); Observed data. https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- According to Cyberhaven's 2026 AI Adoption & Risk Report, the top 1% of early-adopter organizations use more than 300 GenAI tools, while cautious enterprises use fewer than 15. Source: Cyberhaven Labs, 2026 AI Adoption & Risk Report (2026); Observed data. https://www.cyberhaven.com/press-releases/cyberhaven-2026-ai-adoption-risk-report
- According to Harmonic Security, enterprise employees sent prompts to 665 different AI tools in 2025, but six applications accounted for 92.6% of sensitive data exposure. Source: Harmonic Security, What 22 Million Enterprise AI Prompts Reveal About Shadow AI in 2025 (AI Usage Index) (2026); Observed data. https://www.harmonic.security/resources/what-22-million-enterprise-ai-prompts-reveal-about-shadow-ai-in-2025
- According to LayerX's State of AI Usage Report 2026, nearly 75% of AI browser extensions are granted high or critical permissions, and 16.31% have known CVEs. Source: LayerX Security, State of AI Usage Report 2026 (2026); Observed data. https://layerxsecurity.com/library/reports/state-of-ai-usage-report-2026/
- According to Reco's State of Agent Security 2026, small and mid-size firms average 414 unsanctioned AI tools per 1,000 employees, even where 79% of SaaS is authorized. Source: Reco, The State of Agent Security 2026 (2026); Observed data. https://www.reco.ai/state-of-agent-security-2026
- According to Zscaler's ThreatLabz 2026 AI Security Report, the number of applications driving AI/ML transactions quadrupled year over year to more than 3,400. Source: Zscaler ThreatLabz, ThreatLabz 2026 AI Security Report (2026); Observed data. https://www.zscaler.com/press/zscaler-2026-ai-threat-report-83-year-over-year-surge-ai-activity-creates-growing-oversight
- According to Zscaler's ThreatLabz 2026 AI Security Report, enterprise AI/ML activity increased 83% year over year in 2025. Source: Zscaler ThreatLabz, ThreatLabz 2026 AI Security Report (2026); Observed data. https://www.zscaler.com/press/zscaler-2026-ai-threat-report-83-year-over-year-surge-ai-activity-creates-growing-oversight
- According to Cyberhaven's 2025 AI Adoption and Risk Report, the frequency of AI use at work grew 4.6x in 12 months and 61x over 24 months. Source: Cyberhaven Labs, 2025 AI Adoption and Risk Report (2025); Observed data. https://www.cyberhaven.com/press-releases/cyberhaven-report-majority-of-corporate-ai-tools-present-critical-data-security-risks
- According to Harmonic Security's Q3 2025 analysis, the average organization's employees used 27 distinct AI tools in the quarter. Source: Harmonic Security, GenAI in the Enterprise: It's Getting Personal (Q3 2025) (2025); Observed data. https://www.harmonic.security/resources/genai-in-the-enterprise-its-getting-personal
- According to LayerX's Enterprise Browser Extension Security Report 2025, over 20% of enterprise users have a GenAI-enabled browser extension installed, and 58% of GenAI extensions have high or critical permissions. Source: LayerX Security, Enterprise Browser Extension Security Report 2025 (2025); Observed data. https://www.globenewswire.com/news-release/2025/04/15/3061792/0/en/LayerX-Security-Enterprise-Browser-Extension-Security-Report-2025-Finds-Widespread-Usage-Makes-Nearly-Every-Employee-an-Attack-Vector.html
- According to Menlo Security's 2025 report, web traffic to GenAI sites jumped 50%, from 7 billion visits in February 2024 to 10.53 billion in January 2025. Source: Menlo Security, 2025 Report: How AI is Shaping the Modern Workspace (2025); Observed data. https://www.menlosecurity.com/press-releases/menlo-securitys-2025-report-uncovers-68-surge-in-shadow-generative-ai-usage-in-the-modern-enterprise
- According to Palo Alto Networks' State of Generative AI 2025, GenAI traffic surged more than 890% in 2024. Source: Palo Alto Networks, The State of Generative AI in 2025 (2025); Observed data. https://www.paloaltonetworks.com/resources/research/state-of-genai-2025
- According to Palo Alto Networks' State of Generative AI 2025, organizations used an average of 66 GenAI apps, with 10% classified as high risk. Source: Palo Alto Networks, The State of Generative AI in 2025 (2025); Observed data. https://www.paloaltonetworks.com/resources/research/state-of-genai-2025
- According to Reco's 2025 State of Shadow AI Report, small businesses average 269 shadow AI tools per 1,000 employees, and 27% of employees at companies with 11 to 50 workers use unsanctioned AI tools. Source: Reco, 2025 State of Shadow AI Report (2025); Observed data. https://www.reco.ai/state-of-shadow-ai-report

### Policy hasn't caught up

- According to ISACA's 2026 AI Pulse Poll, only 38% of organizations have a formal, comprehensive AI policy, up from 28% in 2025, and 25% have no active policy. Source: ISACA, 2026 AI Pulse Poll (2026); Survey. https://www.isaca.org/about-us/newsroom/press-releases/2026/ai-use-accelerates-while-governance-and-roi-lag-says-new-isaca-research
- According to Netskope's Cloud and Threat Report 2026, 50% of organizations lack enforceable data protection policies for genAI apps. Source: Netskope Threat Labs, Cloud and Threat Report: 2026 (2026); Observed data. https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- According to Netskope's Cloud and Threat Report 2026, 90% of organizations actively block at least one genAI app, blocking 10 apps on average. Source: Netskope Threat Labs, Cloud and Threat Report: 2026 (2026); Observed data. https://www.netskope.com/resources/cloud-and-threat-reports/cloud-and-threat-report-2026
- According to ISACA's 2026 AI Pulse Poll, 56% of digital trust professionals do not know how quickly they could halt an AI system during a security incident. Source: ISACA, 2026 AI Pulse Poll (preview, RSA Conference) (2026); Survey. https://www.isaca.org/about-us/newsroom/press-releases/2026/digital-trust-pros-dont-know-how-fast-they-could-shut-down-ai-after-a-security-incident
- According to ISACA's 2026 AI Pulse Poll, 20% of respondents don't know who would be responsible if an AI system caused harm or serious error in their organization. Source: ISACA, 2026 AI Pulse Poll (preview, RSA Conference) (2026); Survey. https://www.isaca.org/about-us/newsroom/press-releases/2026/digital-trust-pros-dont-know-how-fast-they-could-shut-down-ai-after-a-security-incident
- According to ISACA's 2026 AI Pulse Poll in Europe, 87% of professionals are concerned about employees using AI in an unauthorized capacity. Source: ISACA, 2026 AI Pulse Poll (Europe findings) (2026); Survey. https://www.isaca.org/about-us/newsroom/press-releases/2026/a-third-of-european-organisations-dont-know-if-they-have-been-hit-by-an-ai-powered-cyberattack
- According to Check Point's 2026 Cloud Security Report, 77% of organizations have updated their security strategy in response to AI, but only 26% have the architecture to enforce it. Source: Check Point Software, 2026 Cloud Security Report: Enter the AI Era (2026); Survey. https://www.checkpoint.com/press-releases/ai-adoption-creates-critical-cloud-security-gaps-for-enterprises-new-check-point-report-shows/
- According to Check Point's 2026 Cloud Security Report, 24% of organizations have no AI-specific access controls, and only 16% enforce controls consistently. Source: Check Point Software, 2026 Cloud Security Report: Enter the AI Era (2026); Survey. https://www.checkpoint.com/press-releases/ai-adoption-creates-critical-cloud-security-gaps-for-enterprises-new-check-point-report-shows/
- Flexera found nearly half of organizations don't always know how or when employees are using AI tools, and 85% say IT visibility gaps pose a major risk. Source: Flexera, Flexera 2026 AI Pulse Report (2026); Survey. https://www.flexera.com/blog/perspectives/flexera-2026-ai-pulse-report-what-leaders-need-to-know-about-ais-accelerating-impact/
- According to Deloitte UK's 2026 GenAI Workforce Survey, 65% of GenAI users report a lack of convincing leadership on how GenAI should be used in their organisation. Source: Deloitte UK, GenAI Workforce Survey 2026 (inaugural edition) (2026); Survey. https://www.deloitte.com/uk/en/about/press-room/british-workers-spend-one-billion-pounds-of-their-own-money-on-gen-ai-for-work.html
- According to EY's 2026 AI Risk and Governance Survey, 47% of senior AI executives say their organization has skipped its AI governance process for urgent deployments, even though 98% have formal AI governance policies. Source: EY (Ernst & Young LLP, EY US), AI Risk and Governance Survey 2026 (2026); Survey. https://www.ey.com/en_us/newsroom/2026/09/ey-survey-finds-that-autonomous-ai-implementation-outpaces-oversight-yielding-an-ai-governance-gap
- According to EY's 2026 AI Risk and Governance Survey, 26% of senior AI executives at organizations using agentic AI say their organization cannot detect unauthorized AI agents operating internally. Source: EY (Ernst & Young LLP, EY US), AI Risk and Governance Survey 2026 (2026); Survey. https://www.ey.com/en_us/newsroom/2026/09/ey-survey-finds-that-autonomous-ai-implementation-outpaces-oversight-yielding-an-ai-governance-gap
- According to EY's 2026 AI Risk and Governance Survey, 46% of senior AI executives say their organization encountered shadow AI risk in the past year. Source: EY (Ernst & Young LLP, EY US), AI Risk and Governance Survey 2026 (2026); Survey. https://www.ey.com/en_us/newsroom/2026/09/ey-survey-finds-that-autonomous-ai-implementation-outpaces-oversight-yielding-an-ai-governance-gap
- According to ISACA's 2026 State of Cybersecurity survey of 1,800+ cybersecurity professionals, only 8% of organizations regularly conduct AI-specific incident response exercises. Source: ISACA, State of Cybersecurity 2026 (2026); Survey. https://www.isaca.org/about-us/newsroom/press-releases/2026/only-8-percent-of-organizations-global-enterprises-conduct-regular-ai-specific-response-exercises
- According to IBM's Cost of a Data Breach Report 2025, 97% of organizations that suffered an AI-related breach lacked proper AI access controls. Source: IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025 (2025); Observed data. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
- According to IBM's Cost of a Data Breach Report 2025, 63% of breached organizations either don't have an AI governance policy or are still developing one. Source: IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025 (2025); Observed data. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
- According to IBM's Cost of a Data Breach Report 2025, only 34% of organizations with AI governance policies perform regular audits for unsanctioned AI. Source: IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025 (2025); Observed data. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
- According to IBM's Cost of a Data Breach Report 2025, only 37% of organizations studied have policies to manage AI or detect shadow AI. Source: IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025 (2025); Observed data. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
- According to a TELUS Digital survey, only 24% of enterprise employees who use AI assistants say their company requires mandatory AI assistant training. Source: TELUS Digital, AI at Work survey (shadow AI) (2025); Survey. https://www.telusdigital.com/about/newsroom/telus-digital-survey-reveals-enterprise-employees-use-of-shadow-ai
- According to a Gartner survey of 302 cybersecurity leaders, 69% of organizations suspect or have evidence that employees are using prohibited public GenAI. Source: Gartner, Gartner Identifies Critical GenAI Blind Spots That CIOs Must Urgently Address (press release) (2025); Forecast. https://www.gartner.com/en/newsroom/press-releases/2025-11-19-gartner-identifies-critical-genai-blind-spots-that-cios-must-urgently-address0
- According to the University of Melbourne and KPMG's 2025 global study, only two in five employees say their organization has a policy guiding generative AI use. Source: University of Melbourne and KPMG, Trust, attitudes and use of Artificial Intelligence: A global study 2025 (2025); Survey. https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2025/05/trust-attitudes-and-use-of-ai-global-report.pdf
- According to the University of Melbourne and KPMG's 2025 global study, uploading sensitive data to public AI was most common at organizations that had banned generative AI (67%), versus 33% where there was no policy. Source: University of Melbourne and KPMG, Trust, attitudes and use of Artificial Intelligence: A global study 2025 (2025); Survey. https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2025/05/trust-attitudes-and-use-of-ai-global-report.pdf
- According to UpGuard's State of Shadow AI report, 41% of employees find a way around blocked AI applications. Source: UpGuard, State of Shadow AI (2025); Survey. https://www.upguard.com/press/new-research-from-upguard-reveals-68-of-security-leaders-admit-to-unauthorized-ai-usage
- According to Komprise's 2025 IT survey, 90% of IT leaders are concerned about shadow AI from a privacy and security standpoint, and 46% are extremely worried. Source: Komprise, Komprise IT Survey: AI, Data & Enterprise Risk (2025); Survey. https://www.komprise.com/komprise-survey-finds-that-shadow-ai-is-a-major-concern-across-enterprise-it/
- According to Gallup, 44% of US employees say their organization has begun integrating AI, but only 22% say it has communicated a clear plan or strategy for doing so. Source: Gallup, AI Use at Work Has Nearly Doubled in Two Years (2025); Survey. https://www.gallup.com/workplace/691643/work-nearly-doubled-two-years.aspx
- According to Gallup, only 30% of US employees say their organization has general guidelines or formal policies for using AI at work. Source: Gallup, AI Use at Work Has Nearly Doubled in Two Years (2025); Survey. https://www.gallup.com/workplace/691643/work-nearly-doubled-two-years.aspx
- According to Microsoft and LinkedIn's 2024 Work Trend Index, only 39% of AI users have received AI training from their company. Source: Microsoft and LinkedIn, 2024 Work Trend Index Annual Report (2024); Survey. https://news.microsoft.com/source/2024/05/08/microsoft-and-linkedin-release-the-2024-work-trend-index-on-the-state-of-ai-at-work/
- According to Microsoft and LinkedIn's 2024 Work Trend Index, 60% of leaders say their company lacks a vision and plan to implement AI. Source: Microsoft and LinkedIn, 2024 Work Trend Index Annual Report (2024); Survey. https://news.microsoft.com/source/2024/05/08/microsoft-and-linkedin-release-the-2024-work-trend-index-on-the-state-of-ai-at-work/
- According to Cisco's 2024 Data Privacy Benchmark Study, 27% of organizations had banned the use of generative AI, at least temporarily, over privacy and data security risks. Source: Cisco, 2024 Data Privacy Benchmark Study (2024); Survey. https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2024/m01/organizations-ban-use-of-generative-ai-over-data-privacy-security-cisco-study.html

### When shadow AI turns into a breach

- According to IBM's Cost of a Data Breach Report 2025, one in five organizations studied reported a breach due to shadow AI. Source: IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025 (2025); Observed data. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
- According to IBM's Cost of a Data Breach Report 2025, organizations with high levels of shadow AI saw an average of $670,000 in higher breach costs. Source: IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025 (2025); Observed data. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
- According to Check Point's 2026 Cloud Security Report, 78% of organizations reported confirmed or suspected AI-related security incidents over the past year. Source: Check Point Software, 2026 Cloud Security Report: Enter the AI Era (2026); Survey. https://www.checkpoint.com/press-releases/ai-adoption-creates-critical-cloud-security-gaps-for-enterprises-new-check-point-report-shows/
- 92% of organizations that reported an AI-related breach lacked proper AI access controls, according to IBM's 2026 Cost of a Data Breach Report. Source: IBM, Cost of a Data Breach Report 2026 (2026); Survey. https://www.ibm.com/think/x-force/2026-cost-of-a-data-breach-ai-adversaries-enterprise-risk
- According to EY's 2026 AI Risk and Governance Survey, 36% of large US organizations have had an AI incident or failure with a materially negative impact, including data loss, financial damage, operational disruption and brand damage. Source: EY (Ernst & Young LLP, EY US), AI Risk and Governance Survey 2026 (2026); Survey. https://www.ey.com/en_us/newsroom/2026/09/ey-survey-finds-that-autonomous-ai-implementation-outpaces-oversight-yielding-an-ai-governance-gap
- According to IBM's Cost of a Data Breach Report 2025, 13% of organizations reported breaches of AI models or applications. Source: IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025 (2025); Observed data. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
- According to IBM's Cost of a Data Breach Report 2025, 60% of AI-related security incidents led to compromised data. Source: IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025 (2025); Observed data. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
- Gartner predicts that by 2030 more than 40% of enterprises will experience security or compliance incidents linked to unauthorized shadow AI. Source: Gartner, Gartner Identifies Critical GenAI Blind Spots That CIOs Must Urgently Address (press release) (2025); Forecast. https://www.gartner.com/en/newsroom/press-releases/2025-11-19-gartner-identifies-critical-genai-blind-spots-that-cios-must-urgently-address0
- According to Komprise's 2025 IT survey, nearly 80% of IT leaders say their organization has experienced negative outcomes from employee use of generative AI, including 44% citing sensitive data leaking into AI. Source: Komprise, Komprise IT Survey: AI, Data & Enterprise Risk (2025); Survey. https://www.komprise.com/komprise-survey-finds-that-shadow-ai-is-a-major-concern-across-enterprise-it/

## SaaS spend and pricing statistics

SaaS prices keep climbing, and more contracts now bill on usage instead of seats.

### What software costs

- According to Vertice, SaaS costs per employee reached about $9,100 by the end of 2025, up from $8,700 in 2024 and $7,900 in 2023. Source: Vertice, SaaS Inflation Index 2026 (2026); Observed data. https://www.vertice.one/l/saas-inflation-index-report
- One dollar in every eight a typical organization spends now goes to SaaS, according to Vertice's SaaS Inflation Index 2026. Source: Vertice, SaaS Inflation Index 2026 (2026); Observed data. https://www.vertice.one/l/saas-inflation-index-report
- A company's top 10 software vendors account for roughly 74% of its tracked software spend, a share that hasn't moved in three years, according to Tropic. Source: Tropic, The State of Software Procurement in 2026 (2026); Observed data. https://www.tropicapp.io/blog/state-of-software-procurement-2026
- Mid-market and enterprise companies grew software spend nearly 58% year over year, and SMB/growth companies 50%, according to Tropic. Source: Tropic, 2026 Software and AI Pricing Trends (2026); Observed data. https://www.tropicapp.io/reports/software-spending-trends-2025
- Gartner forecasts worldwide software spending will grow 15.1% to $1.44 trillion in 2026, with generative AI playing a major role. Source: Gartner (reported by eeNews Europe), Worldwide IT Spending Forecast, April 2026 (2026); Forecast. https://www.eenewseurope.com/en/gartner-projects-it-spending-at-6-31-trillion-in-2026-on-ai-surge/
- Gartner estimates up to $234 billion in enterprise application software spending, about 20% of enterprise SaaS spend, is at risk from AI agents by 2030. Source: Gartner (reported by CIO), Gartner press release, July 1, 2026 (2026); Forecast. https://www.cio.com/article/4192242/agentic-ai-puts-234b-in-enterprise-saas-spending-at-risk-gartner-says.html
- Gartner forecasts worldwide IT spending will reach $6.31 trillion in 2026, up 13.5% from 2025. Source: Gartner, Gartner Forecasts Worldwide IT Spending to Grow 13.5% in 2026, Totaling $6.31 Trillion (2026); Forecast. https://www.gartner.com/en/newsroom/press-releases/2026-04-22-gartner-forecasts-worldwide-it-spending-to-grow-13-point-5-percent-in-2026-totaling-6-point-31-trillion-dollars
- Software accounts for an average of 12.5% of total organizational spending, according to Vertice. Source: Vertice, Key SaaS inflation stats: How to mitigate in 2025 (2025); Observed data. https://www.vertice.one/blog/mitigating-2025-saas-inflation-stats
- Software spending rose 10% in 2024 as vendors added AI features that raised costs, according to Tropic's analysis of $11B in corporate spend. Source: Tropic, 2025 Software Buying Trends for Effective Spend Management (2025); Observed data. https://www.tropicapp.io/newsroom/2025-software-spending
- Companies with 1,000 to 10,000 employees spend an average of $21 million a year on software, against $1.9 million for small businesses, according to Tropic. Source: Tropic, 2025 Software Buying Trends for Effective Spend Management (2025); Observed data. https://www.tropicapp.io/newsroom/2025-software-spending
- Mid-market companies spend about $14,000 per employee on software, more than enterprises ($9,000), while growth-stage companies spend the most at $17,000, according to Tropic. Source: Tropic, 2025 Software Buying Trends (blog summary) (2025); Observed data. https://www.tropicapp.io/blog/saas-benchmarks
- The share of IT budgets going to on-demand technology (cloud, SaaS and GenAI) is expected to rise from 29% to 41% within a year, according to Capgemini. Source: Capgemini Research Institute, On-Demand Tech (FinOps) report (2025); Survey. https://www.capgemini.com/us-en/news/press-releases/on-demand-tech-is-on-the-rise-but-spiraling-costs-complexity-and-governance-gaps-are-putting-returns-at-risk/
- Gartner predicts that by 2030, 35% of point-product SaaS tools will be replaced by AI agents or absorbed into the agent ecosystems of major SaaS providers. Source: Gartner (quoted by Deloitte Insights), Deloitte TMT Predictions 2026: SaaS meets AI agents (2025); Forecast. https://www.deloitte.com/us/en/insights/industry/technology/technology-media-and-telecom-predictions/2026/saas-ai-agents.html
- 73% of IT leaders say their SaaS and cloud infrastructure costs have risen, according to Flexera's 2026 IT Priorities report. Source: Flexera, Flexera IT Priorities Report (2026 strategy) (2025); Survey. https://www.flexera.com/about-us/press-center/flexera-report-reveals-priorities-driving-it-strategy-for-2026-ai-takes-the-lead
- Startups with up to 20 staff spend about $8,000 per employee on software, while companies with 100-200 staff spend $1,741, according to Cledara. Source: Cledara, The 2025 Software Spend Report (2024); Observed data. https://www.cledara.com/blog/2025-software-spend-report
- Even the smallest companies (0-20 employees) spend an average of $121,336 a year on software, according to Cledara. Source: Cledara, The 2025 Software Spend Report (2024); Observed data. https://www.cledara.com/blog/2025-software-spend-report
- Gartner forecast that worldwide end-user spending on SaaS would approach $300 billion in 2025, up from just over $250 billion in 2024. Source: Gartner (reported by CIO Dive), Public cloud end-user spending forecast, Nov 2024 (2024); Forecast. https://www.ciodive.com/news/cloud-spend-growth-forecast-2025-gartner/733401/

### Prices only go one way

- SaaS prices rose at a record 16.4% annual rate in June 2026, almost 4x US consumer inflation, according to Vertice's SaaS Inflation Index. Source: Vertice, SaaS Inflation Rate (SaaS Inflation Index) (2026); Observed data. https://www.vertice.one/insights/saas-inflation-rate
- 60% of SaaS vendors deliberately mask their price increases, according to Vertice. Source: Vertice, SaaS Inflation Index 2026 (2026); Observed data. https://www.vertice.one/l/saas-inflation-index-report
- Software vendors are opening renewal talks with AI-linked price increases of 20-37%, against a typical 3-9% SaaS uplift, according to Tropic's 2026 data. Source: Tropic, The State of Software Procurement in 2026 (2026); Observed data. https://www.tropicapp.io/blog/state-of-software-procurement-2026
- CIOs are setting aside 9% of their IT budgets just to cover price increases on existing services, according to Gartner research reported by CIO Dive. Source: Gartner (reported by CIO Dive), Gartner GenAI spending forecast briefing (2025); Forecast. https://www.ciodive.com/news/generative-ai-software-device-spending-soars-gartner/743888/
- SaaS inflation jumped 4.3 percentage points in two months in spring 2026, the fastest increase Vertice has recorded. Source: Vertice, SaaS Inflation Rate (SaaS Inflation Index) (2026); Observed data. https://www.vertice.one/insights/saas-inflation-rate
- 27% of SaaS vendors use 'shrinkflation', cutting features or service levels while holding or raising prices, according to Vertice. Source: Vertice, SaaS shrinkflation (Insights Hub) (2026); Observed data. https://www.vertice.one/insights/saas-shrinkflation
- SaaS vendors are raising prices 8% to 12% a year, with aggressive vendors hitting 15% to 25%, according to Cledara's renewal benchmarks. Source: Cledara, SaaS Renewal Benchmarks 2026 (2026); Observed data. https://www.cledara.com/blog/saas-renewal-benchmarks-2026
- Salesforce's new Core edition, launched September 3, 2026 and positioned against the legacy Enterprise Edition, lists at $195 per user per month, with the Advanced edition (positioned against Unlimited) at $395 and Max unchanged at $550. Source: Salesforce, New Salesforce Editions Bundle Everything Businesses Need for Agentic Transformation (Salesforce News) (2026); Vendor or analysis. https://www.salesforce.com/news/stories/salesforce-simplifies-editions-2026/
- As of January 2025, SaaS prices were up 11.4% year over year, against 2.7% average inflation across G7 countries, according to Vertice. Source: Vertice, SaaS Inflation Stats: How to Mitigate in 2025 (2025); Observed data. https://www.vertice.one/blog/mitigating-2025-saas-inflation-stats
- Vertice found that 33% of software vendors include contract wording that allows them to raise prices at renewal. Source: Vertice, SaaS Inflation Stats: How to Mitigate in 2025 (2025); Observed data. https://www.vertice.one/blog/mitigating-2025-saas-inflation-stats
- Salesforce raised list prices by an average of 6% on August 1, 2025 for Enterprise and Unlimited Editions of Sales Cloud, Service Cloud, Field Service and select Industries Clouds. Source: Salesforce, Salesforce pricing update announcement (2025); Vendor or analysis. https://www.salesforce.com/news/stories/pricing-update-2025/
- Slack raised its Business+ plan 20% to $15 per user per month for annual billing in June 2025, as part of Salesforce's AI-driven pricing changes. Source: CIO Dive (reporting Salesforce/Slack announcement), Salesforce preps price hike amid AI blitz (2025); Vendor or analysis. https://www.ciodive.com/news/salesforce-slack-pricing-changes-AI-agentforce/751121/
- Atlassian raised cloud list prices on October 15, 2025: 5% for Standard, 7.5% for Premium and 7.5% to 10% for Enterprise editions of Jira, Confluence and Jira Service Management, with Bitbucket up 10%. Source: Atlassian Investor Relations, Notice of FY26 Cloud Pricing Changes from Atlassian (2025); Vendor or analysis. https://s206.q4cdn.com/270053503/files/doc_downloads/2025/09/Fiscal-2026-Cloud-Pricing-notice.pdf
- Google raised Workspace Business Standard from $12 to $14 per user per month on annual plans in 2025 as it bundled Gemini AI into all Business plans, a roughly 17% increase. Source: 9to5Google (reporting Google announcement), Google Workspace details 2025 Gemini price increase (2025); Vendor or analysis. https://9to5google.com/2025/01/15/google-workspace-price-increase-2025/
- ICONIQ found that while many software companies include AI features for free today, 37% plan to change their pricing in the next year to reflect AI value and usage. Source: ICONIQ, 2025 State of AI: The Builder's Playbook (2025); Survey. https://www.iconiq.com/growth/reports/2025-state-of-ai
- Microsoft is raising Microsoft 365 E3 from $36 to $39 per user per month (8%) and Office 365 E3 from $23 to $26 (13%) on July 1, 2026, alongside new AI capabilities in the suites. Source: Microsoft, Microsoft 365 packaging and pricing updates (effective July 1, 2026) (2025); Vendor or analysis. https://www.microsoft.com/en-us/licensing/news/2026-m365-packaging-pricing-updates
- When Google bundled Gemini into Workspace in January 2025, Business Standard rose to $14 per user per month, $2 (about 17%) more than the plan cost without Gemini. Source: Google, Google Workspace enables the future of AI-powered work for every business (Workspace blog) (2025); Vendor or analysis. https://workspace.google.com/blog/product-announcements/empowering-businesses-with-AI
- Microsoft raised U.S. Microsoft 365 Personal and Family prices by $3 per month in January 2025, the first increase since launch, when it bundled Copilot into the plans. Source: Microsoft, Copilot is now included in Microsoft 365 Personal and Family (Microsoft 365 blog) (2025); Vendor or analysis. https://www.microsoft.com/en-us/microsoft-365/blog/2025/01/16/copilot-is-now-included-in-microsoft-365-personal-and-family/
- Vertice's SaaS Inflation Index found that 73% of software vendors raised their prices in 2023, and SaaS inflation ran at 8.7%, more than double US CPI. Source: Vertice, SaaS Inflation Index (press release) (2023); Observed data. https://www.prnewswire.com/news-releases/cost-of-software-crisis-saas-inflation-running-at-more-than-double-us-consumer-inflation-301986383.html
- Salesforce raised list prices by an average of 9% across several offerings in 2023, its first list price increase in seven years. Source: CFO Dive (reporting Salesforce announcement), Escalating SaaS prices outpace CPI inflation (2023); Vendor or analysis. https://www.cfodive.com/news/stubbornly-high-saas-prices-outpace-cpi-inflation/699683/

### From seats to consumption

- Consumption-priced SaaS tools show a 37.6% average monthly budget variance, versus 4.1% for seat-based tools, according to Vertice. Source: Vertice, Vertice Insights: Budget variance rates - consumption vs seat pricing (2026); Observed data. https://www.vertice.one/insights/monthly-budget-variance-rate
- Per-usage pricing became the single most common SaaS pricing model in Q2 2026 at 36.5% of contracts, overtaking per-user pricing at 32.4%, according to Vertice. Source: Vertice, Vertice Insights: SaaS pricing models (2026); Observed data. https://www.vertice.one/insights/saas-pricing-models
- More than a third of the AI tools in today's tech stacks are billed only on usage or token consumption, not per seat, according to BetterCloud. Source: BetterCloud, 2026 State of SaaS (2026); Survey. https://www.bettercloud.com/resources/state-of-saas/
- When a SaaS vendor moves a customer from seat-based to consumption pricing, contract costs rise 22.6% on average, according to Vertice. Source: Vertice, Vertice Insights: Consumption pricing - contract cost changes (2026); Observed data. https://www.vertice.one/insights/contract-cost-increase-by-consumption-pricing-model
- Pure consumption pricing drives the effective cost per user up by as much as 37%, and hybrid models by 21% on average, compared with seat-based pricing, Vertice reports. Source: Vertice, Vertice Insights: Consumption pricing - cost-per-user vs seat-based (2026); Observed data. https://www.vertice.one/insights/cost-per-user-by-pricing-models
- 82% of senior leaders at organizations investing in AI expect traditional per-seat SaaS pricing to become less relevant in their industry within five years, according to EY's US AI Pulse Survey. Source: EY US, EY US AI Pulse Survey (fifth wave) (2026); Survey. https://www.ey.com/en_us/newsroom/2026/07/ey-survey-c-suites-pivot-from-ai-adoption-to-unlocking-value-as-escalating-token-costs-trigger-fiscal-scrutiny
- Salesforce's September 2026 editions bundle prepaid AI consumption credits into per-seat pricing: the Core edition includes 500,000 Flex Credits, Advanced 1 million and Max 2.75 million. Source: Salesforce, New Salesforce Editions Bundle Everything Businesses Need for Agentic Transformation (Salesforce News) (2026); Vendor or analysis. https://www.salesforce.com/news/stories/salesforce-simplifies-editions-2026/
- A January 2025 survey of 100 SaaS companies by Metronome and Greyhound Capital found 85% have adopted usage-based pricing. Source: Metronome, State of Usage-Based Pricing 2025 (2025); Survey. https://metronome.com/state-of-usage-based-pricing-2025
- 78% of software companies with usage-based pricing adopted it within the last five years, and nearly half within the last two, Metronome found. Source: Metronome, State of Usage-Based Pricing 2025 (2025); Survey. https://metronome.com/state-of-usage-based-pricing-2025
- Hybrid pricing rose from 27% to 41% of software companies in a year while pure seat-based pricing fell from 21% to 15%, according to Growth Unhinged's 2025 State of B2B Monetization survey. Source: Growth Unhinged (Kyle Poyar), 2025 State of B2B Monetization (2025); Survey. https://www.growthunhinged.com/p/2025-state-of-b2b-monetization
- Only 5% of software companies use outcome-based pricing as their primary model today, but 25% expect to by 2028, per Growth Unhinged's 2025 State of B2B Monetization survey. Source: Growth Unhinged (Kyle Poyar), 2025 State of B2B Monetization (2025); Survey. https://www.growthunhinged.com/p/2025-state-of-b2b-monetization
- Three in four software companies changed their pricing in the past year, according to Growth Unhinged's 2025 State of B2B Monetization survey. Source: Growth Unhinged (Kyle Poyar), 2025 State of B2B Monetization (2025); Survey. https://www.growthunhinged.com/p/2025-state-of-b2b-monetization

## License waste and renewals statistics

Many licenses sit idle, and most contracts renew without anyone taking a second look.

### Licenses nobody uses

- According to Vertice, 65% of all SaaS licenses were either entirely unused or underutilized as of Q2 2026, up from 62% a year earlier. Source: Vertice, Vertice Insights: Unused SaaS applications (2026); Observed data. https://www.vertice.one/insights/unused-saas-applications
- Salesforce tops Torii's License Utilization Audit with a 55% non-utilization rate, followed by PagerDuty (45%) and monday.com (40%), according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- 62.1% of active Crunchbase licenses had no activity in over 90 days, the highest account decay rate in Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- As of Q2 2026, Vertice's spend data shows 14% of SaaS licenses are fully unused and a further 51% are underutilized (under half of purchased seats in use), so over half of all licenses sit in the underused bucket. Source: Vertice, Vertice Insights: Unused SaaS applications (2026); Observed data. https://www.vertice.one/insights/unused-saas-applications
- Vertice estimates that enterprises with 10,000+ employees waste $18.9M a year on unused and underutilized software, roughly 10 times what a 1,000 to 2,500-employee company wastes. Source: Vertice, Vertice Insights: Wasted SaaS spend (2026); Observed data. https://www.vertice.one/insights/cost-of-unused-saas
- Vertice found that wasted software spend ranges from $1.75M a year at companies with 500 to 1,000 employees up to $18.9M at enterprises with 10,000+ employees. Source: Vertice, Vertice Insights: Wasted SaaS spend (2026); Observed data. https://www.vertice.one/insights/cost-of-unused-saas
- Estimated wasted cloud spend rose to 29% in 2026, the first increase in five years, driven by AI workloads, according to Flexera's 2026 State of the Cloud Report. Source: Flexera, 2026 State of the Cloud Report (2026); Survey. https://www.flexera.com/blog/finops/flexera-2026-state-of-the-cloud-report-the-convergence-of-cloud-and-value/
- Gartner predicts that through 2028, organizations that fail to attain centralized visibility and coordinate SaaS life cycles will overspend on SaaS by at least 25%, due to unused entitlements and overlapping tools. Source: Gartner (via USU reprint), 2026 Gartner Magic Quadrant for SaaS Management Platforms (2026); Forecast. https://www.usu.com/en/saas-management/resources/2026-gartner-magic-quadrant-for-saas-management-platforms
- 52% of large organizations overspent their SaaS budgets, according to Capgemini Research Institute. Source: Capgemini Research Institute, On-Demand Tech (FinOps) report (2025); Survey. https://www.capgemini.com/us-en/news/press-releases/on-demand-tech-is-on-the-rise-but-spiraling-costs-complexity-and-governance-gaps-are-putting-returns-at-risk/
- Companies waste $1 of every $5 spent on software to failed implementations, underused tools and unexpected costs, according to Freshworks' 2025 Cost of Complexity report. Source: Freshworks, The Cost of Complexity Report (2025); Survey. https://www.freshworks.com/pressrelease/software-budgets-wasted-on-unnecessary-business-complexity-freshworks-survey-finds/
- 35% of IT asset management professionals say SaaS waste increased over the past year, according to Flexera's 2025 State of ITAM Report. Source: Flexera, 2025 State of ITAM Report (2025); Survey. https://www.flexera.com/about-us/press-center/it-teams-losing-visibility-according-to-flexera-2025-state-of-itam-report
- Nearly one in three IT professionals (31%) say their organizations do not track unused or underused software licenses, according to Ivanti's 2025 Technology at Work report. Source: Ivanti, 2025 Technology at Work Report (2025); Survey. https://www.ivanti.com/resources/research-reports/tech-at-work
- 58% of IT professionals say wasteful IT spending is a problem in their organization, and 21% call it a major problem, according to Ivanti. Source: Ivanti, 2025 Technology at Work Report (2025); Survey. https://www.ivanti.com/resources/research-reports/tech-at-work
- 33% of midsized-enterprise IT leaders estimate they waste 10% of their IT budget on underused software and SaaS licenses, 46% say 25%, and 17% say half or more, according to a Block 64 survey. Source: Block 64, Block 64 Market Survey (2025); Survey. https://www.block64.com/blog/how-much-it-leaders-waste-on-cloud-saas-hardware-budgets
- Companies waste more than $135,000 a year on unused software licenses on average, according to BetterCloud. Source: BetterCloud, State of SaaSOps 2024 (2024); Survey. https://www.prnewswire.com/news-releases/the-number-of-saas-applications-at-companies-declined-for-the-first-time-in-over-a-decade-302199899.html
- 45% of companies believe they are overspending on software, according to Cledara's 2025 Software Spend Report. Source: Cledara, The 2025 Software Spend Report (2024); Survey. https://www.cledara.com/blog/2025-software-spend-report
- Companies with more than 200 staff waste 48% of their software spend, according to Cledara. Source: Cledara, The 2025 Software Spend Report (2024); Observed data. https://www.cledara.com/blog/2025-software-spend-report
- Even advanced IT asset management practitioners self-estimate that 20% of SaaS spend is wasted, alongside 30% of desktop software spend, according to Flexera's 2024 State of ITAM Report. Source: Flexera, 2024 State of ITAM Report (2024); Survey. https://www.flexera.com/about-us/press-center/flexera-2024-state-of-itam-report-finds-software-audit-costs-continue-to-rise
- Gartner estimates that as many as 25% of provisioned SaaS licenses are not regularly used by employees. Source: Gartner (reproduced by Viio), Magic Quadrant for SaaS Management Platforms 2024 (Market Overview) (2024); Forecast. https://viio.io/resources/gartners-market-guide-for-saas-management-platforms
- IT leaders estimate they overspend by around 20-25% across cloud, software, SaaS and hardware, according to Flexera's 2025 IT Priorities Report. Source: Flexera, 2025 IT Priorities Report (2024); Survey. https://www.flexera.com/about-us/press-center/artificial-intelligence-redefining-it-leaders-priorities
- Respondents to Flexera's 2023 State of ITAM Report estimated 32% of SaaS spend was underutilized or wasted. Source: Flexera, 2023 State of ITAM Report (2023); Survey. https://www.flexera.com/about-us/press-center/flexera-2023-state-of-itam-report-highlights-cost-savings-as-top-enterprise-priority
- Nexthink found that half (49.96%) of all installed software went unused by employees, costing businesses about $45M per month across 30+ popular tools. Source: Nexthink, Soft-WASTE: How Much Does IT Waste on Unused Software Licenses? (2023); Observed data. https://nexthink.com/press/half-of-software-licenses-goes-unused-by-employees-wasting-businesses-billions
- The number-one product-related reason for software purchase regret is the software being more expensive than expected, cited by 35% of regretful US buyers, according to Capterra. Source: Capterra (Gartner Digital Markets), 2024 U.S. Tech Trends Report (2023); Survey. https://www.capterra.com/resources/us-tech-trends

### Renewals on autopilot

- As of Q2 2026, 72.3% of SaaS contracts auto-renew on average, up from 60.6% one quarter earlier, according to Vertice. Source: Vertice, Vertice Insights: Contracts containing auto-renewal clauses by category (2026); Observed data. https://www.vertice.one/insights/auto-renewal-clauses
- In Q2 2026, 72% of tail-spend software contracts renewed without any review, compared with 14.1% of larger contracts, according to Vertice. Source: Vertice, Vertice Insights: Renewals triggered without review (2026); Observed data. https://www.vertice.one/insights/renewals-triggered-without-review
- Organizations that begin negotiating 120+ days before a SaaS contract expires save an average of 23.3% more than those who wait until the final month, according to Vertice. Source: Vertice, Vertice Insights: Renewal savings vs. negotiation time (2026); Observed data. https://www.vertice.one/insights/renewal-savings-vs-negotiation-time
- 40% of organizations still track SaaS renewals manually, according to BetterCloud's 2025 State of SaaS report. Source: BetterCloud, 2025 State of SaaS (2025); Survey. https://www.bettercloud.com/monitor/2025-state-of-saas-trends/
- Companies that start renewal prep six months out save up to 39% on average, compared with 14% at 30 days, according to Tropic. Source: Tropic, The State of Software Procurement in 2026 (2026); Observed data. https://www.tropicapp.io/blog/state-of-software-procurement-2026
- Vertice data shows 96.1% of CRM contracts now auto-renew, the highest of any software category. Source: Vertice, Vertice Insights: Contracts containing auto-renewal clauses by category (2026); Observed data. https://www.vertice.one/insights/auto-renewal-clauses
- Tropic found the deepest software discounts came from short-term contracts (31.9%), while 12 to 24-month deals averaged 26.3%. Source: Tropic, 2026 Software and AI Pricing Trends Report (2026); Observed data. https://www.tropicapp.io/reports/software-spending-trends-2025
- Cledara found that companies starting renewal negotiations 90 days ahead achieved average savings of 49%, compared with 19% when they started 30 to 90 days out. Source: Cledara, SaaS Renewal Benchmarks 2026 (2026); Observed data. https://www.cledara.com/blog/saas-renewal-benchmarks-2026
- 45% of leaders name price hikes as their top frustration at SaaS renewal time, and 30% say they miss contract alerts and get auto-renewed, according to Spendflo. Source: Spendflo, State of SaaS Procurement 2025 (2025); Survey. https://www.spendflo.com/blog/insights-from-the-state-of-saas-buying-survey
- The average software contract length rose to 14.2 months in 2024, a 6% increase from the year before, according to Tropic. Source: Tropic, 2025 Software Buying Trends (2025); Observed data. https://www.tropicapp.io/newsroom/2025-software-spending
- Tropic says the average company handles between 200 and 600 software renewals a year, more than one every business day in most cases. Source: Tropic, Tropic product press release (Purchase Prep Assistant) (2025); Vendor or analysis. https://www.globenewswire.com/news-release/2025/10/08/3163504/0/en/tropic-levels-software-negotiation-playing-field-turns-renewal-hell-into-cash-opportunities.html
- Multi-year commitments made up just 18% of software renewal transactions on Vendr's platform in 2023, as multi-year renewals fell 28% compared with 2021, according to Vendr. Source: Vendr, The SaaS Trends Report Q3 2023 (2023); Observed data. https://www.vendr.com/insights/saas-trends-report-2023-q3

### What negotiation is worth

- Companies using pricing benchmarks secured an average discount of 33.8% off list price on SaaS contracts, according to Vertice. Source: Vertice, Vertice Insights: Average discount from list price (2026); Observed data. https://www.vertice.one/insights/average-discount-from-list-price
- Vertice's benchmarks show a poorly negotiated deal in categories like CRM, ERP and project management can cost up to three times what a well-negotiated one does for comparable software. Source: Vertice, Vertice Insights: SaaS benchmark prices deviation (2026); Observed data. https://www.vertice.one/insights/pricing-benchmark-deviation
- Negotiation cut AI-driven renewal price asks by about 55% on average, but final uplifts still averaged around 12%, according to Tropic. Source: Tropic, 2026 Software and AI Pricing Trends Report (2026); Observed data. https://www.tropicapp.io/reports/software-spending-trends-2025
- Only 29% of large organizations achieved the SaaS cost savings they expected, according to Capgemini Research Institute. Source: Capgemini Research Institute, On-Demand Tech (FinOps) report (2025); Survey. https://www.capgemini.com/us-en/news/press-releases/on-demand-tech-is-on-the-rise-but-spiraling-costs-complexity-and-governance-gaps-are-putting-returns-at-risk/
- Vendr reported that average contract values fell 20%, from $50,000 to $40,000, during 2024 as buyers rightsized at renewal in what it called the 'Year of the Descope'. Source: Vendr, Vendr SaaS Trends Report 2025 (Plus 2024 Year-in Review) (2025); Observed data. https://www.vendr.com/insights/saas-trends-report
- 56% of organizations are rightsizing contracts and subscriptions and 59% are actively tracking usage to cut SaaS costs, Flexera's 2025 State of ITAM Report found. Source: Flexera, 2025 State of ITAM Report (2025); Survey. https://www.flexera.com/about-us/press-center/it-teams-losing-visibility-according-to-flexera-2025-state-of-itam-report
- 63% of IT teams say too many unused or underutilized SaaS apps and licenses, or budget pressure, are driving app consolidation, per BetterCloud's 2025 State of SaaS report. Source: BetterCloud, 2025 State of SaaS (as summarized on BetterCloud's SaaS statistics page) (2025); Survey. https://www.bettercloud.com/monitor/saas-statistics/
- Reusing licenses instead of buying new ones (non-cloud) was the top way SAM teams achieved significant savings in the past year, cited by 45%, ahead of better vendor negotiation at 37%, per Flexera's 2024 State of ITAM Report. Source: Flexera, 2024 State of ITAM Report (2024); Survey. https://www.flexera.com/about-us/press-center/flexera-2024-state-of-itam-report-finds-software-audit-costs-continue-to-rise
- Vendr's analysis of more than 20,000 software deals found negotiation saved buyers 16.49% on average, a total of $349 million. Source: Vendr, SaaS statistics: trends, data and insights (updated 2023) (2023); Observed data. https://www.vendr.com/blog/saas-statistics
- 55% of organizations saved more than $1 million through software asset management in a year, and 16% saved more than $10 million, according to Flexera's 2023 State of ITAM Report. Source: Flexera, 2023 State of ITAM Report (2023); Survey. https://www.flexera.com/about-us/press-center/flexera-2023-state-of-itam-report-highlights-cost-savings-as-top-enterprise-priority

### Audits and true-ups

- Nearly half (48%) of organizations were audited by a software vendor in the last year, according to Flexera's 2026 State of ITAM Report. Source: Flexera, 2026 State of ITAM Report (2026); Survey. https://www.flexera.com/about-us/press-center/flexera-2026-state-of-itam-report-reveals-only-31-percent-organizations-have-visibility-into-ai-as-spend-surges
- Respondents reporting Oracle audit activity rose to 38% from 24% a year earlier, and Adobe from 24% to 32%, according to Flexera's 2026 State of ITAM Report. Source: Flexera, 2026 State of ITAM Report (2026); Survey. https://www.flexera.com/about-us/press-center/flexera-2026-state-of-itam-report-reveals-only-31-percent-organizations-have-visibility-into-ai-as-spend-surges
- IT asset management teams spend 32% of their time on software optimization and another 22% responding to audits, according to Flexera's 2026 State of ITAM Report. Source: Flexera, 2026 State of ITAM Report (2026); Survey. https://www.flexera.com/about-us/press-center/flexera-2026-state-of-itam-report-reveals-only-31-percent-organizations-have-visibility-into-ai-as-spend-surges
- 44% of organizations spent more than $1 million on software audits over the past three years, according to Flexera's 2026 State of ITAM Report. Source: Flexera, 2026 State of ITAM Report (2026); Survey. https://www.flexera.com/about-us/press-center/flexera-2026-state-of-itam-report-reveals-only-31-percent-organizations-have-visibility-into-ai-as-spend-surges
- 45% of organizations spent more than $1 million on software audits over the past three years, according to Flexera's 2025 State of ITAM Report. Source: Flexera, 2025 State of ITAM Report (2025); Survey. https://www.flexera.com/about-us/press-center/it-teams-losing-visibility-according-to-flexera-2025-state-of-itam-report
- Half of organizations say Microsoft audited them in the past three years, followed by IBM at 37% and SAP at 32%, per Flexera's 2025 State of ITAM Report. Source: Flexera, 2025 State of ITAM Report (2025); Survey. https://www.flexera.com/about-us/press-center/it-teams-losing-visibility-according-to-flexera-2025-state-of-itam-report
- 23% of software producers report customer license overuse (unintentional or otherwise) as a major problem and another 47% as a moderate concern, according to Revenera's Monetization Monitor 2026 Outlook. Source: Revenera, Monetization Monitor 2026 Outlook (2025); Survey. https://www.globenewswire.com/news-release/2025/11/13/3187406/0/en/Revenera-s-Monetization-Monitor-2026-Outlook-Almost-1-in-3-Software-Producers-say-Piracy-is-a-Major-Problem.html
- 22% of IT leaders paid more than $5 million in software audit costs over three years, up from 15% the previous year, according to Flexera's 2024 State of ITAM Report. Source: Flexera, 2024 State of ITAM Report (2024); Survey. https://www.flexera.com/about-us/press-center/flexera-2024-state-of-itam-report-finds-software-audit-costs-continue-to-rise

## AI spend and ROI statistics

AI budgets are climbing fast, the bills are hard to forecast, and the returns are still arriving.

### AI budgets keep climbing

- According to Menlo Ventures, enterprise generative AI spend reached $37B in 2025, up from $1.7B in 2023, and now equals 6% of the global SaaS market. Source: Menlo Ventures, 2025: The State of Generative AI in the Enterprise (2025); Survey. https://menlovc.com/perspective/2025-the-state-of-generative-ai-in-the-enterprise/
- Ramp's spend data shows the median U.S. business spent $11.95 per employee on AI in July 2026, while the top 1% spent a median $7,400 per employee. Source: Ramp (Ramp Economics Lab), Ramp AI Index, August 2026 update (2026); Observed data. https://ramp.com/data/ai-index-august-2026
- For mid-market and enterprise companies, spend on AI-native software grew 94% year over year while spend on traditional SaaS grew just 8%, according to Tropic. Source: Tropic, 2026 Software and AI Pricing Trends (2026); Observed data. https://www.tropicapp.io/reports/software-spending-trends-2025
- AI-native vendors took 4.8% of the average software budget in July 2026, more than double the 2.3% share in January 2025, according to Tropic. Source: Tropic, AI Spending and Pricing Trends H1 2026 (2026); Observed data. https://www.tropicapp.io/blog/ai-pricing-trends
- Gartner forecasts worldwide AI spending will total $2.7 trillion in 2026, a 49.5% increase over 2025. Source: Gartner, Press release: Gartner Forecasts Worldwide AI Spending to Grow 49.5% in 2026 (2026); Forecast. https://www.gartner.com/en/newsroom/press-releases/2026-09-16-gartner-forecasts-worldwide-ai-spending-to-grow-49-point-5-percent-in-2026
- According to KPMG's Q1 2026 AI Quarterly Pulse, large U.S. organizations plan to spend an average of $207 million on AI over the next 12 months, nearly double a year earlier. Source: KPMG US, AI Quarterly Pulse Survey, Q1 2026 (2026); Survey. https://kpmg.com/us/en/media/news/q1-ai-pulse2026.html
- BCG's AI Radar 2026 found companies plan to double AI spending in 2026 to about 1.7% of revenues, drawing on budgets beyond the tech pool. Source: Boston Consulting Group (BCG), AI Radar 2026: As AI Investments Surge, CEOs Take the Lead (press release) (2026); Survey. https://www.bcg.com/press/15january2026-as-ai-investments-surge-ceos-take-lead
- BCG found 94% of CEOs will keep investing in AI at current or higher levels even if the investments don't pay off in the next year. Source: Boston Consulting Group (BCG), AI Radar 2026: As AI Investments Surge, CEOs Take the Lead (press release) (2026); Survey. https://www.bcg.com/press/15january2026-as-ai-investments-surge-ceos-take-lead
- Atlanta Fed survey data show U.S. firms spent $1,358 per employee on AI in 2025 and expect to spend $2,068 per employee in 2026, about a 50% increase. Source: Federal Reserve Bank of Atlanta, How Much Are Firms Spending on AI (and What Will Happen to Headcounts)? (Policy Hub: Macroblog) (2026); Survey. https://www.atlantafed.org/research-and-data/publications/policy-hub-macroblog/2026/05/06/how-much-firms-spending-on-ai-and-what-will-happen-to-headcounts
- According to the Atlanta Fed, more than half of firms expect to spend no more than $200 per employee on AI in 2026, while the top 10% plan at least $2,800, a 14-fold gap. Source: Federal Reserve Bank of Atlanta, How Much Are Firms Spending on AI (and What Will Happen to Headcounts)? (Policy Hub: Macroblog) (2026); Survey. https://www.atlantafed.org/research-and-data/publications/policy-hub-macroblog/2026/05/06/how-much-firms-spending-on-ai-and-what-will-happen-to-headcounts
- According to a16z's 2025 survey of 100 enterprise CIOs, LLM budgets are expected to grow about 75% over the next year. Source: Andreessen Horowitz (a16z), How 100 Enterprise CIOs Are Building and Buying Gen AI in 2025 (2025); Survey. https://a16z.com/ai-enterprise-2025/
- a16z found that innovation budgets fell from a quarter of enterprise LLM spending to just 7% in 2025, as AI moved into centralized IT and business-unit budgets. Source: Andreessen Horowitz (a16z), How 100 Enterprise CIOs Are Building and Buying Gen AI in 2025 (2025); Survey. https://a16z.com/ai-enterprise-2025/
- CloudZero's State of AI Costs survey found average monthly AI spend of $62,964 in 2024, rising to an expected $85,521 in 2025, a 36% increase. Source: CloudZero, The State Of AI Costs In 2025 (2025); Survey. https://www.cloudzero.com/state-of-ai-costs/
- According to CloudZero, the share of organizations planning to spend over $100,000 a month on AI tools more than doubled, from 20% in 2024 to 45% in 2025. Source: CloudZero, The State Of AI Costs In 2025 (2025); Survey. https://www.cloudzero.com/state-of-ai-costs/
- Deloitte found 85% of organizations increased AI investment in the past 12 months and 91% plan to increase it again. Source: Deloitte, AI ROI: The paradox of rising investment and elusive returns (2025); Survey. https://www.deloitte.com/global/en/issues/generative-ai/ai-roi-the-paradox-of-rising-investment-and-elusive-returns.html
- According to Deloitte's 2025 Tech Value Survey, organizations now allocate an average of 36% of their digital initiative budgets to AI automation. Source: Deloitte, Tech value survey 2025 (AI and tech investment ROI) (2025); Survey. https://www.deloitte.com/us/en/insights/topics/digital-transformation/ai-tech-investment-roi.html
- Deloitte found that when the CFO had full decision-making authority over digital investments, 42% of organizations achieved above-average profitability, versus 18% where the CFO had none. Source: Deloitte, C-suite leadership and AI returns (Tech Value Survey analysis) (2025); Survey. https://www.deloitte.com/us/en/insights/topics/digital-transformation/c-suite-leadership-ai-returns.html
- EY found 27% of organizations investing in AI commit a quarter or more of their IT budget to AI today, a share set to nearly double to 52% next year. Source: EY, EY US AI Pulse Survey, wave 4 (press release) (2025); Survey. https://www.ey.com/en_us/newsroom/2025/12/ai-driven-productivity-is-fueling-reinvestment-over-workforce-reductions
- ICONIQ's 2025 State of AI report found AI-enabled software companies allocate 10-20% of R&D budgets to AI development, a share growing in every revenue band. Source: ICONIQ, 2025 State of AI: The Builder's Playbook (2025); Survey. https://www.iconiq.com/growth/reports/2025-state-of-ai
- AI spending grew 446% over 12 months, compared with 36% growth in overall SaaS spending, according to Cledara's transaction data. Source: Cledara, The 2025 Software Spend Report (2024); Observed data. https://www.cledara.com/blog/2025-software-spend-report
- In 2024, Menlo Ventures found that 60% of enterprise generative AI spend came from innovation budgets rather than permanent budget lines. Source: Menlo Ventures, 2024: The State of Generative AI in the Enterprise (2024); Survey. https://menlovc.com/2024-the-state-of-generative-ai-in-the-enterprise/

### Where the AI money goes

- According to the Ramp AI Index, 43.8% of U.S. businesses paid for Anthropic subscriptions or tokens in August 2026, ahead of OpenAI at 39.8%. Source: Ramp (Ramp Economics Lab), Ramp AI Index, September 2026 update (2026); Observed data. https://ramp.com/data/ai-index-sept-2026
- According to a16z, 37% of enterprises now use five or more AI models, up from 29% a year earlier. Source: Andreessen Horowitz (a16z), How 100 Enterprise CIOs Are Building and Buying Gen AI in 2025 (2025); Survey. https://a16z.com/ai-enterprise-2025/
- According to Ramp, only 6.4% of AI-spending businesses (3.6% of all businesses) use open-source models. Source: Ramp (Ramp Economics Lab), Ramp AI Index, September 2026 update (2026); Observed data. https://ramp.com/data/ai-index-sept-2026
- Ramp's Spring 2026 spending report found that more than half of businesses (50.4%) now pay for AI services, and Anthropic's share of paid AI customers jumped from 16.7% to 30.6% in one quarter. Source: Ramp, Spring 2026 Business Spending Report (2026); Observed data. https://ramp.com/reports/2026-spring-spending-benchmarks
- Mavvrik found engineering organizations run an average of 2.4 AI coding tools at once, 39% report coding-tool costs above expected license or usage, and only 42% include developer AI tools in AI cost reporting. Source: Mavvrik and Benchmarkit, 2026 State of AI Cost Governance Report (2026); Survey. https://www.mavvrik.ai/press-releases/ai-bill-shock-hits-the-boardroom/
- According to BCG, CEOs have committed more than 30% of their organizations' 2026 AI investment to agentic AI. Source: Boston Consulting Group (BCG), AI Radar 2026: As AI Investments Surge, CEOs Take the Lead (press release) (2026); Survey. https://www.bcg.com/press/15january2026-as-ai-investments-surge-ceos-take-lead
- Stanford's 2026 AI Index reports organizational AI adoption rose to 88% of surveyed organizations in 2025, but AI agent deployment was still in the single digits across nearly all business functions. Source: Stanford HAI, AI Index Report 2026, Economy chapter (2026); Vendor or analysis. https://hai.stanford.edu/ai-index/2026-ai-index-report/economy
- Goldman Sachs Research forecasts only 12% of knowledge workers will use agentic AI by 2030, rising to 37% by 2040. Source: Goldman Sachs Research, AI Agents Forecast to Boost Tech Cash Flow as Usage Soars (2026); Forecast. https://www.goldmansachs.com/insights/articles/ai-agents-forecast-to-boost-tech-cash-flow-as-usage-soars
- Menlo Ventures found that 76% of enterprise AI use cases are now purchased rather than built internally, up from 53% purchased in 2024. Source: Menlo Ventures, 2025: The State of Generative AI in the Enterprise (2025); Survey. https://menlovc.com/perspective/2025-the-state-of-generative-ai-in-the-enterprise/
- According to Menlo Ventures, Anthropic holds 40% of enterprise LLM API market share in 2025, versus 27% for OpenAI. Source: Menlo Ventures, 2025: The State of Generative AI in the Enterprise (2025); Survey. https://menlovc.com/perspective/2025-the-state-of-generative-ai-in-the-enterprise/
- Menlo Ventures found that only 16% of enterprise AI deployments (and 27% of startup deployments) qualify as true agents. Source: Menlo Ventures, 2025: The State of Generative AI in the Enterprise (2025); Survey. https://menlovc.com/perspective/2025-the-state-of-generative-ai-in-the-enterprise/
- a16z and Mercury's ranking of the top 50 AI apps by actual startup spend found horizontal tools make up 60% of the list, led by #1 OpenAI and #2 Anthropic. Source: Andreessen Horowitz (a16z) with Mercury, The AI Application Spending Report: Where Startup Dollars Really Go (2025); Observed data. https://a16z.com/the-ai-application-spending-report-where-startup-dollars-really-go/
- MIT NANDA found that AI tools bought from external partners reached deployment about 67% of the time, versus about 33% for internally built tools. Source: MIT NANDA (Project NANDA, MIT Media Lab), The GenAI Divide: State of AI in Business 2025 (2025); Survey. https://mlq.ai/media/quarterly_decks/v0.1_State_of_AI_in_Business_2025_Report.pdf
- MIT NANDA estimates about 50% of generative AI budgets go to sales and marketing, even though back-office automation often delivers better ROI. Source: MIT NANDA (Project NANDA, MIT Media Lab), The GenAI Divide: State of AI in Business 2025 (2025); Survey. https://mlq.ai/media/quarterly_decks/v0.1_State_of_AI_in_Business_2025_Report.pdf
- IBM found half of CEOs say rapid AI investment has left their organization with disconnected, piecemeal technology. Source: IBM Institute for Business Value, 2025 CEO Study (press release) (2025); Survey. https://newsroom.ibm.com/2025-05-06-ibm-study-ceos-double-down-on-ai-while-navigating-enterprise-hurdles
- According to ICONIQ, software companies use an average of 2.8 AI models for customer-facing products. Source: ICONIQ, 2025 State of AI: The Builder's Playbook (2025); Survey. https://www.iconiq.com/growth/reports/2025-state-of-ai
- Menlo Ventures found that organizations typically deploy three or more foundation models, routing between them by use case. Source: Menlo Ventures, 2024: The State of Generative AI in the Enterprise (2024); Survey. https://menlovc.com/2024-the-state-of-generative-ai-in-the-enterprise/
- Menlo Ventures found that just 1% of enterprise leaders named price as a selection concern when choosing generative AI tools. Source: Menlo Ventures, 2024: The State of Generative AI in the Enterprise (2024); Survey. https://menlovc.com/2024-the-state-of-generative-ai-in-the-enterprise/

### Bills nobody can forecast

- ChatGPT exceeds its contracted ceiling 35.4% of the time with a median overage of 13.0%, according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- The majority of applications that consistently exceed their contracted ceilings are AI-powered, according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- Mavvrik's 2026 State of AI Cost Governance report found only 11% of organizations can forecast AI costs within ±10%, down from 15% in 2025. Source: Mavvrik and Benchmarkit, 2026 State of AI Cost Governance Report (2026); Survey. https://www.mavvrik.ai/press-releases/ai-bill-shock-hits-the-boardroom/
- According to Mavvrik and Benchmarkit, 80% of enterprises miss their AI infrastructure cost forecasts by more than 25%, and 24% are off by 50% or more. Source: Mavvrik and Benchmarkit, 2025 State of AI Cost Management (State of AI Cost Governance) (2025); Survey. https://www.mavvrik.ai/news/2025-state-of-ai-cost-management-research-finds-85-of-companies-miss-ai-forecasts-by-10/
- Cursor AI runs a median 20.5% over contract when it overages, the highest intensity in Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- 59% of IT asset managers say wasted AI spend increased year over year, according to Flexera's 2026 State of ITAM Report. Source: Flexera, 2026 State of ITAM Report (2026); Survey. https://www.flexera.com/about-us/press-center/flexera-2026-state-of-itam-report-reveals-only-31-percent-organizations-have-visibility-into-ai-as-spend-surges
- Only 31% of organizations have accurate visibility into their AI software, according to Flexera's 2026 State of ITAM Report. Source: Flexera, 2026 State of ITAM Report (2026); Survey. https://www.flexera.com/about-us/press-center/flexera-2026-state-of-itam-report-reveals-only-31-percent-organizations-have-visibility-into-ai-as-spend-surges
- Gartner predicts that through 2029, organizations that do not centrally monitor and manage SaaS-hosted AI tools will incur at least 50% higher expense and be at least five times more likely to suffer a cyber incident. Source: Gartner (via USU reprint), 2026 Gartner Magic Quadrant for SaaS Management Platforms (2026); Forecast. https://www.usu.com/en/saas-management/resources/2026-gartner-magic-quadrant-for-saas-management-platforms
- Ramp's token price index shows the effective price businesses pay per million AI tokens fell 41% to $0.68 by September 2026, down from a 2026 peak of $1.15 in March. Source: Ramp (Ramp Economics Lab), Ramp AI Index, September 2026 update (2026); Observed data. https://ramp.com/data/ai-index-sept-2026
- Gartner predicts AI inference costs per agentic workflow will rise more than fivefold through 2028, even as per-token prices fall, because agents consume far more tokens per task. Source: Gartner, Press release: Gartner Predicts AI Inference Costs Per Agentic Workflow Will Increase More Than Fivefold Through 2028 (2026); Forecast. https://www.gartner.com/en/newsroom/press-releases/2026-08-17-gartner-predicts-ai-inference-costs-per-agentic-workflow-will-increase-more-than-fivefold-through-2028
- According to Mavvrik, 40% of organizations had to escalate a surprise AI cost to the board in the past year, 33% imposed emergency spending freezes and 25% delayed or cancelled an AI initiative. Source: Mavvrik and Benchmarkit, 2026 State of AI Cost Governance Report (2026); Survey. https://www.mavvrik.ai/press-releases/ai-bill-shock-hits-the-boardroom/
- According to Mavvrik, 49% of companies were forced to reprice AI-powered products because of unforeseen AI cost increases. Source: Mavvrik and Benchmarkit, 2026 State of AI Cost Governance Report (2026); Survey. https://www.mavvrik.ai/press-releases/ai-bill-shock-hits-the-boardroom/
- Mavvrik found only 44% of organizations include on-prem AI infrastructure in cost reporting, and 15% of those running agentic workloads cannot attribute agent costs at any level. Source: Mavvrik and Benchmarkit, 2026 State of AI Cost Governance Report (2026); Survey. https://www.mavvrik.ai/press-releases/ai-bill-shock-hits-the-boardroom/
- According to Flexera's 2026 AI Pulse Report, 80% of organizations increased AI investment, yet more than a third say they overspent on AI applications and 14% report wasted AI spend. Source: Flexera, Flexera 2026 AI Pulse Report (2026); Survey. https://www.flexera.com/blog/perspectives/flexera-2026-ai-pulse-report-what-leaders-need-to-know-about-ais-accelerating-impact/
- KPMG's Q3 2026 AI Pulse found 74% of large organizations now include cost reviews in AI approvals (up from 61% a quarter earlier), and 43% have usage or token budgets. Source: KPMG US, Quarterly AI Pulse Survey, Q3 2026 (2026); Survey. https://kpmg.com/us/en/media/news/q3-ai-pulse-2026.html
- KPMG's Global AI Pulse found nearly half of organizations have rephased AI deployments when costs began to outweigh expected value. Source: KPMG International, Global AI Pulse Q2 2026 (2026); Survey. https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2026/06/global-ai-pulse-q2.pdf
- According to KPMG, organizations with full visibility into AI operating costs are five times more likely to report established ROI than those without (15% vs. 3%). Source: KPMG International, Global AI Pulse Q2 2026 (2026); Survey. https://assets.kpmg.com/content/dam/kpmgsites/xx/pdf/2026/06/global-ai-pulse-q2.pdf
- Goldman Sachs Research says chipmakers are cutting the cost per token for AI inference by 60-70% a year, while forecasting agentic AI will drive a 24-fold increase in token consumption by 2030. Source: Goldman Sachs Research, AI Agents Forecast to Boost Tech Cash Flow as Usage Soars (2026); Forecast. https://www.goldmansachs.com/insights/articles/ai-agents-forecast-to-boost-tech-cash-flow-as-usage-soars
- 85% of technology executives lack full visibility into real-time AI spend, and AI is projected to grow from under 15% of IT budgets in 2025 to nearly 25% by 2027, according to IBM. Source: IBM Institute for Business Value, CIO/CTO AI control gap study (with Oxford Economics) (2026); Survey. https://newsroom.ibm.com/2026-06-08-new-ibm-study-finds-cios-and-ctos-face-growing-ai-control-gap-as-enterprise-deployment-scales
- 80% of IT leaders report increased spending on AI applications and over a third believe they are overspending, according to Flexera's 2026 IT Priorities report. Source: Flexera, Flexera IT Priorities Report (2026 strategy) (2025); Survey. https://www.flexera.com/about-us/press-center/flexera-report-reveals-priorities-driving-it-strategy-for-2026-ai-takes-the-lead
- Mavvrik and Benchmarkit found 84% of companies see gross margins eroded by 6% or more because of AI infrastructure costs, with 26% hit by 16% or more. Source: Mavvrik and Benchmarkit, 2025 State of AI Cost Management (State of AI Cost Governance) (2025); Survey. https://www.mavvrik.ai/news/2025-state-of-ai-cost-management-research-finds-85-of-companies-miss-ai-forecasts-by-10/
- According to a Gartner survey of over 300 CIOs, more than 90% said managing cost limits their ability to get value from AI. Source: Gartner, Press release: Gartner Identifies Four Emerging Challenges to Delivering Value from AI Safely and at Scale (2024); Survey. https://www.gartner.com/en/newsroom/press-releases/2024-10-21-gartner-identifies-four-emerging-challenges-to-delivering-value-from-ai-safely-and-at-scale
- Gartner estimates that CIOs who don't understand how their generative AI costs scale could make a 500% to 1,000% error in their cost calculations. Source: Gartner, Press release: Gartner Identifies Four Emerging Challenges to Delivering Value from AI Safely and at Scale (2024); Forecast. https://www.gartner.com/en/newsroom/press-releases/2024-10-21-gartner-identifies-four-emerging-challenges-to-delivering-value-from-ai-safely-and-at-scale

### Still waiting on the return

- MIT NANDA's GenAI Divide report found that despite $30-40 billion in enterprise investment, 95% of organizations are getting zero return from generative AI. Source: MIT NANDA (Project NANDA, MIT Media Lab), The GenAI Divide: State of AI in Business 2025 (2025); Survey. https://mlq.ai/media/quarterly_decks/v0.1_State_of_AI_in_Business_2025_Report.pdf
- A Gartner survey of 782 infrastructure and operations leaders found only 28% of AI use cases in I&O fully succeed and meet ROI expectations, while 20% fail outright. Source: Gartner, Press release: Gartner Says AI Projects in I&O Stall Ahead of Meaningful ROI Returns (2026); Survey. https://www.gartner.com/en/newsroom/press-releases/2026-04-07-gartner-says-artificial-intelligence-projects-in-infrastructure-and-operations-stall-ahead-of-meaningful-roi-returns
- Deloitte's State of AI in the Enterprise 2026 found 74% of organizations hope to grow revenue through AI, but only 20% are already doing so. Source: Deloitte AI Institute, The State of AI in the Enterprise, 2026 (2026); Survey. https://www.deloitte.com/us/en/what-we-do/capabilities/applied-artificial-intelligence/content/state-of-ai-in-the-enterprise.html
- Workday research found nearly 40% of the time employees save with AI is lost to rework, and only 14% consistently get clear, positive net outcomes from AI. Source: Workday, Beyond Productivity: Measuring the Real Value of AI (press release) (2026); Survey. https://newsroom.workday.com/2026-01-14-New-Workday-Research-Companies-Are-Leaving-AI-Gains-on-the-Table
- Only 19% of IT leaders say AI initiatives have met or exceeded ROI goals, according to Foundry's 2026 State of the CIO study. Source: Foundry (CIO.com), 2026 State of the CIO Study (2026); Survey. https://resources.foundryco.com/hubfs/CIO_Foundry_%20State%20of%20CIO_%20Study%202026.pdf
- According to Menlo Ventures, 47% of AI deals go to production once an organization commits to exploring a solution, nearly twice the 25% rate for traditional SaaS. Source: Menlo Ventures, 2025: The State of Generative AI in the Enterprise (2025); Survey. https://menlovc.com/perspective/2025-the-state-of-generative-ai-in-the-enterprise/
- CloudZero found only about half (51%) of organizations can confidently evaluate the ROI of their AI costs. Source: CloudZero, The State Of AI Costs In 2025 (2025); Survey. https://www.cloudzero.com/press-releases/20250522/
- Deloitte found most organizations achieve satisfactory ROI on a typical AI use case only after two to four years; just 6% saw payback in under a year. Source: Deloitte, AI ROI: The paradox of rising investment and elusive returns (2025); Survey. https://www.deloitte.com/global/en/issues/generative-ai/ai-roi-the-paradox-of-rising-investment-and-elusive-returns.html
- According to Deloitte, just 10% of organizations using agentic AI say they are currently realizing significant ROI from it. Source: Deloitte, AI ROI: The paradox of rising investment and elusive returns (2025); Survey. https://www.deloitte.com/global/en/issues/generative-ai/ai-roi-the-paradox-of-rising-investment-and-elusive-returns.html
- BCG found 60% of companies are AI 'laggards' reporting minimal revenue and cost gains, while just 5% qualify as 'future-built' for AI. Source: Boston Consulting Group (BCG), The Widening AI Value Gap (press release) (2025); Survey. https://www.bcg.com/press/30september2025-ai-leaders-outpace-laggards-revenue-growth-cost-savings
- IBM's 2025 CEO Study found only 25% of AI initiatives have delivered expected ROI over the last few years, and only 16% have scaled enterprise-wide. Source: IBM Institute for Business Value, 2025 CEO Study (press release) (2025); Survey. https://newsroom.ibm.com/2025-05-06-ibm-study-ceos-double-down-on-ai-while-navigating-enterprise-hurdles
- According to IBM, 64% of CEOs admit fear of falling behind drives them to invest in technologies before they clearly understand the value. Source: IBM Institute for Business Value, 2025 CEO Study (press release) (2025); Survey. https://newsroom.ibm.com/2025-05-06-ibm-study-ceos-double-down-on-ai-while-navigating-enterprise-hurdles
- ICONIQ found most companies give about 70% of employees access to internal AI tools, but only about half use them regularly. Source: ICONIQ, 2025 State of AI: The Builder's Playbook (2025); Survey. https://www.iconiq.com/growth/reports/2025-state-of-ai
- According to Menlo Ventures, implementation costs were cited in 26% of failed generative AI pilots, ahead of data privacy (21%) and disappointing ROI (18%). Source: Menlo Ventures, 2024: The State of Generative AI in the Enterprise (2024); Survey. https://menlovc.com/2024-the-state-of-generative-ai-in-the-enterprise/
- Gartner predicted at least 30% of generative AI projects would be abandoned after proof of concept by the end of 2025, citing poor data quality, risk controls, escalating costs or unclear value. Source: Gartner, Press release: Gartner Predicts 30% of Generative AI Projects Will Be Abandoned After Proof of Concept By End of 2025 (2024); Forecast. https://www.gartner.com/en/newsroom/press-releases/2024-07-29-gartner-predicts-30-percent-of-generative-ai-projects-will-be-abandoned-after-proof-of-concept-by-end-of-2025
- BCG's 2024 research found 74% of companies have yet to show tangible value from their use of AI, and only 4% have cutting-edge AI capabilities across functions. Source: Boston Consulting Group (BCG), Where's the Value in AI? (press release) (2024); Survey. https://www.bcg.com/press/24october2024-ai-adoption-in-2024-74-of-companies-struggle-to-achieve-and-scale-value

## Joiners, movers and leavers statistics

Access outlives the job. Departing employees keep seats, tokens and data long after they leave.

### Leavers who never quite leave

- An average of 2.5% of license seats are assigned to offboarded users, roughly 1 in 40, according to Torii's 2026 SaaS Benchmark. Source: Torii, SaaS Benchmark Annual Report 2026 (2026); Torii data. https://www.toriihq.com/reports/saas-benchmark-annual-report-2026
- 38% of employees say they have successfully accessed a prior employer's account, according to 1Password's 2025 Access-Trust Gap report. Source: 1Password, Annual Report 2025: The Access-Trust Gap (2025); Survey. https://1password.com/reports/annual-report-2025
- Veza's 2026 State of Identity & Access report found 38% of identity provider accounts were dormant (inactive 90+ days) but still active, up from 20% the year before. Source: Veza, 2026 State of Identity & Access Report (2025); Observed data. https://veza.com/wp-content/uploads/2025/12/SOIA-2026-Veza.pdf
- Proofpoint platform data shows departing employees caused 87% of anomalous file exfiltration among its cloud tenants over a nine-month period. Source: Proofpoint, 2024 Data Loss Landscape (2024); Observed data. https://www.proofpoint.com/sites/default/files/threat-reports/pfpt-us-tr-data-loss-landscape-report-2024.pdf
- IT teams spend an average of 5 hours per departing employee offboarding cloud and SaaS access, per a 2023 Nudge Security survey. Source: Nudge Security, Employee offboarding by the numbers (2023); Survey. https://www.nudgesecurity.com/post/employee-offboarding-by-the-numbers
- In a 2022 Beyond Identity survey, 83% of former employees said they still had access to the digital assets of a previous employer. Source: Beyond Identity, Former Employees Admit to Using Continued Account Access to Harm Previous Employers (2022); Survey. https://www.beyondidentity.com/resource/former-employees-admit-to-using-continued-account-access-to-harm-previous-employers
- 76% of IT leaders agree or strongly agree that employee offboarding is a significant security threat, according to Torii's 2021 survey. Source: Torii, Offboarding Security for a Remote Workforce (2021); Torii data. https://www.toriihq.com/blog/new-report-76-of-it-leaders-say-offboarding-is-a-significant-security-threat
- Only 1 in 4 organizations automates offboarding, according to BetterCloud's 2026 State of SaaS report, and 18% experienced a data breach caused by an offboarded user who still had access. Source: BetterCloud, 2026 State of SaaS Report (2026); Survey. https://www.bettercloud.com/monitor/the-2026-state-of-saas-report/
- 51% of organizations lack the ability to properly offboard dormant identities and accounts across their SaaS estate, according to Valence Security's 2025-26 State of SaaS Security research with the Cloud Security Alliance. Source: Valence Security (with Cloud Security Alliance), The State of SaaS Security: Trends and Insights for 2025-2026 (2025); Survey. https://www.valencesecurity.com/resources/blogs/valences-latest-research-on-the-2025-2026-state-of-saas-security-overconfidence-despite-critical-gaps
- 88% of organizations have stale but still-enabled 'ghost' user accounts, according to Varonis's 2025 State of Data Security Report. Source: Varonis, 2025 State of Data Security Report (2025); Observed data. https://www.varonis.com/blog/state-of-data-security-report
- Across enterprises Veza analyzed, 78,000 ex-employees (3% of all employees) still held active credentials. Source: Veza, 2026 State of Identity & Access Report (2025); Observed data. https://veza.com/wp-content/uploads/2025/12/SOIA-2026-Veza.pdf
- Veza found 8% of identity provider accounts were orphaned, with no matching owner in HR systems, a 40% year-over-year increase. Source: Veza, 2026 State of Identity & Access Report (2025); Observed data. https://veza.com/wp-content/uploads/2025/12/SOIA-2026-Veza.pdf
- Security professionals rank departing employees as the third riskiest category of user, per Proofpoint's 2024 Data Loss Landscape survey. Source: Proofpoint, 2024 Data Loss Landscape (2024); Survey. https://www.proofpoint.com/sites/default/files/threat-reports/pfpt-us-tr-data-loss-landscape-report-2024.pdf
- Half of IT departments take more than 24 hours to offboard departing employees, according to BetterCloud's 2024 State of SaaSOps research. Source: BetterCloud, State of SaaSOps 2024 (2024); Survey. https://www.bettercloud.com/monitor/state-of-saasops-2024-securing-data-in-saas-top-it-challenge/
- 70% of IT professionals have experienced the impacts of ineffective offboarding, from business disruption to unauthorized access (Nudge Security, 2023). Source: Nudge Security, Employee offboarding by the numbers (2023); Survey. https://www.nudgesecurity.com/post/employee-offboarding-by-the-numbers
- 69% of IT teams use three or more sources just to identify all of a departing employee's cloud and SaaS access (Nudge Security, 2023). Source: Nudge Security, Employee offboarding by the numbers (2023); Survey. https://www.nudgesecurity.com/post/employee-offboarding-by-the-numbers
- Beyond Identity's 2022 survey found 56% of former employees who retained access said they had used it to harm their former employer. Source: Beyond Identity, Former Employees Admit to Using Continued Account Access to Harm Previous Employers (2022); Survey. https://www.beyondidentity.com/resource/former-employees-admit-to-using-continued-account-access-to-harm-previous-employers
- Nearly a quarter (24%) of former employees admitted deliberately keeping a password after leaving a job, per Beyond Identity's 2022 survey. Source: Beyond Identity, Former Employees Admit to Using Continued Account Access to Harm Previous Employers (2022); Survey. https://www.beyondidentity.com/resource/former-employees-admit-to-using-continued-account-access-to-harm-previous-employers
- 74% of business leaders surveyed by Beyond Identity said their company had been negatively impacted by a former employee breaching its digital security. Source: Beyond Identity, Former Employees Admit to Using Continued Account Access to Harm Previous Employers (2022); Survey. https://www.beyondidentity.com/resource/former-employees-admit-to-using-continued-account-access-to-harm-previous-employers
- Only 9% of departing employees in Beyond Identity's 2022 survey remembered an IT specialist being involved in their exit. Source: Beyond Identity, Former Employees Admit to Using Continued Account Access to Harm Previous Employers (2022); Survey. https://www.beyondidentity.com/resource/former-employees-admit-to-using-continued-account-access-to-harm-previous-employers
- Among employees who had been fired, 70% said they had intentionally caused harm using continued access, according to Beyond Identity's 2022 survey. Source: Beyond Identity, Former Employees Admit to Using Continued Account Access to Harm Previous Employers (2022); Survey. https://www.beyondidentity.com/resource/former-employees-admit-to-using-continued-account-access-to-harm-previous-employers
- Mimecast says that when employees leave, there is a 1 in 3 chance they take IP with them. Source: Mimecast (Code42 Incydr), Departing Employee Data Theft (use-case page); Vendor or analysis. https://www.mimecast.com/use-cases/departing-employees/

### Permissions pile up

- Microsoft found that just 2% of the permissions granted to human and workload identities were actually used in 2023. Source: Microsoft, 2024 State of Multicloud Security Risk Report (2024); Observed data. https://www.microsoft.com/en-us/security/blog/2024/05/29/6-insights-from-microsofts-2024-state-of-multicloud-risk-report-to-evolve-your-security-strategy/
- Nudge Security customers average 88 OAuth grants per employee, 31 of them carrying data-level permissions. Source: Nudge Security, The Hidden Risk in Your OAuth Grant Inventory (blog) (2026); Observed data. https://www.nudgesecurity.com/post/every-oauth-grant-has-two-ends
- According to Veza, 16.5% of all permissions belong to inactive users, up from 12% a year earlier. Source: Veza, 2026 State of Identity & Access Report (2025); Observed data. https://veza.com/wp-content/uploads/2025/12/SOIA-2026-Veza.pdf
- The average worker in Veza's 2026 dataset holds 96,000 entitlements. Source: Veza, 2026 State of Identity & Access Report (2025); Observed data. https://veza.com/wp-content/uploads/2025/12/SOIA-2026-Veza.pdf
- Veza reports that 'safe, compliant' permissions fell from 70% in 2024 to 55.3% in 2025, driven by ungoverned permissions rising from 5% to 27.8%. Source: Veza, 2026 State of Identity & Access Report (2025); Observed data. https://veza.com/wp-content/uploads/2025/12/SOIA-2026-Veza.pdf
- Veza classed 3.3% of enterprise permissions as 'residual': access that should have been revoked after a termination, job change or finished task. Source: Veza, 2026 State of Identity & Access Report (2025); Observed data. https://veza.com/wp-content/uploads/2025/12/SOIA-2026-Veza.pdf
- 82% of security leaders say their organization suffered a cyberattack or breach in the past year due to improper access or over-privileged users, up from 77% in 2024 (ConductorOne). Source: ConductorOne, Future of Identity Security Report 2025 (2025); Survey. https://info.conductorone.com/hubfs/FIS%20Report%202025.pdf
- More than half of cloud identities had access to all permissions and all resources in 2023, according to Microsoft's 2024 multicloud risk report. Source: Microsoft, 2024 State of Multicloud Security Risk Report (2024); Observed data. https://www.microsoft.com/en-us/security/blog/2024/05/29/6-insights-from-microsofts-2024-state-of-multicloud-risk-report-to-evolve-your-security-strategy/
- Over 51,000 permissions can now be granted to users and workloads across major clouds, up from 40,000 in 2022, per Microsoft. Source: Microsoft, 2024 State of Multicloud Security Risk Report (2024); Observed data. https://www.microsoft.com/en-us/security/blog/2024/05/29/6-insights-from-microsofts-2024-state-of-multicloud-risk-report-to-evolve-your-security-strategy/
- Microsoft's 2023 State of Cloud Permissions Risks report found identities used just 1% of the permissions they were granted, and over 60% of all identities were inactive. Source: Microsoft, 2023 State of Cloud Permissions Risks (2023); Observed data. https://www.infosecurity-magazine.com/news/just-1-of-cloud-permissions-used/

### Access requests, onboarding and reviews

- App assignment requests make up 28.1% of all IT help desk tickets, more than four times the next most common request, according to Fixify's 2026 IT Help Desk Benchmark Report. Source: Fixify, 2026 IT Help Desk Benchmark Report (2026); Observed data. https://www.fixify.com/blog/most-common-it-help-desk-tickets
- Access requests have surged more than 12x and access certifications more than 9x over the past two years, according to Okta's Businesses at Work 2026 report. Source: Okta, Businesses at Work 2026 (2026); Observed data. https://www.okta.com/reports/businesses-at-work/
- Gartner predicts that by 2028, 70% of CISOs will use identity visibility and intelligence capabilities to shrink the IAM attack surface. Source: Gartner, Gartner Predicts AI Applications Will Drive 50% of Cybersecurity Incident Response Efforts by 2028 (press release) (2026); Forecast. https://www.gartner.com/en/newsroom/press-releases/2026-03-17-gartner-predicts-ai-applications-will-drive-50-percent-of-cybersecurity-incident-response-efforts-by-2028
- Only 45% of employees had their accounts, software and system access fully set up on their first day; 48% said some access was missing or delayed (allwhere survey). Source: allwhere, Employee Onboarding Statistics 2026 (2026); Survey. https://www.allwhere.co/post/employee-onboarding-statistics
- 16% of employees seriously considered quitting in their first month because of a bad onboarding experience, per an allwhere survey. Source: allwhere, Employee Onboarding Statistics 2026 (2026); Survey. https://www.allwhere.co/post/employee-onboarding-statistics
- App assignment, permissions management and employee offboarding together account for 40% of all IT help desk tickets, according to Fixify's 2026 benchmark. Source: Fixify, 2026 IT Help Desk Benchmark Report (2026); Observed data. https://www.fixify.com/blog/most-common-it-help-desk-tickets
- 63% of organizations remain stuck in the earliest stages of identity security maturity, per SailPoint's 2025 Horizons of Identity Security report. Source: SailPoint, 2025 Horizons of Identity Security (2025); Survey. https://www.sailpoint.com/blog/2025-horizons-identity-security-insights
- Only 14% of organizations say their most recent identity security deployment was completely successful, and 48% ran over budget (SailPoint, 2025). Source: SailPoint, 2025 Horizons of Identity Security (2025); Survey. https://www.sailpoint.com/blog/2025-horizons-identity-security-insights
- Access requests and account provisioning are among the top three tasks security leaders expect to hand to AI agents, cited by 46% (ConductorOne, 2025). Source: ConductorOne, Future of Identity Security Report 2025 (2025); Survey. https://info.conductorone.com/hubfs/FIS%20Report%202025.pdf
- Half of security leaders cite the complexity of existing systems as their biggest identity and access management challenge (ConductorOne, 2025). Source: ConductorOne, Future of Identity Security Report 2025 (2025); Survey. https://info.conductorone.com/hubfs/FIS%20Report%202025.pdf
- Only 40% of organizations automate offboarding and 34% automate onboarding, even though IT ranks them as top challenges, according to BetterCloud's 2025 State of SaaS report. Source: BetterCloud, State of SaaS 2025 (2025); Survey. https://www.prnewswire.com/news-releases/state-of-saas-2025-report-reveals-operational-complexity-and-risk-concerns-as-economic-uncertainty-and-ai-apply-spending-pressure-on-technology-investments-302441868.html
- 57% of organizations report fragmented SaaS administration and 54% lack automation for identity lifecycle management, according to the Cloud Security Alliance's State of SaaS Security 2025 report. Source: Cloud Security Alliance, State of SaaS Security Report 2025 (2025); Survey. https://cloudsecurityalliance.org/artifacts/state-of-saas-security-report-2025
- In IDSA's 2024 study, 42% of organizations said more timely reviews of access to sensitive data could have prevented their identity incidents, and 50% pointed to privileged access reviews. Source: Identity Defined Security Alliance (IDSA), 2024 Trends in Securing Digital Identities (2024); Survey. https://www.prnewswire.com/news-releases/new-study-reveals-90-of-organizations-experienced-an-identity-related-incident-in-the-last-year-84-reported-a-direct-business-impact-302156769.html
- 47% of security leaders say their identity security strategy and access policies hinder team productivity, per ConductorOne's 2024 Identity Security Outlook. Source: ConductorOne, Identity Security Outlook Report 2024 (2024); Survey. https://www.c1.ai/news/press-release/conductorones-new-identity-security-outlook-report-reveals-the-top-identity-related-challenges-and-opportunities-in-2024/
- Fewer than one in three IT teams have automated 75% or more of their offboarding process, per Nudge Security's 2023 survey. Source: Nudge Security, Employee offboarding by the numbers (2023); Survey. https://www.nudgesecurity.com/post/employee-offboarding-by-the-numbers
- 51% of new hires name technology issues among their top onboarding frustrations, per BambooHR's 2023 onboarding study. Source: BambooHR, Onboarding study (press release: 44% of New Hires Regret their Decision Within a Week) (2023); Survey. https://www.bamboohr.com/about-bamboohr/press-release/44-of-new-hires-regret-their-decision-within-a-week-bamboohr-study-finds
- 70% of new hires decide whether a job is the right fit within the first month, and companies have about 44 days to convince them to stay (BambooHR, 2023). Source: BambooHR, Onboarding study (press release: 44% of New Hires Regret their Decision Within a Week) (2023); Survey. https://www.bamboohr.com/about-bamboohr/press-release/44-of-new-hires-regret-their-decision-within-a-week-bamboohr-study-finds
- 51% of IT and security practitioners say they cannot keep pace with the number of access change requests, per Saviynt/Ponemon research. Source: Saviynt (research by Ponemon Institute), State of Enterprise Identity (2022); Survey. https://saviynt.com/blog/top-highlights-from-new-state-of-enterprise-identity-report
- 46% of organizations failed to comply with regulations because of access-related issues, according to Saviynt and Ponemon's 2022 study. Source: Saviynt (research by Ponemon Institute), State of Enterprise Identity (2022); Survey. https://saviynt.com/blog/top-highlights-from-new-state-of-enterprise-identity-report
- Only 16% of organizations have a fully mature IAM strategy in place (Saviynt/Ponemon, 2022). Source: Saviynt (research by Ponemon Institute), State of Enterprise Identity (2022); Survey. https://saviynt.com/blog/top-highlights-from-new-state-of-enterprise-identity-report

### When access goes wrong

- The 2026 Ponemon Cost of Insider Risks report puts the average annual cost of insider security incidents at $19.5M per organization. Source: Ponemon Institute / DTEX Systems, 2026 Cost of Insider Risks Global Report (2026); Survey. https://ponemon.dtex.ai/
- Insider incidents took 67 days on average to contain in Ponemon's 2026 study, down from 86 days in 2023. Source: Ponemon Institute / DTEX Systems, 2026 Cost of Insider Risks Global Report (2026); Survey. https://ponemon.dtex.ai/
- Negligent insiders cost organizations $10.3M a year on average, up 17% year over year, per Ponemon's 2026 Cost of Insider Risks report. Source: Ponemon Institute / DTEX Systems, 2026 Cost of Insider Risks Global Report (2026); Survey. https://ponemon.dtex.ai/
- Organizations now allocate 19% of their IT budget to insider risk management, up from 8.2% in 2023, according to Ponemon and DTEX. Source: Ponemon Institute / DTEX Systems, 2026 Cost of Insider Risks Global Report (2026); Survey. https://ponemon.dtex.ai/
- Internal actors were involved in 12% of breaches in Verizon's 2026 DBIR, down from 18% the year before. Source: Verizon, 2026 Data Breach Investigations Report (2026); Observed data. https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf
- Deliberate privilege misuse by insiders accounted for just under 4% of breaches in the 2026 DBIR, and 60% of those were motivated by convenience rather than money. Source: Verizon, 2026 Data Breach Investigations Report (2026); Observed data. https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf
- End-users made up 75% of internal actors in breaches, and system administrators 19%, per Verizon's 2026 DBIR. Source: Verizon, 2026 Data Breach Investigations Report (2026); Observed data. https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf
- Verizon's 2026 DBIR notes that insiders walking off with proprietary data are 'frequently the hardest to catch without specific offboarding processes in place.' Source: Verizon, 2026 Data Breach Investigations Report (2026); Observed data. https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf
- 80% of IT and security leaders surveyed by ConductorOne (C1) experienced at least one access-related breach in the past year. Source: ConductorOne (C1), 2026 Future of Identity Report (2026); Survey. https://www.c1.ai/resources/2026-future-of-identity-report/
- For every insider incident, companies spend about $211,021 on containment but just $37,756 on monitoring, per Ponemon's 2025 Cost of Insider Risks report. Source: Ponemon Institute / DTEX Systems, 2025 Cost of Insider Risks Global Report (2025); Survey. https://www.dtex.ai/blog/2025-cost-insider-risks-takeaways/
- Insider incidents that took more than 91 days to contain cost $18.7M on average, versus $10.6M for those contained in under 31 days (Ponemon, 2025). Source: Ponemon Institute / DTEX Systems, 2025 Cost of Insider Risks Global Report (2025); Survey. https://www.dtex.ai/blog/2025-cost-insider-risks-takeaways/
- Just 1% of users are responsible for 88% of data loss events, according to Proofpoint platform data. Source: Proofpoint, 2024 Data Loss Landscape (2024); Observed data. https://www.proofpoint.com/sites/default/files/threat-reports/pfpt-us-tr-data-loss-landscape-report-2024.pdf
- 85% of organizations surveyed by Proofpoint experienced at least one data loss incident in the past year, averaging just over 15 incidents each. Source: Proofpoint, 2024 Data Loss Landscape (2024); Survey. https://www.proofpoint.com/sites/default/files/threat-reports/pfpt-us-tr-data-loss-landscape-report-2024.pdf
- Monthly insider-driven data exposure, loss, leak and theft events have risen 28% on average since 2021, according to Code42's 2024 Data Exposure Report, a survey of 700 US cybersecurity professionals. Source: Code42 (Mimecast), 2024 Data Exposure Report (2024); Survey. https://www.globenewswire.com/en/news-release/2024/03/05/2840495/0/en/2024-Data-Exposure-Report-Companies-at-Risk-of-Data-Loss-Driven-by-Changing-Workforce-AI-Usage-and-Source-Code-Exfiltration.html
- Security leaders estimate an average insider-driven data event costs $15 million, per Code42's 2024 Data Exposure Report. Source: Mimecast (Code42), 2024 Data Exposure Report (2024); Survey. https://www.mimecast.com/resources/white-papers/annual-data-exposure-report-2024/
- Cybersecurity professionals surveyed for Code42's 2024 Data Exposure Report say they spend an average of 3 hours a day investigating insider-driven data events. Source: Code42 (Mimecast), 2024 Data Exposure Report (2024); Survey. https://www.globenewswire.com/en/news-release/2024/03/05/2840495/0/en/2024-Data-Exposure-Report-Companies-at-Risk-of-Data-Loss-Driven-by-Changing-Workforce-AI-Usage-and-Source-Code-Exfiltration.html
- 90% of organizations experienced at least one identity-related incident in the past year, according to IDSA's 2024 research. Source: Identity Defined Security Alliance (IDSA), 2024 Trends in Securing Digital Identities (2024); Survey. https://www.prnewswire.com/news-releases/new-study-reveals-90-of-organizations-experienced-an-identity-related-incident-in-the-last-year-84-reported-a-direct-business-impact-302156769.html
- 84% of organizations hit by an identity-related incident reported a direct business impact, up from 68% in 2023 (IDSA). Source: Identity Defined Security Alliance (IDSA), 2024 Trends in Securing Digital Identities (2024); Survey. https://www.prnewswire.com/news-releases/new-study-reveals-90-of-organizations-experienced-an-identity-related-incident-in-the-last-year-84-reported-a-direct-business-impact-302156769.html

## AI agents and non-human identities statistics

Machine identities outnumber people many times over, and AI agents are the newest and least governed.

### Machines outnumber people

- According to CyberArk's 2025 Identity Security Landscape, there are 82 machine identities for every human in organizations worldwide. Source: CyberArk, 2025 Identity Security Landscape (2025); Survey. https://web.archive.org/web/2025/https://www.cyberark.com/press/machine-identities-outnumber-humans-by-more-than-80-to-1-new-report-exposes-the-exponential-threats-of-fragmented-identity-security/
- Entro Labs found the average ratio of non-human to human identities grew from 92:1 to 144:1 in one year, a 56% jump. Source: Entro Security, NHI & Secrets Risk Report H1 2025 (2025); Observed data. https://www.globenewswire.com/news-release/2025/07/22/3119538/0/en/Entro-Reports-44-Increase-in-Machine-Identities-Nearly-Half-of-Secret-Exposures-Occur-Outside-Code.html
- Non-human identities grew 44% year over year from H1 2024 to H1 2025, according to Entro Labs. Source: Entro Security, NHI & Secrets Risk Report H1 2025 (2025); Observed data. https://www.globenewswire.com/news-release/2025/07/22/3119538/0/en/Entro-Reports-44-Increase-in-Machine-Identities-Nearly-Half-of-Secret-Exposures-Occur-Outside-Code.html
- 79% of security leaders expect the number of machine identities in their organization to grow, by as much as 150% over the next year, per CyberArk. Source: CyberArk, 2025 State of Machine Identity Security Report (2025); Survey. https://web.archive.org/web/2026/https://www.cyberark.com/press/new-cyberark-research-rapid-growth-of-machine-identities-ai-adoption-and-cloud-native-innovations-leave-organizations-more-vulnerable-to-attacks/
- Machine identities now make up more than 40% of all identities in an organization, per SailPoint's 2024 Horizons report. Source: SailPoint, Horizons of Identity Security 2024 (2024); Survey. https://www.sailpoint.com/press-releases/sailpoint-third-annual-horizons-identity-security

### AI agents are the newest identities

- 68% of organizations cannot clearly distinguish between human and AI agent activity, according to a 2026 Cloud Security Alliance survey. Source: Cloud Security Alliance (commissioned by Aembit), CSA survey report on AI agent identity and access (2026) (2026); Survey. https://cloudsecurityalliance.org/press-releases/2026/03/24/more-than-two-thirds-of-organizations-cannot-clearly-distinguish-ai-agent-from-human-actions
- 82% of organizations discovered previously unknown AI agents in their environment in the past year, according to a 2026 Cloud Security Alliance survey. Source: Cloud Security Alliance (commissioned by Token Security), Autonomous but Not Controlled: AI Agent Incidents Now Common in Enterprises (2026); Survey. https://cloudsecurityalliance.org/articles/new-cloud-security-alliance-survey-reveals-82-of-enterprises-have-unknown-ai-agents-in-their-environments
- According to SailPoint's 2025 AI agent research, 80% of companies say their AI agents have taken unintended actions, such as accessing unauthorized systems. Source: SailPoint, AI Agents: The New Attack Surface (AI agent adoption report) (2025); Survey. https://www.sailpoint.com/press-releases/sailpoint-ai-agent-adoption-report
- According to Netskope's AI Report 2026, 75% of organizations use Claude Code and 58% use Codex, up from negligible adoption a year earlier. Source: Netskope Threat Labs, Netskope AI Report: 2026 (2026); Observed data. https://www.netskope.com/resources/threat-labs-reports/netskope-ai-report-2026
- According to Netskope's AI Report 2026, MCP traffic increased 4x as organizations connect AI systems to sensitive data stores, driving a sharp rise in downstream data policy violations. Source: Netskope Threat Labs, Netskope AI Report: 2026 (2026); Observed data. https://www.netskope.com/resources/threat-labs-reports/netskope-ai-report-2026
- According to UpGuard's analysis of 18,000+ AI agent configuration files on GitHub, 1 in 5 developers have granted AI coding agents unrestricted access to perform high-risk actions without human oversight. Source: UpGuard, YOLO Mode: Hidden Risks in AI Coding Agents (press release) (2026); Vendor or analysis. https://www.upguard.com/press/new-research-from-upguard-1-in-5-developers-grant-ai-vibe-coding-tools-unrestricted-workstation-access
- According to Reco's State of Agent Security 2026, 50% of 500 published AI agent tools (MCP servers) can execute shell commands on the host machine. Source: Reco, The State of Agent Security 2026 (2026); Observed data. https://www.reco.ai/state-of-agent-security-2026
- According to ISACA's 2026 AI Pulse Poll, only 36% of respondents say humans approve most AI-generated actions before execution. Source: ISACA, 2026 AI Pulse Poll (preview, RSA Conference) (2026); Survey. https://www.isaca.org/about-us/newsroom/press-releases/2026/digital-trust-pros-dont-know-how-fast-they-could-shut-down-ai-after-a-security-incident
- According to Ivanti's 2026 research, 87% of security teams say adopting agentic AI is a priority, and 77% report at least some comfort allowing autonomous AI to act without human review. Source: Ivanti, Ivanti 2026 cybersecurity research (agentic AI) (2026); Survey. https://www.ivanti.com/company/press-releases/2026/adopting-agentic-ai-is-a-priority-for-87-of-security-teams-according-to-ivanti-s-research
- GitGuardian found 24,008 unique secrets exposed in Model Context Protocol (MCP) configuration files on public GitHub in 2025. Source: GitGuardian, The State of Secrets Sprawl 2026 (2026); Observed data. https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026-pr/
- 78% of organizations have no documented, formally adopted policy for creating or removing AI identities, per the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Oasis Security), The State of Non-Human Identity and AI Security (2026); Survey. https://cloudsecurityalliance.org/press-releases/2026/01/27/79-of-it-pros-feel-ill-equipped-to-prevent-attacks-via-nhi-csa-oasis-survey-finds
- Only 21% of organizations maintain a real-time registry or inventory of their AI agents, according to the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Strata Identity), Securing Autonomous AI Agents (2026); Survey. https://cloudsecurityalliance.org/press-releases/2026/02/05/cloud-security-alliance-strata-survey-finds-that-enterprises-are-in-time-to-trust-phase-as-they-build-ai-autonomy-foundations
- 84% of organizations doubt they could pass a compliance audit focused on AI agent behavior or access controls, per the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Strata Identity), Securing Autonomous AI Agents (2026); Survey. https://cloudsecurityalliance.org/press-releases/2026/02/05/cloud-security-alliance-strata-survey-finds-that-enterprises-are-in-time-to-trust-phase-as-they-build-ai-autonomy-foundations
- 44% of organizations use or plan to use static API keys to authenticate AI agents, and 43% username and password combinations, per the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Strata Identity), Securing Autonomous AI Agents (2026); Survey. https://cloudsecurityalliance.org/press-releases/2026/02/05/cloud-security-alliance-strata-survey-finds-that-enterprises-are-in-time-to-trust-phase-as-they-build-ai-autonomy-foundations
- 43% of organizations run AI agents on shared service accounts and 31% let agents operate under human user identities, per the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Aembit), CSA survey report on AI agent identity and access (2026) (2026); Survey. https://cloudsecurityalliance.org/press-releases/2026/03/24/more-than-two-thirds-of-organizations-cannot-clearly-distinguish-ai-agent-from-human-actions
- 45% of organizations apply the same privileged access controls to AI agents as they do to human identities, per CyberArk. Source: CyberArk, Privileged access study (January 2026) (2026); Survey. https://web.archive.org/web/2026/https://www.cyberark.com/press/new-study-only-1-of-organizations-have-fully-adopted-just-in-time-privileged-access-as-ai-driven-identities-rapidly-increase/
- According to Deloitte, only one in five companies has a mature governance model for autonomous AI agents, even as agentic AI use is poised to rise sharply. Source: Deloitte AI Institute, The State of AI in the Enterprise, 2026 (2026); Survey. https://www.deloitte.com/us/en/what-we-do/capabilities/applied-artificial-intelligence/content/state-of-ai-in-the-enterprise.html
- According to SailPoint's 2025 AI agent research, 82% of organizations already use AI agents, but only 44% have policies in place to secure them. Source: SailPoint, AI Agents: The New Attack Surface (AI agent adoption report) (2025); Survey. https://www.sailpoint.com/press-releases/sailpoint-ai-agent-adoption-report
- According to SailPoint's 2025 AI agent research, 23% of organizations reported their AI agents have been tricked into revealing access credentials. Source: SailPoint, AI Agents: The New Attack Surface (AI agent adoption report) (2025); Survey. https://www.sailpoint.com/press-releases/sailpoint-ai-agent-adoption-report
- According to SailPoint's 2025 AI agent research, 96% of technology professionals consider AI agents a growing risk, yet 98% of organizations plan to expand their use within the next year. Source: SailPoint, AI Agents: The New Attack Surface (AI agent adoption report) (2025); Survey. https://www.sailpoint.com/press-releases/sailpoint-ai-agent-adoption-report
- According to Microsoft's 2025 Work Trend Index, 81% of leaders expect AI agents to be moderately or extensively integrated into their company's AI strategy in the next 12 to 18 months. Source: Microsoft, 2025 Work Trend Index: The Year the Frontier Firm Is Born (2025); Survey. https://www.microsoft.com/en-us/worklab/work-trend-index/2025-the-year-the-frontier-firm-is-born
- According to Microsoft's 2025 Work Trend Index, 46% of leaders say their companies are using AI agents to fully automate workflows or processes. Source: Microsoft, 2025 Work Trend Index: The Year the Frontier Firm Is Born (2025); Survey. https://www.microsoft.com/en-us/worklab/work-trend-index/2025-the-year-the-frontier-firm-is-born
- 68% of security decision makers surveyed by CyberArk say their organizations lack identity security controls for AI. Source: CyberArk, 2025 Identity Security Landscape (2025); Survey. https://web.archive.org/web/2025/https://www.cyberark.com/press/machine-identities-outnumber-humans-by-more-than-80-to-1-new-report-exposes-the-exponential-threats-of-fragmented-identity-security/
- 72% of technology professionals say AI agents pose a greater risk than other machine identities, per SailPoint. Source: SailPoint, AI agents: The new attack surface (2025); Survey. https://www.sailpoint.com/press-releases/sailpoint-ai-agent-adoption-report
- Of more than 5,200 open-source MCP servers Astrix analyzed, 88% require credentials, 53% rely on long-lived static API keys or personal access tokens, and only 8.5% use OAuth. Source: Astrix Security, State of MCP Server Security 2025 (2025); Observed data. https://astrix.security/learn/blog/state-of-mcp-server-security-2025/
- 79% of MCP servers that use API keys take them from plain environment variables, according to Astrix Security. Source: Astrix Security, State of MCP Server Security 2025 (2025); Observed data. https://astrix.security/learn/blog/state-of-mcp-server-security-2025/
- Gartner found that 64% of technology executives plan to deploy agentic AI within the next 24 months, while AI investment is expected to grow more than 35% year over year in a constrained IT budget environment. Source: Gartner, Gartner Survey Reveals 50% of Non-U.S. CIOs and Technology Executives Anticipate Changes to Vendor Engagement Based on Regional Factors (2025); Survey. https://www.gartner.com/en/newsroom/press-releases/2025-10-21-gartner-survey-reveals-50-percent-of-non-us-cios-and-technology-executives-anticipate-changes-to-vendor-engagement-based-on-regional-factors

### Keys and tokens that never expire

- GitGuardian detected about 29 million new hardcoded secrets in public GitHub commits in 2025, a 34% increase year over year and the largest single-year jump it has recorded. Source: GitGuardian, The State of Secrets Sprawl 2026 (2026); Observed data. https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026-pr/
- GitGuardian found that 64% of valid secrets first detected in 2022 were still not revoked in 2026. Source: GitGuardian, The State of Secrets Sprawl 2026 (2026); Observed data. https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026-pr/
- 59% of AWS IAM users have an active access key older than one year, according to Datadog's 2025 State of Cloud Security. Source: Datadog, State of Cloud Security 2025 (2025); Observed data. https://www.datadoghq.com/state-of-cloud-security/
- Leaked secrets tied to AI services rose 81% year over year in 2025, to 1,275,105, according to GitGuardian. Source: GitGuardian, The State of Secrets Sprawl 2026 (2026); Observed data. https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026-pr/
- Internal repositories are about 6 times more likely than public ones to contain hardcoded secrets, per GitGuardian. Source: GitGuardian, The State of Secrets Sprawl 2026 (2026); Observed data. https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026-pr/
- About 28% of secrets-leak incidents GitGuardian found originate in collaboration and productivity tools rather than code repositories. Source: GitGuardian, The State of Secrets Sprawl 2026 (2026); Observed data. https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026-pr/
- Claude Code-assisted commits leaked secrets at about 3.2%, roughly twice the public GitHub baseline, according to GitGuardian. Source: GitGuardian, The State of Secrets Sprawl 2026 (2026); Observed data. https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026-pr/
- About 60% of secrets policy violations GitGuardian sees are long-lived credentials that persist over time. Source: GitGuardian, The State of Secrets Sprawl 2026 (2026); Observed data. https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026-pr/
- Since 2021, leaked secrets have grown about 1.6 times faster than the active developer population, per GitGuardian. Source: GitGuardian, The State of Secrets Sprawl 2026 (2026); Observed data. https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026-pr/
- Only 14% of organizations have fully automated the creation and removal of AI-related identities; 27% do it entirely by hand, per the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Oasis Security), The State of Non-Human Identity and AI Security (2026); Survey. https://cloudsecurityalliance.org/press-releases/2026/01/27/79-of-it-pros-feel-ill-equipped-to-prevent-attacks-via-nhi-csa-oasis-survey-finds
- Nearly a quarter (24%) of organizations take more than 24 hours to rotate or revoke a credential after a potential exposure, per the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Oasis Security), The State of Non-Human Identity and AI Security (2026); Survey. https://cloudsecurityalliance.org/press-releases/2026/01/27/79-of-it-pros-feel-ill-equipped-to-prevent-attacks-via-nhi-csa-oasis-survey-finds
- A third of organizations (33%) do not know how often their AI agent credentials are rotated, per the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Aembit), CSA survey report on AI agent identity and access (2026) (2026); Survey. https://cloudsecurityalliance.org/press-releases/2026/03/24/more-than-two-thirds-of-organizations-cannot-clearly-distinguish-ai-agent-from-human-actions
- 54% of organizations uncover unmanaged privileged accounts and secrets every week, according to a 2026 CyberArk study. Source: CyberArk, Privileged access study (January 2026) (2026); Survey. https://web.archive.org/web/2026/https://www.cyberark.com/press/new-study-only-1-of-organizations-have-fully-adopted-just-in-time-privileged-access-as-ai-driven-identities-rapidly-increase/
- The average organization oversees more than 114,000 internal certificates but has only four full-time staff dedicated to managing them, according to Ponemon research for CyberArk. Source: CyberArk / Ponemon Institute, Trends in PKI Security: A Global Study of Trends, Challenges & Business Impact (2026); Survey. https://web.archive.org/web/2026/https://www.cyberark.com/press/new-research-shows-that-legacy-pki-puts-digital-identities-at-risk-with-56-of-organizations-experiencing-services-disruption/
- 56% of organizations have suffered unplanned outages due to expired certificates or configuration errors, per Ponemon research for CyberArk. Source: CyberArk / Ponemon Institute, Trends in PKI Security: A Global Study of Trends, Challenges & Business Impact (2026); Survey. https://web.archive.org/web/2026/https://www.cyberark.com/press/new-research-shows-that-legacy-pki-puts-digital-identities-at-risk-with-56-of-organizations-experiencing-services-disruption/
- 7.5% of non-human identities are 5 to 10 years old, with some exceeding a decade, per Entro Labs. Source: Entro Security, NHI & Secrets Risk Report H1 2025 (2025); Observed data. https://www.globenewswire.com/news-release/2025/07/22/3119538/0/en/Entro-Reports-44-Increase-in-Machine-Identities-Nearly-Half-of-Secret-Exposures-Occur-Outside-Code.html
- 55% of Google Cloud service accounts have active keys older than a year, and 40% of Microsoft Entra ID applications have credentials older than a year, per Datadog. Source: Datadog, State of Cloud Security 2025 (2025); Observed data. https://www.datadoghq.com/state-of-cloud-security/
- The share of cloud access keys older than three years rose to 25% in both AWS and Google Cloud, according to Datadog. Source: Datadog, State of Cloud Security 2025 (2025); Observed data. https://www.datadoghq.com/state-of-cloud-security/
- 86% of companies suffered at least one outage from expired or mismanaged digital certificates in the past year, and 10% have one every week, according to Keyfactor. Source: Keyfactor, Digital Trust Digest: The Automation Edition (2025); Survey. https://www.keyfactor.com/press-releases/keyfactor-research-reveals-digital-certificate-outages-a-weekly-reality-for-1-in-10-enterprises/
- Only 17% of certificate practitioners have complete, real-time visibility across all their certificates, per Keyfactor. Source: Keyfactor, Digital Trust Digest: The Automation Edition (2025); Survey. https://www.keyfactor.com/press-releases/keyfactor-research-reveals-digital-certificate-outages-a-weekly-reality-for-1-in-10-enterprises/
- The median time to remediate leaked secrets discovered in a GitHub repository was 94 days, according to Verizon's 2025 DBIR. Source: Verizon, 2025 Data Breach Investigations Report (2025); Observed data. https://www.verizon.com/business/resources/reports/2025-dbir-data-breach-investigations-report.pdf
- GitLab tokens made up 50% of all development and CI/CD secrets found leaked in public code repositories, per Verizon's 2025 DBIR. Source: Verizon, 2025 Data Breach Investigations Report (2025); Observed data. https://www.verizon.com/business/resources/reports/2025-dbir-data-breach-investigations-report.pdf
- 72% of organizations suffered at least one certificate-related outage in the past year, and 45% have one weekly, per CyberArk, up from 12% weekly in 2022. Source: CyberArk, 2025 State of Machine Identity Security Report (2025); Survey. https://web.archive.org/web/2026/https://www.cyberark.com/press/new-cyberark-research-rapid-growth-of-machine-identities-ai-adoption-and-cloud-native-innovations-leave-organizations-more-vulnerable-to-attacks/
- Lack of credential rotation was the most common cause of NHI-related attacks (45%), ahead of inadequate monitoring (37%) and over-privileged identities (37%), per CSA and Astrix. Source: Cloud Security Alliance and Astrix Security, State of Non-Human Identity Security Survey Report (2024); Survey. https://cloudsecurityalliance.org/press-releases/2024/09/12/csa-and-astrix-security-reveal-critical-gaps-in-nhi-protection
- 71% of non-human identities are not rotated within recommended time frames, per Entro Labs. Source: Entro Security, Entro Labs NHI research security advisory (2024) (2024); Observed data. https://www.globenewswire.com/news-release/2024/09/16/2946680/0/en/Entro-Security-Labs-Releases-Non-Human-Identities-Research-Security-Advisory.html
- The average organization experienced nine certificate-related incidents in the past 12 months, taking 2.6 hours to identify and 2.7 hours to fix each outage, according to Keyfactor. Source: Keyfactor, 2024 PKI & Digital Trust Report (2024); Survey. https://www.keyfactor.com/blog/key-takeaways-from-the-2024-pki-digital-trust-report/
- 89% of organizations face challenges managing and securing secrets at scale, according to Venafi. Source: Venafi (a CyberArk company), The Impact of Machine Identities on the State of Cloud Native Security in 2024 (2024); Survey. https://web.archive.org/web/2026/https://www.cyberark.com/press/security-leaders-say-machine-identities-such-as-access-tokens-and-service-accounts-are-next-big-target-for-cyberattack/
- 40% of workload identities were inactive in 2023, according to Microsoft Entra Permissions Management data. Source: Microsoft, 2024 State of Multicloud Security Risk Report (2024); Observed data. https://www.microsoft.com/en-us/security/blog/2024/05/29/6-insights-from-microsofts-2024-state-of-multicloud-risk-report-to-evolve-your-security-strategy/

### Too much access, too little ownership

- Only 1% of organizations have fully implemented just-in-time privileged access, and 91% say at least half of their privileged access is always on, per CyberArk. Source: CyberArk, Privileged access study (January 2026) (2026); Survey. https://web.archive.org/web/2026/https://www.cyberark.com/press/new-study-only-1-of-organizations-have-fully-adopted-just-in-time-privileged-access-as-ai-driven-identities-rapidly-increase/
- In the Shai-Hulud 2 supply-chain attack, 59% of compromised machines were CI/CD runners rather than personal workstations, GitGuardian found. Source: GitGuardian, The State of Secrets Sprawl 2026 (2026); Observed data. https://www.gitguardian.com/state-of-secrets-sprawl-report-2026
- 79% of organizations rate their confidence in preventing attacks via non-human identities as low or moderate, per a 2026 Cloud Security Alliance survey commissioned by Oasis Security. Source: Cloud Security Alliance (commissioned by Oasis Security), The State of Non-Human Identity and AI Security (2026); Survey. https://cloudsecurityalliance.org/press-releases/2026/01/27/79-of-it-pros-feel-ill-equipped-to-prevent-attacks-via-nhi-csa-oasis-survey-finds
- 92% of IT and security professionals are not confident their legacy IAM tools can manage the risks of AI and non-human identities, per the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Oasis Security), The State of Non-Human Identity and AI Security (2026); Survey. https://cloudsecurityalliance.org/press-releases/2026/01/27/79-of-it-pros-feel-ill-equipped-to-prevent-attacks-via-nhi-csa-oasis-survey-finds
- Only 18% of security professionals are highly confident their IAM systems can manage AI agent identities, per the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Strata Identity), Securing Autonomous AI Agents (2026); Survey. https://cloudsecurityalliance.org/press-releases/2026/02/05/cloud-security-alliance-strata-survey-finds-that-enterprises-are-in-time-to-trust-phase-as-they-build-ai-autonomy-foundations
- 74% of organizations say AI agents often receive more access than necessary, per the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Aembit), CSA survey report on AI agent identity and access (2026) (2026); Survey. https://cloudsecurityalliance.org/press-releases/2026/03/24/more-than-two-thirds-of-organizations-cannot-clearly-distinguish-ai-agent-from-human-actions
- Only 9% of organizations say their IAM team is the primary owner of AI agent identity and access, per the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Aembit), CSA survey report on AI agent identity and access (2026) (2026); Survey. https://cloudsecurityalliance.org/press-releases/2026/03/24/more-than-two-thirds-of-organizations-cannot-clearly-distinguish-ai-agent-from-human-actions
- 65% of organizations experienced an AI agent-related incident in the past 12 months, with 61% reporting data exposure, per the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Token Security), Autonomous but Not Controlled: AI Agent Incidents Now Common in Enterprises (2026); Survey. https://cloudsecurityalliance.org/articles/new-cloud-security-alliance-survey-reveals-82-of-enterprises-have-unknown-ai-agents-in-their-environments
- 53% of organizations have had AI agents exceed their intended permissions, and only 8% say their agents never do, according to the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Zenity), Enterprise AI Security Starts with AI Agents (2026); Survey. https://cloudsecurityalliance.org/articles/more-than-half-of-organizations-experience-ai-agent-scope-violations-cloud-security-alliance-study-finds
- 54% of organizations report between 1 and 100 unsanctioned AI agents, and only 15% say most of their agents have a defined owner, per the Cloud Security Alliance. Source: Cloud Security Alliance (commissioned by Zenity), Enterprise AI Security Starts with AI Agents (2026); Survey. https://cloudsecurityalliance.org/articles/more-than-half-of-organizations-experience-ai-agent-scope-violations-cloud-security-alliance-study-finds
- Fewer than half of organizations are actively securing non-human identities, according to IBM's 2026 Cost of a Data Breach Report. Source: IBM, Cost of a Data Breach Report 2026 (2026); Survey. https://www.ibm.com/think/x-force/2026-cost-of-a-data-breach-ai-adversaries-enterprise-risk
- 78% of organizations cite controlling non-human identity access and permissions as a top concern, but only 10% have a strategy for governing them (Okta, 2026). Source: Okta, Businesses at Work 2026 (2026); Survey. https://www.okta.com/reports/businesses-at-work/
- CyberArk's 2025 Identity Security Landscape found that 42% of machine identities have privileged or sensitive access. Source: CyberArk, 2025 Identity Security Landscape (2025); Survey. https://web.archive.org/web/2025/https://www.cyberark.com/press/machine-identities-outnumber-humans-by-more-than-80-to-1-new-report-exposes-the-exponential-threats-of-fragmented-identity-security/
- 88% of security decision makers told CyberArk that their organization defines a 'privileged user' as human identities only. Source: CyberArk, 2025 Identity Security Landscape (2025); Survey. https://web.archive.org/web/2025/https://www.cyberark.com/press/machine-identities-outnumber-humans-by-more-than-80-to-1-new-report-exposes-the-exponential-threats-of-fragmented-identity-security/
- 87% of organizations surveyed by CyberArk experienced at least two successful identity-centric breaches in the past 12 months. Source: CyberArk, 2025 Identity Security Landscape (2025); Survey. https://web.archive.org/web/2025/https://www.cyberark.com/press/machine-identities-outnumber-humans-by-more-than-80-to-1-new-report-exposes-the-exponential-threats-of-fragmented-identity-security/
- 61% of organizations surveyed by CyberArk do not have identity security controls in place to secure cloud infrastructure and workloads. Source: CyberArk, 2025 Identity Security Landscape (2025); Survey. https://web.archive.org/web/2025/https://www.cyberark.com/press/machine-identities-outnumber-humans-by-more-than-80-to-1-new-report-exposes-the-exponential-threats-of-fragmented-identity-security/
- 1 in 20 AWS machine identities carries full-admin privileges, according to Entro Labs. Source: Entro Security, NHI & Secrets Risk Report H1 2025 (2025); Observed data. https://www.globenewswire.com/news-release/2025/07/22/3119538/0/en/Entro-Reports-44-Increase-in-Machine-Identities-Nearly-Half-of-Secret-Exposures-Occur-Outside-Code.html
- Entro Labs found 8.7% of non-human identities are both overprivileged and idle. Source: Entro Security, NHI & Secrets Risk Report H1 2025 (2025); Observed data. https://www.globenewswire.com/news-release/2025/07/22/3119538/0/en/Entro-Reports-44-Increase-in-Machine-Identities-Nearly-Half-of-Secret-Exposures-Occur-Outside-Code.html
- 12.2% of third-party integrations into AWS accounts are dangerously overprivileged, letting the vendor access all data or take over the account, per Datadog. Source: Datadog, State of Cloud Security 2025 (2025); Observed data. https://www.datadoghq.com/state-of-cloud-security/
- The average organization deploys 13 third-party SaaS integration roles in AWS, up from 10.2 in 2024, per Datadog. Source: Datadog, State of Cloud Security 2025 (2025); Observed data. https://www.datadoghq.com/state-of-cloud-security/
- Almost one in five AWS EC2 instances (19.4%) is overprivileged, according to Datadog. Source: Datadog, State of Cloud Security 2025 (2025); Observed data. https://www.datadoghq.com/state-of-cloud-security/
- Half (50%) of security leaders reported security incidents or breaches linked to compromised machine identities in the past year, according to CyberArk's 2025 State of Machine Identity Security Report. Source: CyberArk, 2025 State of Machine Identity Security Report (2025); Survey. https://web.archive.org/web/2026/https://www.cyberark.com/press/new-cyberark-research-rapid-growth-of-machine-identities-ai-adoption-and-cloud-native-innovations-leave-organizations-more-vulnerable-to-attacks/
- Responsibility for preventing machine identity compromises is split among security (53%), development (28%) and platform (14%) teams, per CyberArk. Source: CyberArk, 2025 State of Machine Identity Security Report (2025); Survey. https://web.archive.org/web/2026/https://www.cyberark.com/press/new-cyberark-research-rapid-growth-of-machine-identities-ai-adoption-and-cloud-native-innovations-leave-organizations-more-vulnerable-to-attacks/
- 46% of organizations struggle to monitor non-human identities created by SaaS-to-SaaS integrations and GenAI tools, and 56% worry about over-privileged API access, per the Cloud Security Alliance. Source: Cloud Security Alliance, State of SaaS Security Report: Trends and Insights for 2025-2026 (2025); Survey. https://cloudsecurityalliance.org/articles/research-from-csa-highlights-critical-need-purpose-built-approach-to-saas-security
- A Gartner survey of 335 IAM leaders found IAM teams are responsible for only 44% of their organization's machine identities. Source: Gartner, Gartner Identifies the Top Cybersecurity Trends for 2025 (press release) (2025); Survey. https://www.gartner.com/en/newsroom/press-releases/2025-03-03-gartner-identifiesthe-top-cybersecurity-trends-for-2025
- Nearly 1 in 5 organizations have experienced a security incident related to non-human identities, according to a 2024 Cloud Security Alliance and Astrix survey. Source: Cloud Security Alliance and Astrix Security, State of Non-Human Identity Security Survey Report (2024); Survey. https://cloudsecurityalliance.org/press-releases/2024/09/12/csa-and-astrix-security-reveal-critical-gaps-in-nhi-protection
- Only 15% of organizations are highly confident in their ability to secure non-human identities, versus nearly 1 in 4 for human identities, per CSA and Astrix. Source: Cloud Security Alliance and Astrix Security, State of Non-Human Identity Security Survey Report (2024); Survey. https://cloudsecurityalliance.org/press-releases/2024/09/12/csa-and-astrix-security-reveal-critical-gaps-in-nhi-protection
- 38% of organizations report no or low visibility into third-party vendors connected by OAuth apps, and another 47% have only partial visibility, according to CSA and Astrix. Source: Cloud Security Alliance and Astrix Security, State of Non-Human Identity Security Survey Report (2024); Survey. https://cloudsecurityalliance.org/press-releases/2024/09/12/csa-and-astrix-security-reveal-critical-gaps-in-nhi-protection
- Entro Labs found 97% of non-human identities have excessive privileges, and 92% of organizations expose NHIs to third parties. Source: Entro Security, Entro Labs NHI research security advisory (2024) (2024); Observed data. https://www.globenewswire.com/news-release/2024/09/16/2946680/0/en/Entro-Security-Labs-Releases-Non-Human-Identities-Research-Security-Advisory.html
- 91% of former employees' tokens remain active after they leave, according to Entro Labs. Source: Entro Security, Entro Labs NHI research security advisory (2024) (2024); Observed data. https://www.globenewswire.com/news-release/2024/09/16/2946680/0/en/Entro-Security-Labs-Releases-Non-Human-Identities-Research-Security-Advisory.html
- 56% of organizations had a security incident involving machine identities such as access tokens used with service accounts in the past year, according to Venafi. Source: Venafi (a CyberArk company), The Impact of Machine Identities on the State of Cloud Native Security in 2024 (2024); Survey. https://web.archive.org/web/2026/https://www.cyberark.com/press/security-leaders-say-machine-identities-such-as-access-tokens-and-service-accounts-are-next-big-target-for-cyberattack/
- 88% of security leaders believe machine identities, specifically access tokens and their connected service accounts, are the next big target for attackers, per Venafi. Source: Venafi (a CyberArk company), The Impact of Machine Identities on the State of Cloud Native Security in 2024 (2024); Survey. https://web.archive.org/web/2026/https://www.cyberark.com/press/security-leaders-say-machine-identities-such-as-access-tokens-and-service-accounts-are-next-big-target-for-cyberattack/

## SaaS security and breaches statistics

Most SaaS breaches start with a login, not an exploit, and often through a connected third party.

### Attackers log in, they don't break in

- Threat actors exploited identity issues to gain initial access in 83% of incidents involving major cloud and SaaS-hosted environments, according to Google Cloud's H1 2026 Threat Horizons Report. Source: Google Cloud, Cloud Threat Horizons Report H1 2026 (2026); Observed data. https://cloud.google.com/security/report/resources/cloud-threat-horizons-report-h1-2026
- 99% of SaaS compromises Obsidian Security investigated originated at the identity provider, according to its 2025 SaaS Security Threat Report. Source: Obsidian Security, 2025 SaaS Security Threat Report (2025); Observed data. https://www.obsidiansecurity.com/news/obsidian-security-launches-2025-saas-security-threat-report
- More than 97% of identity attacks are password attacks, according to Microsoft's 2025 Digital Defense Report. Source: Microsoft, Microsoft Digital Defense Report 2025 (2025); Observed data. https://blogs.microsoft.com/on-the-issues/2025/10/16/mddr-2025/
- Counting every stage of an attack, credential abuse appears in 39% of breaches, the most common action, according to Verizon's 2026 DBIR. Source: Verizon, 2026 Data Breach Investigations Report (2026); Observed data. https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf
- For the first time in the DBIR's history, vulnerability exploitation (31% of breaches) overtook credential abuse (13%) as the most common way attackers get in, per Verizon's 2026 report. Source: Verizon, 2026 Data Breach Investigations Report (2026); Observed data. https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf
- Half of ransomware victims with a prior credential or infostealer leak had that leak within 95 days of the attack, per Verizon's 2026 DBIR. Source: Verizon, 2026 Data Breach Investigations Report (2026); Observed data. https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf
- Small organizations saw a median of seven credential leak events a year and larger organizations around 20, according to Verizon's 2026 DBIR. Source: Verizon, 2026 Data Breach Investigations Report (2026); Observed data. https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf
- 82% of CrowdStrike detections in 2025 were malware-free, as adversaries used valid credentials, trusted identity flows and approved SaaS integrations. Source: CrowdStrike, 2026 Global Threat Report (2026); Observed data. https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-global-threat-report-findings/
- Valid account abuse accounted for 35% of cloud incidents in 2025, and cloud-conscious intrusions rose 37%, according to CrowdStrike's 2026 Global Threat Report. Source: CrowdStrike, 2026 Global Threat Report (2026); Observed data. https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-global-threat-report-findings/
- Voice phishing was the number one initial infection vector in cloud-related compromises in 2025, at 23%, according to Mandiant's M-Trends 2026. Source: Google Cloud (Mandiant), M-Trends 2026 (2026); Observed data. https://security.googlecloudcommunity.com/google-threat-intelligence-3/announcing-m-trends-2026-data-insights-and-strategies-from-the-frontlines-7123
- 52.2% of intrusions that used a valid account went on to steal more credentials, according to Microsoft's 2026 Digital Defense Report. Source: Microsoft, Microsoft Digital Defense Report 2026 (2026); Observed data. https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/reports/microsoft-digital-defense-report/
- 78% of observed attack techniques against critical infrastructure used cloud identity abuse, according to Microsoft's 2026 Digital Defense Report. Source: Microsoft, Microsoft Digital Defense Report 2026 (2026); Observed data. https://www.microsoft.com/en-us/corporate-responsibility/topics/cybersecurity/reports/microsoft-digital-defense-report/
- The use of stolen credentials appeared in 36% of breaches in the 2026 Verizon DBIR. Source: Verizon, 2026 Data Breach Investigations Report (2026); Observed data. https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf
- In the 2024 Snowflake customer breaches, about 80% of the accounts the attacker used had prior credential exposure, and around 165 organizations were affected, per Verizon's 2025 DBIR. Source: Verizon, 2025 Data Breach Investigations Report (2025); Observed data. https://www.verizon.com/business/resources/reports/2025-dbir-data-breach-investigations-report.pdf
- Credential abuse (22%) was the leading initial attack vector in Verizon's 2025 DBIR, just ahead of vulnerability exploitation (20%). Source: Verizon, 2025 Data Breach Investigations Report (2025); Observed data. https://www.verizon.com/about/news/2025-data-breach-investigations-report
- 54% of 2024 ransomware victims had their domains appear in infostealer credential dumps, per Verizon's 2025 DBIR. Source: Verizon, 2025 Data Breach Investigations Report (2025); Observed data. https://www.verizon.com/business/resources/reports/2025-dbir-data-breach-investigations-report.pdf
- Compromised credentials were the root cause of 53% of material breaches over the past three years, according to 1Password's 2025 Access-Trust Gap report. Source: 1Password, 2025 Annual Report: The Access-Trust Gap (2025); Survey. https://1password.com/press/2025/oct/annual-report-2025-the-access-trust-gap
- Identity-based attacks rose 32% in the first half of 2025, according to Microsoft. Source: Microsoft, Microsoft Digital Defense Report 2025 (2025); Observed data. https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf
- At least 79.7% of the Snowflake customer accounts used in the 2024 UNC5537 campaign had prior credential exposure, much of it from infostealer infections dating back to 2020, Mandiant found. Source: Google Cloud (Mandiant), UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion (2024); Observed data. https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion

### Every connected app is a door

- Breaches with third-party involvement rose 60% year over year to 48% of all breaches, according to Verizon's 2026 DBIR. Source: Verizon, 2026 Data Breach Investigations Report (2026); Observed data. https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf
- The 2025 Salesloft Drift OAuth token compromise extended into Salesforce and other tools at more than 700 companies, according to Obsidian Security. Source: Obsidian Security, The rise of SaaS supply chain attacks (blog) (2025); Observed data. https://www.obsidiansecurity.com/blog/the-rise-of-saas-supply-chain-attacks-why-you-arent-safe-from-the-next-salesloft-drift-attack
- For weak passwords and permission misconfigurations in third parties' cloud accounts, it took almost eight months to resolve half of all findings, per Verizon's 2026 DBIR. Source: Verizon, 2026 Data Breach Investigations Report (2026); Observed data. https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf
- 21% of cloud and SaaS intrusions in the second half of 2025 involved compromised trusted relationships with third parties, such as stolen Salesloft Drift and Gainsight OAuth tokens, per Google Cloud's H1 2026 Threat Horizons Report. Source: Google Cloud, Cloud Threat Horizons Report H1 2026 (2026); Observed data. https://cloud.google.com/security/report/resources/cloud-threat-horizons-report-h1-2026
- 78% of organizations say their cybersecurity programs cover less than half of their vendor ecosystem, according to SecurityScorecard's 2026 Supply Chain Cybersecurity Trends Report. Source: SecurityScorecard, 2026 Supply Chain Cybersecurity Trends Report (2026); Survey. https://securityscorecard.com/resources/research/2026-supply-chain-cybersecurity-trends-report/
- Third-party involvement in breaches doubled in a year, from 15% to 30%, according to Verizon's 2025 Data Breach Investigations Report. Source: Verizon, 2025 Data Breach Investigations Report (2025); Observed data. https://www.verizon.com/business/resources/reports/2025-dbir-data-breach-investigations-report.pdf
- SaaS integrations created in Obsidian Security's network grew 123% and AI agents created grew 223%, widening the SaaS supply chain attack surface. Source: Obsidian Security, The rise of SaaS supply chain attacks (blog) (2025); Observed data. https://www.obsidiansecurity.com/blog/the-rise-of-saas-supply-chain-attacks-why-you-arent-safe-from-the-next-salesloft-drift-attack
- Obsidian Security found the blast radius of the Salesloft Drift supply chain attack was 10 times greater than previous incidents in which attackers went after Salesforce directly. Source: Obsidian Security, The rise of SaaS supply chain attacks (blog) (2025); Observed data. https://www.obsidiansecurity.com/blog/the-rise-of-saas-supply-chain-attacks-why-you-arent-safe-from-the-next-salesloft-drift-attack
- 35.5% of all breaches in 2024 were third-party related, according to SecurityScorecard's 2025 Global Third-Party Breach Report. Source: SecurityScorecard, 2025 Global Third-Party Breach Report (2025); Observed data. https://securityscorecard.com/company/press/securityscorecard-2025-global-third-party-breach-report-reveals-surge-in-vendor-driven-attacks/
- 41.4% of ransomware attacks now start through third parties, according to SecurityScorecard's 2025 Global Third-Party Breach Report. Source: SecurityScorecard, 2025 Global Third-Party Breach Report (2025); Observed data. https://securityscorecard.com/company/press/securityscorecard-2025-global-third-party-breach-report-reveals-surge-in-vendor-driven-attacks/
- More than 70% of organizations had at least one material third-party cybersecurity incident in the past year, according to SecurityScorecard's 2025 Supply Chain Cybersecurity Trends survey. Source: SecurityScorecard, 2025 Supply Chain Cybersecurity Trends Survey (2025); Survey. https://securityscorecard.com/company/press/securityscorecard-report-reveals-5-in-6-organizations-at-risk-due-to-immature-supply-chain-security/
- 49% of frequent Microsoft 365 users thought fewer than 10 apps were connected to their tenant; AppOmni's platform data shows more than 1,000 connections on average. Source: AppOmni, The State of SaaS Security 2024 (2024); Survey. https://appomni.com/press-releases/new-state-of-saas-security-report-2024/
- Every organization in Valence Security's 2024 data granted API access to at least one third-party vendor, and 33% of those integrations had access to sensitive permissions and data. Source: Valence Security, 2024 State of SaaS Security Report (2024); Observed data. https://www.valencesecurity.com/lp/2024-state-of-saas-security-report
- 99% of Global 2000 companies are directly connected to vendors that have had a recent breach, and supply chain incidents cost 17 times more to remediate than first-party breaches, according to SecurityScorecard and the Cyentia Institute. Source: SecurityScorecard and Cyentia Institute, Global 2000 supply chain research (2024); Observed data. https://securityscorecard.com/company/press/global-2000-companies-directly-connected-to-a-supply-chain-breach/

### The MFA and SSO gaps

- 1Password's 2025 report found at least one-third (34%) of SaaS apps are not protected by single sign-on. Source: 1Password, Annual Report 2025: The Access-Trust Gap (2025); Survey. https://1password.com/reports/annual-report-2025
- Only 23% of third-party organizations fully remediated missing or weak MFA on their cloud accounts, according to Verizon's 2026 DBIR. Source: Verizon, 2026 Data Breach Investigations Report (2026); Observed data. https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf
- In a cloud exposure snapshot in Verizon's 2026 DBIR, 37% of organizations had an admin account with MFA disabled on an IaaS platform, versus 14% on Snowflake after its 2024 breach campaign. Source: Verizon, 2026 Data Breach Investigations Report (2026); Observed data. https://www.verizon.com/business/resources/Td15/reports/2026-dbir-data-breach-investigations-report.pdf
- 46% of SaaS breaches were linked to weak or exploited MFA protections, according to Valence Security's State of SaaS Security: Trends and Insights for 2026. Source: Valence Security, The State of SaaS Security: Trends and Insights for 2026 (2026); Survey. https://www.valencesecurity.com/lp/2025-state-of-saas-security-report
- Token theft was the most common technique in attacks that bypassed MFA on Microsoft 365 accounts, at 31%, according to Verizon's 2025 DBIR. Source: Verizon, 2025 Data Breach Investigations Report (2025); Observed data. https://www.verizon.com/business/resources/reports/2025-dbir-data-breach-investigations-report.pdf
- MFA failed to prevent the attack in 84% of the SaaS incident responses Obsidian Security took part in, per its 2025 SaaS Security Threat Report. Source: Obsidian Security, 2025 SaaS Security Threat Report (2025); Observed data. https://www.obsidiansecurity.com/news/obsidian-security-launches-2025-saas-security-threat-report
- Nearly half of organizations cannot enforce consistent MFA and single sign-on across all users and SaaS applications, according to Valence Security's 2025-26 research with the Cloud Security Alliance. Source: Valence Security (with Cloud Security Alliance), The State of SaaS Security: Trends and Insights for 2025-2026 (2025); Survey. https://www.valencesecurity.com/resources/blogs/valences-latest-research-on-the-2025-2026-state-of-saas-security-overconfidence-despite-critical-gaps
- Phishing-resistant MFA can block more than 99% of identity-based attacks, according to Microsoft's 2025 Digital Defense Report. Source: Microsoft, Microsoft Digital Defense Report 2025 (2025); Observed data. https://blogs.microsoft.com/on-the-issues/2025/10/16/mddr-2025/
- 1 in 7 organizations do not use or enforce MFA across their SaaS and multi-cloud environments, according to Varonis's 2025 State of Data Security Report. Source: Varonis, 2025 State of Data Security Report (2025); Observed data. https://www.varonis.com/blog/state-of-data-security-report
- Veza found 13% of enterprise users still lack MFA, a figure that did not change year over year. Source: Veza, 2026 State of Identity & Access Report (2025); Observed data. https://veza.com/wp-content/uploads/2025/12/SOIA-2026-Veza.pdf
- 39% of employees use apps not managed by their company on work devices, and IT leaders estimate 37% of corporate apps are not behind single sign-on, according to Dashlane. Source: Dashlane, Shadow IT and IT burnout survey (2025); Survey. https://www.dashlane.com/blog/new-data-shadow-it-burnout-it-teams
- 80% of popular AI apps that support SAML single sign-on are not federated through it, according to Grip Security's 2025 SaaS Security Risks Report. Source: Grip Security, 2025 SaaS Security Risks Report (2024); Observed data. https://www.grip.security/press-release/grip-publishes-2025-saas-security-risks-report

### Data exposed by default

- Attackers targeted data in 73% of cloud-related incidents in the second half of 2025, according to Google Cloud's H1 2026 Threat Horizons Report. Source: Google Cloud, Cloud Threat Horizons Report H1 2026 (2026); Observed data. https://cloud.google.com/security/report/resources/cloud-threat-horizons-report-h1-2026
- 41% of SaaS security incidents stemmed from permission issues and 29% from misconfigurations, according to AppOmni's 2025 report. Source: AppOmni, The State of SaaS Security 2025 (2025); Survey. https://appomni.com/press-releases/2025-saas-security-report-ai-threats-sspm/
- 63% of organizations report external data oversharing in their SaaS apps, according to the Cloud Security Alliance's State of SaaS Security 2025 survey. Source: Cloud Security Alliance (commissioned by Valence Security), State of SaaS Security Report 2025 (2025); Survey. https://cloudsecurityalliance.org/artifacts/state-of-saas-security-report-2025
- 66% of companies have cloud data exposed to anonymous users, according to Varonis's 2025 State of Data Security Report. Source: Varonis, 2025 State of Data Security Report (2025); Observed data. https://www.varonis.com/blog/state-of-data-security-report
- 94% of external data shares in enterprise SaaS apps are inactive, meaning outsiders keep access they no longer need, according to Valence Security's 2024 State of SaaS Security report. Source: Valence Security, 2024 State of SaaS Security Report (2024); Observed data. https://www.valencesecurity.com/lp/2024-state-of-saas-security-report

### Confident, and still breached

- 75% of organizations had a SaaS security incident in the past year, up 33% from 2024, according to AppOmni's State of SaaS Security 2025 report. Source: AppOmni, The State of SaaS Security 2025 (2025); Survey. https://appomni.com/press-releases/2025-saas-security-report-ai-threats-sspm/
- 91% of organizations say they are confident in their SaaS security posture, even though three-quarters had a SaaS incident in the past year, per AppOmni's 2025 report. Source: AppOmni, The State of SaaS Security 2025 (2025); Survey. https://appomni.com/press-releases/2025-saas-security-report-ai-threats-sspm/
- 94% of organizations report cloud intrusions that resulted in data exposure or exfiltration, according to CrowdStrike's 2026 State of Cloud Detection and Response survey. Source: CrowdStrike, State of Cloud Detection and Response (CDR) Survey (2026); Survey. https://www.crowdstrike.com/en-us/blog/crowdstrike-state-of-cdr-survey-key-takeaways/
- Cloud applications are among the top three attack targets for 34% of organizations, and only about half of sensitive data in the cloud is encrypted, according to Thales's 2026 Data Threat Report. Source: Thales (research by S&P Global 451 Research), 2026 Data Threat Report (2026); Survey. https://cpl.thalesgroup.com/data-threat-report
- 89% of organizations that suffered a SaaS incident believed they had 'appropriate visibility' into their SaaS environment, according to AppOmni's 2025 report. Source: AppOmni, The State of SaaS Security 2025 (2025); Survey. https://appomni.com/press-releases/2025-saas-security-report-ai-threats-sspm/
- Just 13% of organizations use a dedicated SaaS Security Posture Management (SSPM) tool, though nearly a third say they need one, per AppOmni's 2025 report. Source: AppOmni, The State of SaaS Security 2025 (2025); Survey. https://appomni.com/press-releases/2025-saas-security-report-ai-threats-sspm/
- SaaS breaches rose 300% year over year between September 2023 and September 2024, according to Obsidian Security's 2025 SaaS Security Threat Report. Source: Obsidian Security, 2025 SaaS Security Threat Report (2025); Observed data. https://www.obsidiansecurity.com/news/obsidian-security-launches-2025-saas-security-threat-report
- SaaS security is a high priority for 86% of organizations and 76% are increasing their SaaS security budgets, per the Cloud Security Alliance's 2025 survey. Source: Cloud Security Alliance (commissioned by Valence Security), State of SaaS Security Report 2025 (2025); Survey. https://cloudsecurityalliance.org/artifacts/state-of-saas-security-report-2025
- 42% of organizations lack comprehensive SaaS discovery and cannot tell whether employees are using risky GenAI apps, according to Valence Security's 2025-26 research with the Cloud Security Alliance. Source: Valence Security (with Cloud Security Alliance), The State of SaaS Security: Trends and Insights for 2025-2026 (2025); Survey. https://www.valencesecurity.com/resources/blogs/valences-latest-research-on-the-2025-2026-state-of-saas-security-overconfidence-despite-critical-gaps
- 34% of organizations with policies requiring only sanctioned SaaS apps admit those rules are not strictly enforced, up 12 points from 2023, per AppOmni's 2024 report. Source: AppOmni, The State of SaaS Security 2024 (2024); Survey. https://appomni.com/press-releases/new-state-of-saas-security-report-2024/

### What a breach costs, and how fast it moves

- The global average cost of a data breach rose 12% to a record $4.99 million in IBM's 2026 Cost of a Data Breach Report. Source: IBM, Cost of a Data Breach Report 2026 (2026); Survey. https://www.ibm.com/reports/data-breach
- The average time to identify and contain a breach rose to 247 days in IBM's 2026 Cost of a Data Breach Report, reversing five straight years of decline. Source: IBM (reported by Help Net Security), Cost of a Data Breach Report 2026 (2026); Survey. https://www.helpnetsecurity.com/2026/07/30/ibm-cost-of-a-data-breach-2026/
- The average eCrime breakout time fell to 29 minutes in 2025, with the fastest observed at 27 seconds, according to CrowdStrike's 2026 Global Threat Report. Source: CrowdStrike, 2026 Global Threat Report (2026); Observed data. https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-global-threat-report-findings/
- 68% of organizations take 15 minutes or more to detect a cloud intrusion and over half need at least an hour, according to CrowdStrike's 2026 State of CDR survey. Source: CrowdStrike, State of Cloud Detection and Response (CDR) Survey (2026); Survey. https://www.crowdstrike.com/en-us/blog/crowdstrike-state-of-cdr-survey-key-takeaways/
- The global median dwell time rose to 14 days in 2025 from 11 days in 2024, according to Mandiant's M-Trends 2026. Source: Google Cloud (Mandiant), M-Trends 2026 (2026); Observed data. https://cloud.google.com/security/resources/m-trends-executive-edition
- The median time between initial access and hand-off to a second threat group collapsed from more than 8 hours in 2022 to 22 seconds in 2025, according to Mandiant's M-Trends 2026. Source: Google Cloud (Mandiant), M-Trends 2026 (2026); Observed data. https://security.googlecloudcommunity.com/google-threat-intelligence-3/announcing-m-trends-2026-data-insights-and-strategies-from-the-frontlines-7123
- Organizations detected 52% of intrusions themselves in 2025, up from 43% in 2024, while 14% were disclosed by the attackers, according to Mandiant's M-Trends 2026. Source: Google Cloud (Mandiant), M-Trends 2026 (2026); Observed data. https://cloud.google.com/security/resources/m-trends-executive-edition
- The global average cost of a data breach was $4.44 million in IBM's 2025 Cost of a Data Breach Report, the first decline in five years. Source: IBM, Cost of a Data Breach Report 2025 (2025); Survey. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
- The average cost of a data breach in the U.S. hit a record $10.22 million in IBM's 2025 Cost of a Data Breach Report. Source: IBM, Cost of a Data Breach Report 2025 (2025); Survey. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
- It took organizations an average of 241 days to identify and contain a breach, according to IBM's 2025 Cost of a Data Breach Report. Source: IBM, Cost of a Data Breach Report 2025 (2025); Survey. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls
- In the fastest SaaS breach Obsidian Security observed, attackers went from initial access to data exfiltration in 9 minutes. Source: Obsidian Security, 2025 SaaS Security Threat Report (2025); Observed data. https://www.obsidiansecurity.com/news/obsidian-security-launches-2025-saas-security-threat-report
- Mandiant and Snowflake notified about 165 organizations potentially exposed in the 2024 UNC5537 campaign that used stolen credentials against Snowflake customer accounts without MFA. Source: Google Cloud (Mandiant), UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion (2024); Observed data. https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion

## IT teams and SaaS management statistics

IT teams run bigger, faster-moving stacks with fewer people per employee.

### IT is stretched thin

- There is now one IT person for every 108 employees, according to BetterCloud's 2025 State of SaaS report. Source: BetterCloud, 2025 State of SaaS (2025); Survey. https://www.bettercloud.com/monitor/2025-state-of-saas-trends/
- 62% of IT leaders say manual work is actively preventing them from doing strategic projects, according to BetterCloud's 2026 State of SaaS report. Source: BetterCloud, 2026 State of SaaS Report (2026); Survey. https://www.bettercloud.com/monitor/the-2026-state-of-saas-report/
- 34% of organizations still rely on spreadsheets to track IT assets, according to Ivanti's 2025 Digital Employee Experience report. Source: Ivanti, 2025 Digital Employee Experience Report (2025); Survey. https://www.ivanti.com/resources/research-reports/2025-digital-employee-experience-report
- 60% of IT professionals say they feel burnt out by their work, according to Auvik's 2025 IT Trends Report. Source: Auvik, 2025 IT Trends Report (2025); Survey. https://www.auvik.com/media-room/media-releases/auviks-2025-it-trends-report-highlights-rise-of-it-generalist/
- 58% of IT professionals spend half or more of their work week on tickets resolving end-user requests, according to Auvik's 2025 IT Trends Report. Source: Auvik, 2025 IT Trends Report (2025); Survey. https://www.auvik.com/media-room/media-releases/auviks-2025-it-trends-report-highlights-rise-of-it-generalist/
- IT teams spend an average of 36% of their time designing, building and testing custom integrations between systems, according to MuleSoft. Source: MuleSoft (Salesforce), 2026 Connectivity Benchmark Report (2026); Survey. https://blogs.mulesoft.com/agentic-perspectives/connectivity-benchmark-report/
- 90% of organizations still lack true cross-app orchestration, according to BetterCloud's 2026 State of SaaS report. Source: BetterCloud, 2026 State of SaaS Report (2026); Survey. https://www.bettercloud.com/monitor/the-2026-state-of-saas-report/
- 29% of IT leaders name automating more IT and SaaS operations as their top priority for the next 12 to 18 months, ahead of SaaS security (19%), according to BetterCloud. Source: BetterCloud, 2026 State of SaaS Report (2026); Survey. https://www.bettercloud.com/monitor/the-2026-state-of-saas-report/
- The median company has 1.6 IT and security staff per 100 employees, with a practical range of 0.7 to 4.3, according to Fixify's 2026 IT Help Desk Benchmark Report. Source: Fixify, 2026 IT Help Desk Benchmark Report (2026); Observed data. https://www.fixify.com/it-help-desk-benchmark-report-2026
- More than 1 in 5 IT help desk tickets is a work stoppage where the employee cannot work, according to Fixify's 2026 benchmark. Source: Fixify, 2026 IT Help Desk Benchmark Report (2026); Observed data. https://www.fixify.com/it-help-desk-benchmark-report-2026
- 61% of IT organizations now use AI in service management, but only 3.3% have reached fully autonomous execution, according to SysAid's 2026 research. Source: SysAid, State of Service Management 2026 (2026); Survey. https://www.sysaid.com/blog/generative-ai/ai-adoption-itsm-statistics
- 33% of organizations using AI-powered self-service in IT are not measuring ticket reduction, according to SysAid's 2026 research. Source: SysAid, State of Service Management 2026 (2026); Survey. https://www.sysaid.com/blog/generative-ai/ai-adoption-itsm-statistics
- 69% of IT leaders expect their IT budgets to increase in 2026, with an average expected rise of 6.93%, according to Foundry's 2026 State of the CIO study. Source: Foundry (CIO.com), 2026 State of the CIO Study (2026); Survey. https://resources.foundryco.com/hubfs/CIO_Foundry_%20State%20of%20CIO_%20Study%202026.pdf
- Staffing and skills shortages are a distraction for 34% of IT leaders, according to Foundry's 2026 State of the CIO study. Source: Foundry (CIO.com), 2026 State of the CIO Study (2026); Survey. https://resources.foundryco.com/hubfs/CIO_Foundry_%20State%20of%20CIO_%20Study%202026.pdf
- 56% of organizations are expanding business process and IT automation initiatives in 2026, according to Foundry's State of the CIO study. Source: Foundry (CIO.com), 2026 State of the CIO Study (2026); Survey. https://resources.foundryco.com/hubfs/CIO_Foundry_%20State%20of%20CIO_%20Study%202026.pdf
- Three quarters of CIOs say it is difficult to balance business innovation with operational excellence, and the average CIO juggles 1.6 roles, according to Foundry. Source: Foundry (CIO.com), 2026 State of the CIO Study (2026); Survey. https://resources.foundryco.com/hubfs/CIO_Foundry_%20State%20of%20CIO_%20Study%202026.pdf
- 78% of organizations plan to add (56%) or replace (22%) an IT automation platform in the near term, according to Stonebranch's 2026 Global State of IT Automation report. Source: Stonebranch, 2026 Global State of IT Automation Report (2026); Survey. https://www.stonebranch.com/resources/analyst-reports/global-state-of-it-automation
- 46% of IT professionals say new software deployments drive up help desk ticket volume, according to Ivanti's 2025 Technology at Work report. Source: Ivanti, 2025 Technology at Work Report (2025); Survey. https://www.ivanti.com/resources/research-reports/tech-at-work
- 38% of IT professionals say tech complexity has become a significant barrier to effective IT operations, up four points in a year, according to Ivanti. Source: Ivanti, 2025 Technology at Work Report (2025); Survey. https://www.ivanti.com/resources/research-reports/tech-at-work
- 37% of IT professionals say their tech infrastructure is so complex they cannot uphold basic security practices, according to Ivanti. Source: Ivanti, 2025 Technology at Work Report (2025); Survey. https://www.ivanti.com/resources/research-reports/tech-at-work
- Nearly 2 in 3 IT professionals say day-to-day IT operations are so overwhelming that employee experience takes a back seat, according to Ivanti. Source: Ivanti, 2025 Digital Employee Experience Report (2025); Survey. https://www.ivanti.com/resources/research-reports/2025-digital-employee-experience-report
- 44% of IT professionals say the burden of work is outweighing their ability to be productive, according to Auvik's 2025 IT Trends Report. Source: Auvik, 2025 IT Trends Report (2025); Survey. https://www.auvik.com/media-room/media-releases/auviks-2025-it-trends-report-highlights-rise-of-it-generalist/
- 26% of SME IT admins juggle 11 or more IT tools, and 47% rank managing too many point solutions as their top challenge, according to JumpCloud. Source: JumpCloud, Q1 2025 SME IT Trends Report (2025); Survey. https://jumpcloud.com/blog/sme-it-report-q1-2025
- 74% of IT leaders say their IT environment is too complex, and organizations rely on more than nine platforms to run IT, according to JumpCloud's Q3 2025 IT Trends Report. Source: JumpCloud, Q3 2025 IT Trends Report (2025); Survey. https://jumpcloud.com/blog/q3-2025-it-trends-report
- Only 19% of organizations have fully unified their IT stack, according to JumpCloud's Q3 2025 IT Trends Report. Source: JumpCloud, Q3 2025 IT Trends Report (2025); Survey. https://jumpcloud.com/blog/q3-2025-it-trends-report
- 55% of companies plan to increase IT budgets in 2026, down from 62% in 2025, according to Spiceworks' 2026 State of IT report. Source: Spiceworks (Ziff Davis / Aberdeen), 2026 State of IT (2025); Survey. https://www.spiceworks.com/research/state-of-it/
- 33% of IT budgets are still devoted to maintaining existing systems, according to IBM Institute for Business Value research. Source: IBM Institute for Business Value, Intelligent IT automation (2025); Survey. https://www.ibm.com/thought-leadership/institute-business-value/report/intelligent-it-automation
- Highly automated organizations employ only 90 IT staff per $1 billion in revenue, versus 140 for less automated peers, according to IBM Institute for Business Value. Source: IBM Institute for Business Value, Intelligent IT automation (2025); Survey. https://www.ibm.com/thought-leadership/institute-business-value/report/intelligent-it-automation
- 78% of IT leaders say their teams deal with employee password issues at least weekly, and 28% daily or more, according to Dashlane research. Source: Dashlane, Shadow IT and IT burnout survey (2025); Survey. https://www.dashlane.com/blog/new-data-shadow-it-burnout-it-teams
- 73% of European IT professionals have experienced work-related stress or burnout, and 61% blame heavy workloads, according to ISACA. Source: ISACA, Tech Workplace and Culture survey (Europe findings) (2025); Survey. https://www.isaca.org/about-us/newsroom/press-releases/2025/73-percent-of-european-it-professionals-suffer-burnout-amid-rising-workloads-and-skills-shortages
- Organizations attribute a 31% reduction in IT costs to intelligent automation, according to IBM Institute for Business Value benchmarking. Source: IBM Institute for Business Value, Intelligent IT automation (2025); Survey. https://www.ibm.com/thought-leadership/institute-business-value/report/intelligent-it-automation
- Nearly one in four IT professionals (23%) say a colleague has resigned due to burnout, according to Ivanti's 2024 Everywhere Work report. Source: Ivanti, 2024 Everywhere Work Report (2024); Survey. https://www.ivanti.com/company/press-releases/2024/ivant-unveiled-findings-from-its-2024-everywhere-work-report
- 76% of IT professionals say AI and automation can help decrease ticket volume and provide better service, according to Ivanti's 2024 Everywhere Work report. Source: Ivanti, 2024 Everywhere Work Report (2024); Survey. https://www.ivanti.com/company/press-releases/2024/ivant-unveiled-findings-from-its-2024-everywhere-work-report
- On average, 29% of network and SaaS-related tasks are still done mostly or completely manually, according to Auvik's 2024 IT Trends Report. Source: Auvik, IT Trends 2024: Industry Report (2024); Survey. https://www.auvik.com/media-room/media-releases/it-trends-report-2024/
- In a Gartner Peer Community poll, 84% of IT leaders said at least one of their direct reports showed signs of burnout in the past year, and 68% blamed work overload. Source: Gartner Peer Community, One-Minute Insights: Managing Burnout in IT (2023); Survey. https://www.gartner.com/peer-community/oneminuteinsights/omi-managing-burnout-it-insights-it-leaders-t4e
- In a Gartner Peer Community poll, 60% of IT leaders said they had personally felt burnout in their role in the past 12 months, with 67% citing an unmanageable workload. Source: Gartner Peer Community, One-Minute Insights: Managing Burnout in IT (2023); Survey. https://www.gartner.com/peer-community/oneminuteinsights/omi-managing-burnout-it-insights-it-leaders-t4e
- A quarter of IT professionals were seriously considering leaving their jobs within six months, and only 8% of organizations prioritized automation for repetitive tasks, according to Ivanti's 2023 Defending IT Talent report. Source: Ivanti, Defending IT Talent Report (Everywhere Work series) (2023); Survey. https://www.ivanti.com/company/press-releases/2023/new-research-by-ivanti-reveals-a-quarter-of-it-professionals-are-considering-quitting-their-job-in-the-next-six-months
- Gartner found only 29.1% of IT workers globally have high intent to stay with their current employer, the lowest of any corporate function. Source: Gartner, Gartner Survey Finds Only 29% of IT Workers Have High Intent to Stay With Current Employer (2022); Survey. https://www.gartner.com/en/newsroom/press-releases/2022-03-09-gartner-survey-finds-only-29-percent-of-tech-workers-have-high-intent-to-stay-with-current-employer

### Visibility is the first gap

- Only 36% of organizations have complete visibility into their IT estate, down from 43% in 2025, according to Flexera's 2026 State of ITAM report. Source: Flexera, 2026 State of ITAM Report (2026); Survey. https://www.flexera.com/blog/it-asset-management/state-of-itam-2026/
- 70% of CIOs and CTOs say teams across the business are deploying technology faster than IT can track, according to a 2026 IBM Institute for Business Value study. Source: IBM Institute for Business Value, CIO/CTO AI control gap study (with Oxford Economics) (2026); Survey. https://newsroom.ibm.com/2026-06-08-new-ibm-study-finds-cios-and-ctos-face-growing-ai-control-gap-as-enterprise-deployment-scales
- Tropic has found more than $3 billion in 'shadow spend' across customer software portfolios, spending that existed before organizations had the visibility to see it. Source: Tropic, The State of Software Procurement in 2026 (2026); Observed data. https://www.tropicapp.io/blog/state-of-software-procurement-2026
- 66% of organizations have visibility into their SaaS environment, but only 31% have visibility into AI software, according to Flexera. Source: Flexera, 2026 State of ITAM Report (2026); Survey. https://www.flexera.com/blog/it-asset-management/state-of-itam-2026-saas-sprawl/
- 12% of all SaaS spending at large organizations is unmanaged, according to Capgemini Research Institute. Source: Capgemini Research Institute, On-Demand Tech (FinOps) report (2025); Survey. https://www.capgemini.com/us-en/news/press-releases/on-demand-tech-is-on-the-rise-but-spiraling-costs-complexity-and-governance-gaps-are-putting-returns-at-risk/
- Flexera's 2025 State of ITAM Report found complete visibility across the technology stack fell to 43% from 47% a year earlier. Source: Flexera, 2025 State of ITAM Report (2025); Survey. https://www.flexera.com/about-us/press-center/it-teams-losing-visibility-according-to-flexera-2025-state-of-itam-report
- 85% of IT leaders say gaps in IT visibility pose a risk to their organization, according to Flexera's 2026 IT Priorities Report. Source: Flexera, 2026 IT Priorities Report (2025); Survey. https://www.flexera.com/about-us/press-center/flexera-report-reveals-priorities-driving-it-strategy-for-2026-ai-takes-the-lead
- 29% of companies say they lack sufficient visibility into their SaaS spend, according to BetterCloud's State of SaaSOps 2024. Source: BetterCloud, State of SaaSOps 2024 (2024); Survey. https://www.prnewswire.com/news-releases/the-number-of-saas-applications-at-companies-declined-for-the-first-time-in-over-a-decade-302199899.html
- Only 47% of software producers can see whether a customer is using their software at all, according to Revenera's Monetization Monitor 2025 Outlook. Source: Revenera, Monetization Monitor 2025 Outlook (2024); Survey. https://www.revenera.com/about-us/press-center/software-piracy-overuse-and-misuse-are-equally-undermining-revenue-goals

### SaaS management grows up

- Gartner predicts that by 2028 over 70% of organizations will centralize SaaS management using SaaS management platforms, up from less than 30% in 2025. Source: Gartner (via USU), 2025 Gartner Magic Quadrant for SaaS Management Platforms (2025); Forecast. https://www.usu.com/en/blog/gartner-magic-quadrant-saas-management-platforms
- Gartner's 2024 (inaugural) Magic Quadrant for SaaS Management Platforms predicted that through 2027, over 50% of organizations will centralize SaaS management using an SMP, up from less than 10% in 2024. Source: Gartner (quoted by Josys), Magic Quadrant for SaaS Management Platforms 2024 (2024); Forecast. https://josys.com/news/josys-recognized-in-first-gartner-magic-quadrant-for-saas-management-platforms
- Only 64% of IT asset management teams manage SaaS licenses, compared with 75% that manage cloud software licenses, according to Flexera. Source: Flexera, 2026 State of ITAM Report (2026); Survey. https://www.flexera.com/blog/it-asset-management/state-of-itam-2026/
- IT asset management teams spend the largest share of their time (32%) on software optimization, followed by audit response (22%), according to Flexera's 2026 State of ITAM Report. Source: Flexera, 2026 State of ITAM Report (2026); Survey. https://www.flexera.com/about-us/press-center/flexera-2026-state-of-itam-report-reveals-only-31-percent-organizations-have-visibility-into-ai-as-spend-surges
- Security and governance became IT's biggest SaaS management challenge for 47% of IT leaders in 2026, up from 28% a year earlier, according to BetterCloud. Source: BetterCloud, 2026 State of SaaS Report (2026); Survey. https://www.bettercloud.com/monitor/the-2026-state-of-saas-report/
- 86% of IT leaders say SaaS management platforms are crucial to good AI governance, according to BetterCloud's 2026 State of SaaS report. Source: BetterCloud, 2026 State of SaaS Report (2026); Survey. https://www.bettercloud.com/monitor/the-2026-state-of-saas-report/
- 90% of FinOps practitioners now manage SaaS spend or plan to within a year, up from 65% in 2025, according to the FinOps Foundation's State of FinOps 2026. Source: FinOps Foundation, State of FinOps 2026 (6th annual) (2026); Survey. https://data.finops.org/
- Gartner warns that through 2027, organizations that fail to centrally manage SaaS life cycles will remain five times more susceptible to a cyber incident or data loss. Source: Gartner (quoted by BetterCloud), Magic Quadrant for SaaS Management Platforms 2025 (2025); Forecast. https://www.bettercloud.com/monitor/gartner-magic-quadrant-leader-for-saas-management-platforms/
- According to Gartner's 2026 CIO and Technology Executive Survey, 57% of CIOs face pressure to improve productivity and 52% face pressure to reduce costs. Source: Gartner, The CIO Agenda 2026 / 2026 CIO and Technology Executive Survey (2025); Survey. https://www.gartner.com/en/articles/cio-agenda
- ITAM teams increasingly work with FinOps: 38% collaborate with FinOps teams and 44% with cloud teams, according to Flexera's 2025 State of ITAM Report. Source: Flexera, 2025 State of ITAM Report (2025); Survey. https://www.flexera.com/about-us/press-center/it-teams-losing-visibility-according-to-flexera-2025-state-of-itam-report
- 70% of IT teams prefer a unified SaaS management platform, and 51% find point solutions harder to manage SaaS with, according to BetterCloud's 2025 State of SaaS report. Source: BetterCloud, State of SaaS 2025 (2025); Survey. https://www.prnewswire.com/news-releases/state-of-saas-2025-report-reveals-operational-complexity-and-risk-concerns-as-economic-uncertainty-and-ai-apply-spending-pressure-on-technology-investments-302441868.html
- 88% of IT decision-makers are open to switching at least some tech vendors, and re-evaluating vendors or contracts (39%) is their top cost-saving measure, according to Spiceworks' 2026 State of IT. Source: Spiceworks (Ziff Davis / Aberdeen), 2026 State of IT (2025); Survey. https://www.spiceworks.com/research/state-of-it/
- 52% of IT professionals say SaaS purchases now face more scrutiny than before, according to BetterCloud. Source: BetterCloud, State of SaaSOps 2024 (2024); Survey. https://www.prnewswire.com/news-releases/the-number-of-saas-applications-at-companies-declined-for-the-first-time-in-over-a-decade-302199899.html
- Gartner predicts that by 2028, 75% of enterprises will prioritize backup of SaaS applications as a critical requirement, up from 15% in 2024. Source: Gartner, Gartner Predicts 75% of Enterprises Will Prioritize Backup of SaaS Applications as a Critical Requirement by 2028 (2024); Forecast. https://www.gartner.com/en/newsroom/press-releases/2024-08-28-gartner-predicts-75-percent-of-enterprises-will-prioritize-backup-of-saas-applications-as-a-critical-requirement-by-2028
- 48% of IT teams say they are investing most heavily in SaaS monitoring and management tools, according to Auvik's 2024 IT Trends Report. Source: Auvik, IT Trends 2024: Industry Report (2024); Survey. https://www.auvik.com/media-room/media-releases/it-trends-report-2024/
- 71% of finance leaders list SaaS fees among their top three cost-saving priorities, and 55% blame a lack of transparency from tech leaders, according to a Vertice survey. Source: Vertice, Finance vs tech leaders cloud spending survey (2023); Survey. https://financialit.net/news/management/vertice-survey-reveals-friction-between-finance-and-tech-leaders-preventing
- In its 2022 Market Guide for SaaS Management Platforms, Gartner predicted that by 2027, 40% of organizations using multiple SaaS applications would centralize management using an SMP, up from less than 25% in 2022. Source: Gartner (quoted by BetterCloud), Market Guide for SaaS Management Platforms (Dan Wilson, Jaswant Kalay, Tom Cipolla, Joe Mariano), ID G00745874 (2022); Forecast. https://www.bettercloud.com/monitor/2022-gartner-market-guide-for-smp/

## Frequently asked questions

Q: How many SaaS apps does the average company use?
A: It depends on what is counted. Torii's discovery data finds 831 apps in the average organization (median 682), shadow IT included. Okta counts 101 apps connected to its single sign-on, and BetterCloud's survey of IT teams puts it at 106.

Q: What percentage of apps are shadow IT?
A: In Torii's 2026 SaaS Benchmark, 61.3% of apps in the average portfolio are shadow IT, discovered through usage, browser activity or direct sign-up rather than procurement. Only 15.5% are formally approved.

Q: How common is shadow AI?
A: Very. 26 of the top 50 shadow IT apps in Torii's 2025 data were pure-play AI tools, and Torii discovered 694 new AI-native apps in 2025. In Microsoft and LinkedIn's 2024 survey, 78% of AI users said they bring their own AI tools to work.

Q: How much SaaS spend is wasted?
A: Estimates vary by method. Vertice's platform data puts 65% of SaaS licenses as unused or underutilized, while Flexera's survey respondents estimate 20% to 32% of SaaS spend is wasted. Torii finds Salesforce licenses have a 55% non-utilization rate.

Q: How many machine identities are there per employee?
A: CyberArk's 2025 survey reports 82 machine identities for every human. Entro's observed data puts the ratio at 144 to 1.

Q: Which SaaS management platforms does Gartner rate as Leaders?
A: Torii is named a Leader in the 2026 Gartner Magic Quadrant for SaaS Management Platforms, which evaluated 16 vendors. Torii has been a Leader in every edition since the first Magic Quadrant for the category in 2024. The report is available from Torii.

Q: Where do these statistics come from?
A: Torii's own figures come from the 2026 SaaS Benchmark Annual Report, based on aggregated, anonymized discovery data. Every other figure links to the organization that published the research. The page holds 709 statistics from 107 publishers.

## Change log

- 2026-10-07: Page moved. This page moved from toriihq.com/articles/saas-statistics to toriihq.com/saas-statistics. The old address redirects here, and every statistic, anchor link and citation works as before.
- 2026-10-07: 15 new statistics added. New research added to SaaS spend and pricing, SaaS sprawl, Shadow AI. Every new number was confirmed on its publisher's own page before it was added.
  - Added: 31% of GenAI users use AI without their employer knowing (Deloitte UK, GenAI Workforce Survey 2026 (inaugural edition), https://www.deloitte.com/uk/en/about/press-room/british-workers-spend-one-billion-pounds-of-their-own-money-on-gen-ai-for-work.html)
  - Added: £958M a year UK workers spend on their own AI tools (Deloitte UK, GenAI Workforce Survey 2026 (inaugural edition), https://www.deloitte.com/uk/en/about/press-room/british-workers-spend-one-billion-pounds-of-their-own-money-on-gen-ai-for-work.html)
  - Added: 65% of AI users see no convincing leadership on AI use (Deloitte UK, GenAI Workforce Survey 2026 (inaugural edition), https://www.deloitte.com/uk/en/about/press-room/british-workers-spend-one-billion-pounds-of-their-own-money-on-gen-ai-for-work.html)
  - Added: 47% skipped AI governance for urgent deployments (EY (Ernst & Young LLP, EY US), AI Risk and Governance Survey 2026, https://www.ey.com/en_us/newsroom/2026/09/ey-survey-finds-that-autonomous-ai-implementation-outpaces-oversight-yielding-an-ai-governance-gap)
  - Added: 26% cannot detect unauthorized AI agents internally (EY (Ernst & Young LLP, EY US), AI Risk and Governance Survey 2026, https://www.ey.com/en_us/newsroom/2026/09/ey-survey-finds-that-autonomous-ai-implementation-outpaces-oversight-yielding-an-ai-governance-gap)
  - Added: 46% encountered shadow AI risk in the past year (EY (Ernst & Young LLP, EY US), AI Risk and Governance Survey 2026, https://www.ey.com/en_us/newsroom/2026/09/ey-survey-finds-that-autonomous-ai-implementation-outpaces-oversight-yielding-an-ai-governance-gap)
  - Added: 36% had an AI incident with material negative impact (EY (Ernst & Young LLP, EY US), AI Risk and Governance Survey 2026, https://www.ey.com/en_us/newsroom/2026/09/ey-survey-finds-that-autonomous-ai-implementation-outpaces-oversight-yielding-an-ai-governance-gap)
  - Added: 8% regularly run AI-specific incident response exercises (ISACA, State of Cybersecurity 2026, https://www.isaca.org/about-us/newsroom/press-releases/2026/only-8-percent-of-organizations-global-enterprises-conduct-regular-ai-specific-response-exercises)
  - Added: $195 per user per month for Salesforce's new Core edition (Salesforce, New Salesforce Editions Bundle Everything Businesses Need for Agentic Transformation (Salesforce News), https://www.salesforce.com/news/stories/salesforce-simplifies-editions-2026/)
  - Added: 500,000 Flex Credits bundled into Salesforce's Core edition (Salesforce, New Salesforce Editions Bundle Everything Businesses Need for Agentic Transformation (Salesforce News), https://www.salesforce.com/news/stories/salesforce-simplifies-editions-2026/)
  - Added: 47% of organizations with AI agents run dozens or more (Guild.ai (survey by Morning Consult), The AI Agent Management Gap Report, https://www.globenewswire.com/news-release/2026/09/22/3366611/0/en/the-ai-agent-management-gap-is-growing.html)
  - Added: 61.2% of IT and engineering teams lose time to duplicate AI agents (Guild.ai (survey by Morning Consult), The AI Agent Management Gap Report, https://www.globenewswire.com/news-release/2026/09/22/3366611/0/en/the-ai-agent-management-gap-is-growing.html)
  - Added: 81% of IT leaders want a central hub to manage AI agents (Guild.ai (survey by Morning Consult), The AI Agent Management Gap Report, https://www.globenewswire.com/news-release/2026/09/22/3366611/0/en/the-ai-agent-management-gap-is-growing.html)
  - Added: 91% of finance teams run six finance tools or fewer (CFO Connect (Spendesk), CFO Connect Top Finance Tools Report 2026 (The CFO tech stack in 2026), https://www.cfoconnect.eu/resources/reports/best-cfo-tools-2026/)
  - Added: 23% of finance leaders plan to actively consolidate tools (CFO Connect (Spendesk), CFO Connect Top Finance Tools Report 2026 (The CFO tech stack in 2026), https://www.cfoconnect.eu/resources/reports/best-cfo-tools-2026/)
- 2026-10-06: Page published. Launched with 694 statistics from 106 publishers across 10 topics, led by Torii's 2026 SaaS Benchmark (January to December 2025 data). Every third-party number was confirmed on its publisher's own page before it was added.

## How to cite

Torii, SaaS Statistics 2026, https://www.toriihq.com/saas-statistics. For Torii figures: Torii, SaaS Benchmark Annual Report 2026 (January to December 2025 data).

Gartner, Magic Quadrant for SaaS Management Platforms, Tom Cipolla, et al, 18 June 2026. Torii is named a Leader. GARTNER and MAGIC QUADRANT are registered trademarks of Gartner, Inc. and/or its affiliates and are used herein with permission.