Torii Research
John Baker·Updated
694 sourced statistics on SaaS management: sprawl, shadow IT, shadow AI, AI agents, license waste and security. Torii's own discovery data first, then every credible number we could trace to its original source.
Popular:
Torii research
The SaaS Benchmark Annual Report 2026
The observed data behind every Torii figure on this page: app sprawl by company size, the shadow IT leaderboard, AI adoption and shadow rates, license waste and contract overage.
Analyst recognition
Torii is a Leader in the 2026 Gartner® Magic Quadrant™ for SaaS Management Platforms
Gartner evaluated 16 SaaS management platform vendors. Torii has been named a Leader in every edition since the first Magic Quadrant for the category in 2024.
Get the Gartner reportGartner, Magic Quadrant for SaaS Management Platforms, Tom Cipolla, et al, 18 June 2026.
Sprawl · 48 stats
The average organization runs 831 apps, and every one of them lands on someone's screen.
Source: Torii, SaaS Benchmark Annual Report 2026, "Volume Explosion" chart.
See the full chart in the benchmark report831
apps in the average organization
Torii, SaaS Benchmark Annual Report 2026
The average organization runs 831 SaaS apps, according to Torii's 2026 SaaS Benchmark.
2,191
apps at the average 4,000+ employee enterprise
Torii, SaaS Benchmark Annual Report 2026
Enterprises with 4,000+ employees run 2,191 apps on average (median 2,323), according to Torii's 2026 SaaS Benchmark.
40
apps the average employee uses
Torii, SaaS Benchmark Annual Report 2026
Across all company sizes, the average employee interacts with 40 apps, according to Torii's 2026 SaaS Benchmark.
11%
YoY rise in apps per organization
BetterCloud, 2026 State of SaaS
BetterCloud's 2026 State of SaaS report found the average number of apps per organization rose 11% year over year, ending two years of consolidation.
957
applications managed by the average enterprise
MuleSoft (Salesforce), 2026 Connectivity Benchmark Report
According to MuleSoft's 2026 Connectivity Benchmark Report, the average organization now manages 957 applications.
101
apps deployed by the average company
According to Okta's Businesses at Work 2025 report, the average company now deploys 101 apps, crossing 100 for the first time after years of flat growth.
342
apps in the average SaaS portfolio
Productiv (reported by CIO Dive), State of SaaS 2024
According to Productiv data reported by CIO Dive, organizations cut their app portfolios 10% in 2023, but the average still stood at 342 apps, down from 374.
682
apps in the median organization
Torii, SaaS Benchmark Annual Report 2026
The median organization runs 682 SaaS apps, according to Torii's 2026 SaaS Benchmark.
448
apps at the average startup under 100 people
Torii, SaaS Benchmark Annual Report 2026
Companies under 100 employees run 448 apps on average (median 392), according to Torii's 2026 SaaS Benchmark.
41%
one-year jump in mid-market app count (116 to 164)
BetterCloud, 2026 State of SaaS
Mid-market organizations saw their average app count jump 41% in a single year, from 116 to 164, according to BetterCloud.
27%
of enterprise apps are connected
MuleSoft (Salesforce), 2026 Connectivity Benchmark Report
Only 27% of an organization's applications are connected to each other on average, according to MuleSoft's 2026 Connectivity Benchmark Report.
114
apps per US company, up 9% YoY
Okta, Businesses at Work 2025 (infographic)
Okta's Businesses at Work 2025 data shows US companies deploy an average of 114 apps, up 9% year over year, the highest of any country Okta reports.
74
apps per organization in EMEA
Okta, Businesses at Work 2025 (infographic)
According to Okta, the average EMEA organization deploys 74 apps, up from 69 a year earlier, while the global average reached 101.
60%
of the most popular apps are security or collaboration
Security and collaboration apps together make up 60% of the most widely deployed apps, according to Okta's Businesses at Work 2025.
106
SaaS apps per company (2025 survey)
BetterCloud, 2025 State of SaaS
BetterCloud's 2025 State of SaaS report found companies used an average of 106 SaaS apps, down from 112 the year before.
897
applications used by the average organization (2025)
MuleSoft (Salesforce), 2025 Connectivity Benchmark Report
According to MuleSoft's 2025 Connectivity Benchmark Report, organizations use 897 applications on average.
23%
one-year jump in tools per company
Spendflo, State of SaaS Procurement 2025
The average tool count per company jumped 23% in a year, driven by AI-powered tools, according to Spendflo's State of SaaS Procurement 2025 report.
93
apps per company in 2023, up 4%
Okta's 2024 Businesses at Work report found the average company's app count grew 4% to 93, after stalling at 89 for two years.
231
apps at companies with 2,000+ employees
According to Okta, large companies with 2,000 or more employees deploy an average of 231 apps each, up 10% from 211 a year earlier.
72
apps at companies under 2,000 employees
Okta's data shows companies with fewer than 2,000 employees deploy an average of 72 apps, up from 69 a year earlier.
47
apps per tech startup, up 15%
Tech startups (100 or fewer employees) grew their app count 15% in a year to an average of 47 apps, according to Okta.
105 vs 66
apps per company, US vs Canada
Okta found US companies deploy an average of 105 apps, while Canadian companies deploy just 66.
58
apps per SMB (36 for small businesses)
According to Okta's SMBs at Work 2024 report, SMBs (500 or fewer employees) deploy an average of 58 apps and small businesses (50 or fewer) about 36.
130
peak apps per company in 2022
BetterCloud, State of SaaSOps 2024
According to BetterCloud, the average company's SaaS app count peaked at 130 in 2022, then fell 14% to 112 in 2023, the first decline in over a decade.
~7 hrs
lost per employee each week to fragmented tools
Freshworks, The Cost of Complexity Report
Employees lose nearly seven hours a week, almost a full workday, to complicated processes and fragmented tools, according to Freshworks.
1,200
app and window toggles per worker per day
Workers toggle between apps and websites roughly 1,200 times a day, losing just under four hours a week (about 9% of work time) to reorienting, according to a Harvard Business Review study.
48%
of Microsoft 365 customers also run Google Workspace
Okta, Businesses at Work 2025 (infographic)
Okta found that 48% of its Microsoft 365 customers also run Google Workspace, up from 33% five years earlier, a sign of duplicate productivity suites.
33%
consolidated redundant apps or accounts
BetterCloud, 2025 State of SaaS
Only 33% of companies consolidated redundant apps or accounts in the past year, according to BetterCloud.
15
software tools workers juggle every day
Freshworks, The Cost of Complexity Report
Workers juggle an average of 15 different software tools and four communication channels every day, according to Freshworks.
36%
of CX teams cite toggling between too many tools
Freshworks, The Cost of Complexity Report
36% of customer experience teams name toggling between too many tools as a top frustration, according to Freshworks.
33
app or tab switches per worker per day
Lokalise, Tool Fatigue Productivity Report
Workers switch between tabs, apps or platforms an average of 33 times a day, and 17% switch more than 100 times, according to a 2025 Lokalise survey.
51 min
lost per worker each week to tool fatigue
Lokalise, Tool Fatigue Productivity Report
Workers lose an average of 51 minutes a week to tool fatigue, more than 44 hours a year, according to Lokalise.
79%
say their company hasn't tried to consolidate tools
Lokalise, Tool Fatigue Productivity Report
79% of employees say their company hasn't taken steps to reduce tool fatigue or consolidate platforms, according to Lokalise.
74%
see clear evidence of tech overlap and redundancy
Ivanti, 2025 Digital Employee Experience Report
74% of IT professionals see clear evidence of technology overlaps and redundancies in their organizations, yet 63% say consolidating tools is not a high priority, according to Ivanti.
11
apps the average desk worker uses (up from 6 in 2019)
A Gartner survey found the average desk worker uses 11 applications for work, up from six in 2019, and 5% use 26 or more.
3,600+
daily toggles per employee in one supply-chain team
Harvard Business Review, How Much Time and Energy Do We Waste Toggling Between Applications?
At one Fortune 500 company, a single supply-chain transaction meant switching about 350 times between 22 apps and websites, adding up to more than 3,600 toggles per employee per day.
13 apps
switched between 30 times a day
Asana (reported by CIO Dive), Anatomy of Work Index 2021
US employees switch between an average of 13 apps 30 times a day, according to Asana's Anatomy of Work Index 2021.
45%
say tool-switching hurts their productivity
Qatalog with Cornell University Ellis Idea Lab (reported by Construction Dive), Workgeist report
Context switching between digital tools hurts productivity for 45% of workers, according to a Qatalog study run with Cornell University's Ellis Idea Lab.
27
AI-powered SaaS apps per organization
BetterCloud, 2026 State of SaaS
Organizations now deploy an average of 27 AI-powered SaaS apps, about 22% of their total portfolio, according to BetterCloud's 2026 State of SaaS report.
1,057
apps at organizations fully adopting agentic AI
MuleSoft (Salesforce), 2026 Connectivity Benchmark Report
Organizations that have fully adopted agentic AI manage an average of 1,057 applications, 10% more than the overall average, according to MuleSoft.
#1
Anthropic: fastest-growing vendor in every segment
Tropic, The State of Software Procurement in 2026
Anthropic was the fastest-growing software vendor across SMB, mid-market and enterprise buyers in Q2 2026, the first time one vendor topped all three segments, according to Tropic.
67%
of organizations pay for AI-native tools
Tropic, AI Spending and Pricing Trends H1 2026
67% of organizations now pay for AI-native tools, up from 12% in January 2023, according to Tropic's spend data.
4.2
AI tools per mid-market company
Freshworks, The Global Cost of Complexity Report: The Mid-Market AI Complexity Trap
Mid-market companies use an average of 4.2 AI tools, but only 33% have a formal, consistently applied AI governance framework, according to Freshworks.
46% → 69%
of organizations using Gemini alongside other AI apps
Netskope Threat Labs, Cloud and Threat Report: 2026
Google Gemini adoption among organizations rose from 46% to 69% in a year, a sign that companies increasingly pay for multiple overlapping generative AI apps, according to Netskope.
40%
of the fastest-growing apps are security tools
Security tools make up 40% of the fastest-growing apps in Okta's Businesses at Work 2025 report.
146%
YoY growth for OpenAI, the fastest-growing vendor
Tropic, 2025 Software Buying Trends for Effective Spend Management
OpenAI was the fastest-growing software vendor of 2024 at 146% year-over-year growth, and 19 of the 20 fastest-growing vendors prominently featured AI, according to Tropic.
62%
of companies use Salesforce, the most-used tool
Tropic, 2025 Software Buying Trends (blog summary)
Salesforce is the most widely used software tool, found at 62% of companies, according to Tropic's 2024 buying data.
338%
YoY customer growth for Vanta, the fastest-growing app
Compliance tool Vanta was the fastest-growing app in Okta's 2024 report, with 338% year-over-year growth in customers deploying it.
Shadow IT · 75 stats
Most apps never pass through IT. In Torii's data, 61.3% of the average portfolio is shadow IT.
Source: Torii, SaaS Benchmark Annual Report 2026, "Shadow Iceberg" chart.
See the full chart in the benchmark reportSource: Torii, SaaS Benchmark Annual Report 2026, "Shadow Categories" chart.
See the full chart in the benchmark report52%
of employees have downloaded apps without IT approval
1Password, Annual Report 2025: The Access-Trust Gap
According to 1Password's 2025 Access-Trust Gap report, 52% of employees have downloaded apps without IT approval.
42%
of employees bypass IT to boost productivity
1Password, Annual Report 2025: The Access-Trust Gap (press release)
1Password's 2025 Access-Trust Gap report found 42% of employees bypass IT to boost their productivity.
55%
of Singapore employees download apps without IT approval
1Password, Annual Report 2025: The Access-Trust Gap (press release)
Shadow IT varies by country: 55% of employees in Singapore admit downloading apps without IT approval, versus 46% in Germany, 44% in the U.S., 43% in the UK and 33% in France, per 1Password's 2025 report.
27%
of office workers regularly use unauthorized tools out of frustration
Ivanti, 2025 Digital Employee Experience (DEX) Report
27% of office workers say they regularly use unauthorized tools and apps out of frustration with their employer-provided tools, according to Ivanti's 2025 Digital Employee Experience Report.
~40%
of office workers bypass IT support to fix tech problems themselves
Ivanti, 2025 Digital Employee Experience (DEX) Report
Nearly 40% of office workers say they bypass employer-provided tech support entirely when they hit a technology problem, usually because they can fix it faster themselves, per Ivanti.
69%
of employees bypassed security guidance in a year
A Gartner survey found 69% of employees had bypassed their organization's cybersecurity guidance in the past 12 months.
74%
of employees would bypass security to hit a business goal
74% of employees told Gartner they would bypass cybersecurity guidance if it helped them or their team achieve a business objective.
4.9 sec
between each use of an unauthorized app
Cledara, The State of Shadow IT
Across 200 companies, Cledara counted 23.6 million instances of shadow IT usage over 30 days: an employee opened an unauthorized app every 4.9 seconds of the workday.
68%
of corporate-account SaaS logins bypass SSO
LayerX Security, Browser Security Report 2025
Per LayerX's Browser Security Report 2025, 68% of logins to SaaS apps using corporate accounts happen without single sign-on.
78%
of employees ignore BYOD bans
Ivanti, Securing the Borderless Digital Landscape
Where BYOD is banned, 78% of employees use personal devices for work anyway, according to Ivanti's Securing the Borderless Digital Landscape report.
31%
of users upload work data to personal cloud apps each month
Netskope, Cloud and Threat Report: 2026
According to Netskope's Cloud and Threat Report 2026, 31% of users in the average organization upload data to personal cloud apps every month.
21%
rise in users uploading data to personal apps in a year
Netskope, Cloud and Threat Report: 2026
Netskope reports the share of users uploading data to personal cloud apps grew 21% over the past year.
43%
of organizations put real-time controls on personal Google Drive
Netskope, Cloud and Threat Report: 2026
Google Drive is the personal app organizations most often control, with 43% applying real-time protections, followed by Gmail (31%) and OneDrive (28%), per Netskope.
43%
of SaaS apps accessed with personal credentials
LayerX Security, Browser Security Report 2025
LayerX's Browser Security Report 2025 found 43% of SaaS applications in organizational networks are accessed with personal (non-corporate) credentials.
83%
of ERP logins happen without SSO
LayerX Security, Browser Security Report 2025
LayerX telemetry shows 83% of logins to ERP systems and 71% of logins to CRM systems happen without SSO.
87%
of chat/IM app usage is on personal accounts
LayerX Security, Browser Security Report 2025
87% of employee activity in chat and instant-messaging apps happens through personal, non-corporate accounts, according to LayerX's Browser Security Report 2025.
77%
of Salesforce logins use non-corporate accounts
LayerX Security, Enterprise AI and SaaS Data Security Report 2025
Even in Salesforce, 77% of logins observed by LayerX came from non-corporate accounts, as did 68% of Microsoft Online and 64% of Zoom logins.
38%
of file-sharing uploads go through personal accounts
LayerX Security, Enterprise AI and SaaS Data Security Report 2025
38% of file uploads to file storage and sharing platforms are made through personal accounts, and 41% of files uploaded there contain PII or payment card data, per LayerX.
99%
of enterprise users run at least one browser extension
LayerX Security, Enterprise Browser Extension Security Report 2025 (press release)
99% of enterprise users have at least one browser extension installed, and 53% have more than 10, according to LayerX's Enterprise Browser Extension Security Report 2025.
53%
of enterprise users run high-risk-permission extensions
LayerX Security, Enterprise Browser Extension Security Report 2025 (press release)
53% of enterprise users have installed browser extensions with 'high' or 'critical' permission scopes, able to access cookies, passwords and browsing data, per LayerX.
26%
of enterprise browser extensions were side-loaded
LayerX Security, Browser Security Report 2025
17% of browser extensions installed by enterprise users come from non-official stores and 26% are side-loaded by external applications, according to LayerX's Browser Security Report 2025.
54%
of extension publishers use a free webmail account
LayerX Security, Enterprise Browser Extension Security Report 2025 (press release)
54% of browser extension publishers use a free webmail account, and 79% have published only a single extension, per LayerX.
51%
of browser extensions not updated in a year
LayerX Security, Enterprise Browser Extension Security Report 2025 (press release)
51% of all browser extensions haven't received an update in over a year, LayerX reports.
46%
of infostealer-hit devices with corporate logins were unmanaged
Verizon, 2025 Data Breach Investigations Report
Verizon's 2025 Data Breach Investigations Report found 46% of systems compromised by infostealer malware that held corporate logins were non-managed devices, most likely personal devices or devices used outside policy.
3 in 4
IT workers say BYOD is routine
Ivanti, Securing the Borderless Digital Landscape
Three in four IT workers say BYOD is a regular occurrence at their organization, though only 52% say it is explicitly allowed, per Ivanti.
84%
of organizations have employees on unmanaged devices
Cisco, 2025 Cybersecurity Readiness Index
84% of organizations say employees access company networks from unmanaged devices, according to Cisco's 2025 Cybersecurity Readiness Index.
1 in 2
office workers log into work systems from personal devices
Ivanti, Digital Employee Experience (DEX) Security Research Report
One in two office workers use personal devices to log into work networks and software, and 32% of them say their employer doesn't know, according to Ivanti research.
47%
of companies allow access from unmanaged devices
1Password (Kolide), The Shadow IT Report
47% of companies let employees access company resources from unmanaged devices using credentials alone, according to Kolide's (now 1Password) Shadow IT report.
49%
of developers write code on personal devices
1Password (Kolide), The Shadow IT Report
49% of developers report doing software development on personal devices, and 35% of security professionals use personal devices to manage cloud infrastructure, per Kolide's Shadow IT report.
35%
of orgs saw work email forwarded to personal accounts
BetterCloud, 2023 State of SaaSOps
35% of IT respondents said users had forwarded work email to their personal email accounts, per BetterCloud's 2023 State of SaaSOps report.
1,454
browser extensions at the average 2,000+ employee company
Spin.AI, Browser Extension Risk Report
Companies with more than 2,000 employees have an average of 1,454 different browser extensions installed, according to Spin.AI's analysis of its customers.
60%
of insider threat incidents involve personal cloud apps
Netskope, Cloud and Threat Report: 2026
Netskope's Cloud and Threat Report 2026 found that 60% of insider threat incidents involve personal cloud app instances.
54%
of personal-app policy violations involve regulated data
Netskope, Cloud and Threat Report: 2026
Regulated data (personal, financial and healthcare information) accounts for 54% of data policy violations linked to personal cloud apps, per Netskope's Cloud and Threat Report 2026.
77%
of organizations control data sent to personal apps
Netskope, Cloud and Threat Report: 2026
77% of organizations now place real-time controls on data being sent to personal apps, up from 70% a year earlier, according to Netskope.
49%
of IT/security pros say unapproved software has weakened their defenses
1Password, Annual Report 2025: The Access-Trust Gap (press release)
In 1Password's 2025 survey, 49% of security and IT professionals said employee use of unapproved software has compromised their ability to maintain adequate protections.
56%
of organizations see sensitive data uploaded to unauthorized apps
Cloud Security Alliance (commissioned by Valence Security), State of SaaS Security Report 2025
56% of organizations say employees upload sensitive data to unauthorized SaaS apps, per the Cloud Security Alliance's 2025 State of SaaS Security Report.
90%
of SME IT pros worry about unauthorized apps
JumpCloud, SME IT Trends Report Q1 2025
In JumpCloud's Q1 2025 SME IT Trends survey, 90% of SME IT professionals said they worry about employees using unauthorized apps, yet 38% have no full app discovery process.
38%
of SMEs lack a full app discovery process
JumpCloud, SME IT Trends Report Q1 2025
38% of SME IT professionals say they don't have a full process for discovering the apps employees use, according to JumpCloud's Q1 2025 SME IT Trends report.
~60%
of IT pros still worry about shadow IT
BetterCloud, State of SaaS 2025
Nearly 60% of IT professionals remain concerned about the risks of shadow IT, according to BetterCloud's State of SaaS 2025 report.
45%
of IT pros lack sufficient data about shadow IT
Ivanti, Securing the Borderless Digital Landscape
45% of IT professionals say they lack sufficient data about shadow IT, and 38% lack sufficient data about the devices accessing their network, per Ivanti.
58%
of IT leaders hit issues from unsanctioned SaaS
Flexera, 2026 IT Priorities Report
58% of IT leaders have encountered issues due to unsanctioned SaaS usage, according to Flexera's 2026 IT Priorities Report.
1 in 3
breaches involved shadow data
IBM / Ponemon Institute, Cost of a Data Breach Report 2024
IBM's Cost of a Data Breach Report 2024 found more than one-third of breaches involved shadow data stored in unmanaged data sources.
37%
of SME breaches in H1 2024 blamed on shadow IT
JumpCloud, SME IT Trends Report (Q3 2024)
SME IT leaders surveyed by JumpCloud attributed 37% of the breaches their organizations suffered in the first half of 2024 to shadow IT.
84%
of SMEs are concerned about shadow IT
JumpCloud, SME IT Trends Report (Q3 2024)
84% of SMEs are concerned about shadow IT, according to JumpCloud's mid-2024 SME IT Trends survey.
11%
of companies hit by incidents caused by shadow IT
Kaspersky research found 11% of companies worldwide suffered cyber incidents caused by employees' use of shadow IT over two years; in the IT industry, 16% of incidents were due to shadow IT.
13%
of U.S. companies' cyber incidents caused by shadow IT
Kaspersky, Kaspersky uncovers the risks unauthorized IT products pose to businesses (press release)
In the U.S., 13% of cyber incidents companies suffered over two years were caused by the use of shadow IT, according to Kaspersky.
76%
of SMBs say shadow IT posed a moderate-to-severe cyber threat
Capterra (Gartner Digital Markets), Shadow IT Teams Cost Your SMB Time and Money
76% of SMBs that had high-impact shadow IT efforts say the effort posed a moderate to severe cybersecurity threat, per Capterra.
89%
of SMBs saw negative financial consequences from shadow IT
Capterra (Gartner Digital Markets), Shadow IT Teams Cost Your SMB Time and Money
89% of SMBs with high-impact shadow IT efforts report negative financial consequences, yet 80% also report a positive long-term financial impact, Capterra found.
91%
of SMBs struggle to integrate shadow IT work
Capterra (Gartner Digital Markets), Shadow IT Teams Cost Your SMB Time and Money
91% of SMBs that had high-impact shadow IT efforts report challenges integrating the shadow IT work into their official environments, according to Capterra.
35-40%
of SaaS spend is shadow IT at the median company
Cledara, The True Cost of Shadow IT (blog)
Cledara's analysis of SaaS spend data finds shadow IT accounts for about 35-40% of total SaaS spend at the median company, and as much as 60-70% at some.
Shadow AI · 95 stats
AI is now the quickest way around IT: 26 of the top 50 shadow IT apps are pure-play AI tools.
Source: Torii, SaaS Benchmark Annual Report 2026, "New AI Apps Discovered" chart.
See the full chart in the benchmark reportSource: Torii, SaaS Benchmark Annual Report 2026, "LLM Adoption vs. Shadow IT" chart. The report does not state the denominator for either rate.
See the full chart in the benchmark report57%
of employees hide or don't disclose AI use
According to the University of Melbourne and KPMG's 2025 global study, 57% of employees admit to hiding their AI use or presenting AI-generated content as their own.
78%
of AI users bring their own AI tools to work
Microsoft and LinkedIn, 2024 Work Trend Index Annual Report
According to Microsoft and LinkedIn's 2024 Work Trend Index, 78% of AI users at work are bringing their own AI tools to work (BYOAI).
95.3%
adoption rate for ChatGPT, the top AI app
Torii, SaaS Benchmark Annual Report 2026
ChatGPT leads Torii's AI Leaders of 2025 with a 95.3% adoption rate, followed by Zapier (93.9%) and Grammarly (93.3%), according to Torii's 2026 SaaS Benchmark.
76%
shadow rate for Grok
Torii, SaaS Benchmark Annual Report 2026
Grok has a 76% shadow rate against 65% adoption, compared with ChatGPT's 28% shadow rate, according to Torii's 2026 SaaS Benchmark LLM adoption vs shadow IT chart.
47%
of genAI users use personal AI apps
Netskope Threat Labs, Cloud and Threat Report: 2026
According to Netskope's Cloud and Threat Report 2026, 47% of genAI users at work use personal AI apps, down from 78% a year earlier.
59%
of users use AI apps weekly (median org)
Netskope Threat Labs, Netskope AI Report: 2026
According to Netskope's AI Report 2026, the share of enterprise users using AI apps weekly rose from 34% to 59% in the median organization over the past year.
30%
of AI users use only personal AI apps
Netskope Threat Labs, Netskope AI Report: 2026
According to Netskope's AI Report 2026, 30% of AI users use only personal AI apps and another 14% mix personal and organization-managed apps.
32.3%
of workplace ChatGPT use is on personal accounts
Cyberhaven Labs, 2026 AI Adoption & Risk Report
According to Cyberhaven's 2026 AI Adoption & Risk Report, 32.3% of ChatGPT usage and 24.9% of Gemini usage at work happens through personal accounts.
16.9%
of sensitive AI exposures via personal free accounts
According to Harmonic Security's analysis of 22.4 million enterprise AI prompts in 2025, 16.9% of all sensitive data exposures flowed through personal free-tier AI accounts where IT has no visibility.
47%
of enterprise AI conversations use personal identities
LayerX Security, State of AI Usage Report 2026
According to LayerX's State of AI Usage Report 2026, 47% of enterprise AI conversations are done through personal identities rather than corporate accounts.
90%
believe employees use AI in their organization
According to ISACA's 2026 AI Pulse Poll, 90% of digital trust professionals believe employees are using AI in their organization, but only 22% say AI ROI has met or exceeded expectations.
45.4%
of sensitive AI interactions from personal emails
Harmonic Security, The AI Tightrope: Balancing Innovation and Exposure in the Enterprise (Q1 2025)
According to Harmonic Security's Q1 2025 research, 45.4% of sensitive AI interactions came from personal email accounts.
68%
of enterprise GenAI users use personal accounts
TELUS Digital, AI at Work survey (shadow AI)
According to a TELUS Digital survey, nearly 68% of enterprise employees who use GenAI at work access public AI assistants through personal accounts.
56%
used AI at work without knowing if allowed
According to the University of Melbourne and KPMG's 2025 global study, 56% of employees say they have used AI tools at work without knowing if it is allowed.
68%
of security leaders use unauthorized AI daily
According to UpGuard's State of Shadow AI report, 8 out of 10 employees use unauthorized AI tools, and 68% of security leaders admit to incorporating unauthorized AI into their daily workflows.
8 in 10
employees use unauthorized AI tools
According to UpGuard's State of Shadow AI report, 8 out of 10 employees worldwide use unauthorized AI tools.
32%
of GenAI users keep it secret from their employer
Ivanti, 2025 Technology at Work Report: Reshaping Flexible Work
According to Ivanti's 2025 Technology at Work Report, nearly a third (32%) of employees who use GenAI tools at work keep it a secret from their employer.
42%
of employees use GenAI at work (up from 26%)
Ivanti, 2025 Technology at Work Report: Reshaping Flexible Work
According to Ivanti's 2025 Technology at Work Report, 42% of employees admit to using GenAI at work in 2025, up from 26% in 2024.
90%+
of companies have workers using personal AI tools
MIT NANDA (Project NANDA, MIT Media Lab), The GenAI Divide: State of AI in Business 2025
According to MIT NANDA's State of AI in Business 2025 report, only 40% of companies say they purchased an official LLM subscription, yet workers at over 90% of companies surveyed reported regular use of personal AI tools for work.
37%
follow company AI policy only 'most of the time'
1Password, 2025 Annual Report: The Access-Trust Gap
According to 1Password's 2025 Access-Trust Gap report, 73% of employees are encouraged to use AI at work, but 37% say they follow their company's AI policies only 'most of the time.'
27%
of AI app spend arrives via individual users (PLG)
Menlo Ventures, 2025: The State of Generative AI in the Enterprise
Menlo Ventures found that 27% of all AI application spend enters companies through product-led growth (individual users), nearly 4x the 7% rate in traditional software, and close to 40% when personal-card shadow AI is counted.
75%
of knowledge workers use AI at work
Microsoft and LinkedIn, 2024 Work Trend Index Annual Report
According to Microsoft and LinkedIn's 2024 Work Trend Index, 75% of knowledge workers now use AI at work.
46%
would keep using shadow AI even if banned
Software AG, Shadow AI study (press release)
According to a Software AG study of 6,000 knowledge workers, half of all employees use shadow AI, and 46% would refuse to stop even if their organization banned it.
50%
of employees use shadow AI
Software AG, Shadow AI study (press release)
According to a Software AG study, half of all employees are using shadow AI, meaning AI tools not provided by their companies.
Over half
of workplace GenAI users lack employer approval
Salesforce, Generative AI Snapshot Research Series: The Promises and Pitfalls of AI at Work
According to Salesforce's 2023 Generative AI Snapshot research, 28% of workers use generative AI at work, and over half of them do so without formal approval from their employer.
48%
of employees uploaded sensitive company data to public AI
According to the University of Melbourne and KPMG's 2025 global study of 48,000 people in 47 countries, about half (48 to 49%) of employees have uploaded sensitive company information or copyrighted material into public AI tools.
223
genAI data policy violations per org per month
Netskope Threat Labs, Cloud and Threat Report: 2026
According to Netskope's Cloud and Threat Report 2026, the average organization sees 223 incidents per month of users sending sensitive data to genAI apps, double the year before.
42%
of genAI data violations involve source code
Netskope Threat Labs, Cloud and Threat Report: 2026
According to Netskope's Cloud and Threat Report 2026, source code (42%), regulated data (32%) and intellectual property (16%) were the top data types in genAI data policy violations.
39.7%
of data movements into AI involve sensitive data
Cyberhaven Labs, 2026 AI Adoption & Risk Report
According to Cyberhaven's 2026 AI Adoption & Risk Report, 39.7% of all data movements into AI tools involve sensitive data.
Every 3 days
the average employee puts sensitive data into AI
Cyberhaven Labs, 2026 AI Adoption & Risk Report
According to Cyberhaven's 2026 AI Adoption & Risk Report, the average employee enters sensitive data into AI tools once every three days.
12.8%
of AI coding-tool exposures contain credentials
According to Harmonic Security, 12.8% of sensitive data exposures in AI coding tools contain API keys, tokens or other credentials.
1 in 12
enterprise ChatGPT conversations contain sensitive data
LayerX Security, State of AI Usage Report 2026
According to LayerX's State of AI Usage Report 2026, more than 1 in 12 ChatGPT conversations in the enterprise contains sensitive information.
18,033 TB
of enterprise data sent to AI apps in 2025
Zscaler ThreatLabz, ThreatLabz 2026 AI Security Report
According to Zscaler's ThreatLabz 2026 AI Security Report, enterprise data transfers to AI/ML applications surged 93% in 2025 to 18,033 terabytes.
410M
DLP violations tied to ChatGPT alone
Zscaler ThreatLabz, ThreatLabz 2026 AI Security Report
According to Zscaler's ThreatLabz 2026 AI Security Report, ChatGPT alone was tied to 410 million data loss prevention policy violations in 2025.
34.8%
of data put into AI tools is sensitive
Cyberhaven Labs, 2025 AI Adoption and Risk Report
According to Cyberhaven's 2025 AI Adoption and Risk Report, 34.8% of the corporate data employees put into AI tools is sensitive, up from 10.7% two years earlier.
83.8%
of enterprise data sent to AI goes to risky tools
Cyberhaven Labs, 2025 AI Adoption and Risk Report
According to Cyberhaven's 2025 AI Adoption and Risk Report, 71.7% of AI tools used in workplaces are high or critical risk, and 83.8% of enterprise data going to AI flows to these risky tools.
26%
of files uploaded to GenAI contain sensitive data
Harmonic Security, GenAI in the Enterprise: It's Getting Personal (Q3 2025)
According to Harmonic Security's Q3 2025 analysis, 26.38% of files uploaded to GenAI tools contained sensitive information, up from 22% in Q2.
40%
of files uploaded to GenAI contain PII or PCI
LayerX Security, Enterprise AI and SaaS Data Security Report 2025
According to LayerX's Enterprise AI and SaaS Data Security Report 2025, 40% of files uploaded to GenAI tools contain sensitive PII or PCI data.
32%
of corporate-to-personal data transfers go to GenAI
LayerX Security, Enterprise AI and SaaS Data Security Report 2025
According to LayerX's Enterprise AI and SaaS Data Security Report 2025, GenAI tools account for 32% of all corporate-to-personal data transfers, making AI the top data exfiltration channel.
57%
admit entering sensitive data into public AI
TELUS Digital, AI at Work survey (shadow AI)
According to a TELUS Digital survey, 57% of enterprise employees who use GenAI at work admit to entering sensitive information into public AI assistants.
70%
know of sensitive data shared with AI at work
According to UpGuard's State of Shadow AI report, 70% of employees know of sensitive data being shared with AI tools at their workplace.
99%
of orgs have sensitive data AI can surface
Varonis, 2025 State of Data Security Report: Quantifying AI's Impact on Data Risk
According to Varonis' 2025 State of Data Security Report, 99% of organizations have exposed sensitive data that can easily be surfaced by AI.
64%
worry about leaking sensitive data via GenAI
Cisco, 2025 Data Privacy Benchmark Study
According to Cisco's 2025 Data Privacy Benchmark Study, 64% of privacy and security professionals worry about inadvertently sharing sensitive information through GenAI, yet nearly half admit inputting personal employee or non-public data into GenAI tools.
48%
entered non-public company info into GenAI
Cisco, 2024 Data Privacy Benchmark Study
According to Cisco's 2024 Data Privacy Benchmark Study, 48% of privacy and security professionals admit entering non-public company information into GenAI tools.
26 of 50
top shadow IT apps are pure-play AI
Torii, SaaS Benchmark Annual Report 2026
In 2025, 26 of the top 50 shadow IT apps were pure-play AI tools, according to Torii's 2026 SaaS Benchmark.
694
new AI-native apps discovered in 2025
Torii, SaaS Benchmark Annual Report 2026
Torii discovered 694 new AI-native applications in 2025, more than double the 2023 figure of 317, according to its 2026 SaaS Benchmark.
254
distinct AI apps used by the average company
Harmonic Security, The AI Tightrope: Balancing Innovation and Exposure in the Enterprise (Q1 2025)
According to Harmonic Security's Q1 2025 research, the average company interacted with 254 distinct AI applications, not counting mobile or API access.
11 → 694
new AI-native apps a year, 2020 vs 2025
Torii, SaaS Benchmark Annual Report 2026
New AI-native apps discovered per year grew from 11 in 2020 to 694 in 2025, according to Torii's 2026 SaaS Benchmark.
6x
growth in prompts sent to genAI apps
Netskope Threat Labs, Cloud and Threat Report: 2026
According to Netskope's Cloud and Threat Report 2026, the amount of data sent to SaaS genAI apps grew sixfold in a year, from 3,000 to 18,000 prompts per month per organization, while user counts tripled.
1,600+
genAI apps tracked, up fivefold in a year
Netskope Threat Labs, Cloud and Threat Report: 2026
According to Netskope's Cloud and Threat Report 2026, the number of genAI apps it tracks grew fivefold to more than 1,600, while the average organization uses 8 AI apps, up from 6.
300+
GenAI tools in the top 1% of organizations
Cyberhaven Labs, 2026 AI Adoption & Risk Report
According to Cyberhaven's 2026 AI Adoption & Risk Report, the top 1% of early-adopter organizations use more than 300 GenAI tools, while cautious enterprises use fewer than 15.
665
AI tools seen in enterprise prompt traffic
According to Harmonic Security, enterprise employees sent prompts to 665 different AI tools in 2025, but six applications accounted for 92.6% of sensitive data exposure.
75%
of AI browser extensions have high or critical permissions
LayerX Security, State of AI Usage Report 2026
According to LayerX's State of AI Usage Report 2026, nearly 75% of AI browser extensions are granted high or critical permissions, and 16.31% have known CVEs.
414
unsanctioned AI tools per 1,000 employees
Reco, The State of Agent Security 2026
According to Reco's State of Agent Security 2026, small and mid-size firms average 414 unsanctioned AI tools per 1,000 employees, even where 79% of SaaS is authorized.
3,400+
apps generating enterprise AI traffic
Zscaler ThreatLabz, ThreatLabz 2026 AI Security Report
According to Zscaler's ThreatLabz 2026 AI Security Report, the number of applications driving AI/ML transactions quadrupled year over year to more than 3,400.
83%
year-over-year growth in enterprise AI activity
Zscaler ThreatLabz, ThreatLabz 2026 AI Security Report
According to Zscaler's ThreatLabz 2026 AI Security Report, enterprise AI/ML activity increased 83% year over year in 2025.
61x
growth in workplace AI usage over two years
Cyberhaven Labs, 2025 AI Adoption and Risk Report
According to Cyberhaven's 2025 AI Adoption and Risk Report, the frequency of AI use at work grew 4.6x in 12 months and 61x over 24 months.
27
distinct AI tools used per organization per quarter
Harmonic Security, GenAI in the Enterprise: It's Getting Personal (Q3 2025)
According to Harmonic Security's Q3 2025 analysis, the average organization's employees used 27 distinct AI tools in the quarter.
20%+
of enterprise users have a GenAI browser extension
LayerX Security, Enterprise Browser Extension Security Report 2025
According to LayerX's Enterprise Browser Extension Security Report 2025, over 20% of enterprise users have a GenAI-enabled browser extension installed, and 58% of GenAI extensions have high or critical permissions.
10.53B
monthly visits to GenAI sites (Jan 2025)
Menlo Security, 2025 Report: How AI is Shaping the Modern Workspace
According to Menlo Security's 2025 report, web traffic to GenAI sites jumped 50%, from 7 billion visits in February 2024 to 10.53 billion in January 2025.
890%
surge in enterprise GenAI traffic in 2024
Palo Alto Networks, The State of Generative AI in 2025
According to Palo Alto Networks' State of Generative AI 2025, GenAI traffic surged more than 890% in 2024.
66
GenAI apps used by the average organization
Palo Alto Networks, The State of Generative AI in 2025
According to Palo Alto Networks' State of Generative AI 2025, organizations used an average of 66 GenAI apps, with 10% classified as high risk.
269
shadow AI tools per 1,000 employees at small firms
Reco, 2025 State of Shadow AI Report
According to Reco's 2025 State of Shadow AI Report, small businesses average 269 shadow AI tools per 1,000 employees, and 27% of employees at companies with 11 to 50 workers use unsanctioned AI tools.
38%
of orgs have a formal, comprehensive AI policy
According to ISACA's 2026 AI Pulse Poll, only 38% of organizations have a formal, comprehensive AI policy, up from 28% in 2025, and 25% have no active policy.
50%
of orgs lack enforceable genAI data policies
Netskope Threat Labs, Cloud and Threat Report: 2026
According to Netskope's Cloud and Threat Report 2026, 50% of organizations lack enforceable data protection policies for genAI apps.
90%
of orgs block at least one genAI app
Netskope Threat Labs, Cloud and Threat Report: 2026
According to Netskope's Cloud and Threat Report 2026, 90% of organizations actively block at least one genAI app, blocking 10 apps on average.
56%
don't know how fast they could shut down AI
ISACA, 2026 AI Pulse Poll (preview, RSA Conference)
According to ISACA's 2026 AI Pulse Poll, 56% of digital trust professionals do not know how quickly they could halt an AI system during a security incident.
20%
don't know who owns AI harm
ISACA, 2026 AI Pulse Poll (preview, RSA Conference)
According to ISACA's 2026 AI Pulse Poll, 20% of respondents don't know who would be responsible if an AI system caused harm or serious error in their organization.
87%
worry about unauthorized employee AI use
ISACA, 2026 AI Pulse Poll (Europe findings)
According to ISACA's 2026 AI Pulse Poll in Europe, 87% of professionals are concerned about employees using AI in an unauthorized capacity.
26%
can actually enforce their AI security strategy
Check Point Software, 2026 Cloud Security Report: Enter the AI Era
According to Check Point's 2026 Cloud Security Report, 77% of organizations have updated their security strategy in response to AI, but only 26% have the architecture to enforce it.
16%
enforce AI access controls consistently
Check Point Software, 2026 Cloud Security Report: Enter the AI Era
According to Check Point's 2026 Cloud Security Report, 24% of organizations have no AI-specific access controls, and only 16% enforce controls consistently.
~50%
don't always know when employees use AI tools
Flexera, Flexera 2026 AI Pulse Report
Flexera found nearly half of organizations don't always know how or when employees are using AI tools, and 85% say IT visibility gaps pose a major risk.
97%
of AI-breached orgs lacked AI access controls
IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025
According to IBM's Cost of a Data Breach Report 2025, 97% of organizations that suffered an AI-related breach lacked proper AI access controls.
63%
of breached orgs lack an AI governance policy
IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025
According to IBM's Cost of a Data Breach Report 2025, 63% of breached organizations either don't have an AI governance policy or are still developing one.
34%
regularly audit for unsanctioned AI
IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025
According to IBM's Cost of a Data Breach Report 2025, only 34% of organizations with AI governance policies perform regular audits for unsanctioned AI.
37%
have policies to manage AI or detect shadow AI
IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025
According to IBM's Cost of a Data Breach Report 2025, only 37% of organizations studied have policies to manage AI or detect shadow AI.
24%
say their employer requires AI training
TELUS Digital, AI at Work survey (shadow AI)
According to a TELUS Digital survey, only 24% of enterprise employees who use AI assistants say their company requires mandatory AI assistant training.
69%
of orgs suspect employees use prohibited GenAI
According to a Gartner survey of 302 cybersecurity leaders, 69% of organizations suspect or have evidence that employees are using prohibited public GenAI.
2 in 5
employees say there's a GenAI policy at work
According to the University of Melbourne and KPMG's 2025 global study, only two in five employees say their organization has a policy guiding generative AI use.
67%
upload sensitive data where GenAI is banned
According to the University of Melbourne and KPMG's 2025 global study, uploading sensitive data to public AI was most common at organizations that had banned generative AI (67%), versus 33% where there was no policy.
41%
of employees work around blocked AI apps
According to UpGuard's State of Shadow AI report, 41% of employees find a way around blocked AI applications.
90%
of IT leaders worry about shadow AI
Komprise, Komprise IT Survey: AI, Data & Enterprise Risk
According to Komprise's 2025 IT survey, 90% of IT leaders are concerned about shadow AI from a privacy and security standpoint, and 46% are extremely worried.
22%
say their employer has a clear AI plan
Gallup, AI Use at Work Has Nearly Doubled in Two Years
According to Gallup, 44% of US employees say their organization has begun integrating AI, but only 22% say it has communicated a clear plan or strategy for doing so.
30%
say their employer has AI guidelines or policies
Gallup, AI Use at Work Has Nearly Doubled in Two Years
According to Gallup, only 30% of US employees say their organization has general guidelines or formal policies for using AI at work.
39%
of AI users got AI training from their employer
Microsoft and LinkedIn, 2024 Work Trend Index Annual Report
According to Microsoft and LinkedIn's 2024 Work Trend Index, only 39% of AI users have received AI training from their company.
60%
of leaders say their company lacks an AI plan
Microsoft and LinkedIn, 2024 Work Trend Index Annual Report
According to Microsoft and LinkedIn's 2024 Work Trend Index, 60% of leaders say their company lacks a vision and plan to implement AI.
27%
of organizations banned GenAI at least temporarily
Cisco, 2024 Data Privacy Benchmark Study
According to Cisco's 2024 Data Privacy Benchmark Study, 27% of organizations had banned the use of generative AI, at least temporarily, over privacy and data security risks.
1 in 5
breached organizations hit via shadow AI
IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025
According to IBM's Cost of a Data Breach Report 2025, one in five organizations studied reported a breach due to shadow AI.
$670K
higher breach cost with high shadow AI
IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025
According to IBM's Cost of a Data Breach Report 2025, organizations with high levels of shadow AI saw an average of $670,000 in higher breach costs.
78%
had confirmed or suspected AI-related incidents
Check Point Software, 2026 Cloud Security Report: Enter the AI Era
According to Check Point's 2026 Cloud Security Report, 78% of organizations reported confirmed or suspected AI-related security incidents over the past year.
92%
of AI-breached orgs lacked proper access controls
IBM, Cost of a Data Breach Report 2026
92% of organizations that reported an AI-related breach lacked proper AI access controls, according to IBM's 2026 Cost of a Data Breach Report.
13%
of organizations had AI models or apps breached
IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025
According to IBM's Cost of a Data Breach Report 2025, 13% of organizations reported breaches of AI models or applications.
60%
of AI-related incidents compromised data
IBM (research by Ponemon Institute), Cost of a Data Breach Report 2025
According to IBM's Cost of a Data Breach Report 2025, 60% of AI-related security incidents led to compromised data.
40%+
of enterprises will have shadow AI incidents by 2030
Gartner predicts that by 2030 more than 40% of enterprises will experience security or compliance incidents linked to unauthorized shadow AI.
79%
of orgs had negative outcomes from employee GenAI use
Komprise, Komprise IT Survey: AI, Data & Enterprise Risk
According to Komprise's 2025 IT survey, nearly 80% of IT leaders say their organization has experienced negative outcomes from employee use of generative AI, including 44% citing sensitive data leaking into AI.
Spend & pricing · 47 stats
SaaS prices keep climbing, and more contracts now bill on usage instead of seats.
$9,100
SaaS cost per employee (end of 2025)
Vertice, SaaS Inflation Index 2026
According to Vertice, SaaS costs per employee reached about $9,100 by the end of 2025, up from $8,700 in 2024 and $7,900 in 2023.
1 in 8
dollars of company spend go to SaaS
Vertice, SaaS Inflation Index 2026
One dollar in every eight a typical organization spends now goes to SaaS, according to Vertice's SaaS Inflation Index 2026.
74%
of software spend goes to the top 10 vendors
Tropic, The State of Software Procurement in 2026
A company's top 10 software vendors account for roughly 74% of its tracked software spend, a share that hasn't moved in three years, according to Tropic.
58%
YoY software spend growth, mid-market/enterprise
Tropic, 2026 Software and AI Pricing Trends
Mid-market and enterprise companies grew software spend nearly 58% year over year, and SMB/growth companies 50%, according to Tropic.
$1.44T
worldwide software spending forecast for 2026
Gartner (reported by eeNews Europe), Worldwide IT Spending Forecast, April 2026
Gartner forecasts worldwide software spending will grow 15.1% to $1.44 trillion in 2026, with generative AI playing a major role.
$234B
of app software spend at risk from AI agents by 2030
Gartner (reported by CIO), Gartner press release, July 1, 2026
Gartner estimates up to $234 billion in enterprise application software spending, about 20% of enterprise SaaS spend, is at risk from AI agents by 2030.
$6.31T
worldwide IT spending forecast for 2026
Gartner, Gartner Forecasts Worldwide IT Spending to Grow 13.5% in 2026, Totaling $6.31 Trillion
Gartner forecasts worldwide IT spending will reach $6.31 trillion in 2026, up 13.5% from 2025.
12.5%
of total organizational spend goes to software
Vertice, Key SaaS inflation stats: How to mitigate in 2025
Software accounts for an average of 12.5% of total organizational spending, according to Vertice.
10%
rise in software spending in 2024
Tropic, 2025 Software Buying Trends for Effective Spend Management
Software spending rose 10% in 2024 as vendors added AI features that raised costs, according to Tropic's analysis of $11B in corporate spend.
$21M
average annual software spend, 1,000-10,000 employees
Tropic, 2025 Software Buying Trends for Effective Spend Management
Companies with 1,000 to 10,000 employees spend an average of $21 million a year on software, against $1.9 million for small businesses, according to Tropic.
$14,000
software spend per employee, mid-market
Tropic, 2025 Software Buying Trends (blog summary)
Mid-market companies spend about $14,000 per employee on software, more than enterprises ($9,000), while growth-stage companies spend the most at $17,000, according to Tropic.
29% → 41%
of IT budget on cloud, SaaS and GenAI
Capgemini Research Institute, On-Demand Tech (FinOps) report
The share of IT budgets going to on-demand technology (cloud, SaaS and GenAI) is expected to rise from 29% to 41% within a year, according to Capgemini.
35%
of point-product SaaS tools replaced by AI agents by 2030
Gartner (quoted by Deloitte Insights), Deloitte TMT Predictions 2026: SaaS meets AI agents
Gartner predicts that by 2030, 35% of point-product SaaS tools will be replaced by AI agents or absorbed into the agent ecosystems of major SaaS providers.
73%
say SaaS and cloud costs have risen
Flexera, Flexera IT Priorities Report (2026 strategy)
73% of IT leaders say their SaaS and cloud infrastructure costs have risen, according to Flexera's 2026 IT Priorities report.
$8,000
software spend per employee at startups (0-20 staff)
Cledara, The 2025 Software Spend Report
Startups with up to 20 staff spend about $8,000 per employee on software, while companies with 100-200 staff spend $1,741, according to Cledara.
$121,336
annual software spend, companies with 0-20 staff
Cledara, The 2025 Software Spend Report
Even the smallest companies (0-20 employees) spend an average of $121,336 a year on software, according to Cledara.
~$300B
worldwide SaaS spending forecast for 2025
Gartner (reported by CIO Dive), Public cloud end-user spending forecast, Nov 2024
Gartner forecast that worldwide end-user spending on SaaS would approach $300 billion in 2025, up from just over $250 billion in 2024.
16.4%
SaaS inflation in June 2026, a record high
Vertice, SaaS Inflation Rate (SaaS Inflation Index)
SaaS prices rose at a record 16.4% annual rate in June 2026, almost 4x US consumer inflation, according to Vertice's SaaS Inflation Index.
60%
of SaaS vendors mask price rises
Vertice, SaaS Inflation Index 2026
60% of SaaS vendors deliberately mask their price increases, according to Vertice.
20-37%
AI-linked renewal uplift asks (vs 3-9% typical)
Tropic, The State of Software Procurement in 2026
Software vendors are opening renewal talks with AI-linked price increases of 20-37%, against a typical 3-9% SaaS uplift, according to Tropic's 2026 data.
9%
of IT budget set aside for price increases
Gartner (reported by CIO Dive), Gartner GenAI spending forecast briefing
CIOs are setting aside 9% of their IT budgets just to cover price increases on existing services, according to Gartner research reported by CIO Dive.
+4.3 pts
SaaS inflation rise in two months
Vertice, SaaS Inflation Rate (SaaS Inflation Index)
SaaS inflation jumped 4.3 percentage points in two months in spring 2026, the fastest increase Vertice has recorded.
27%
of SaaS vendors use shrinkflation
Vertice, SaaS shrinkflation (Insights Hub)
27% of SaaS vendors use 'shrinkflation', cutting features or service levels while holding or raising prices, according to Vertice.
8-12%
typical annual SaaS vendor price increase
Cledara, SaaS Renewal Benchmarks 2026
SaaS vendors are raising prices 8% to 12% a year, with aggressive vendors hitting 15% to 25%, according to Cledara's renewal benchmarks.
11.4%
SaaS price increase, Jan 2024 to Jan 2025
Vertice, SaaS Inflation Stats: How to Mitigate in 2025
As of January 2025, SaaS prices were up 11.4% year over year, against 2.7% average inflation across G7 countries, according to Vertice.
33%
of vendors can raise prices at renewal by contract
Vertice, SaaS Inflation Stats: How to Mitigate in 2025
Vertice found that 33% of software vendors include contract wording that allows them to raise prices at renewal.
6%
Salesforce average list price increase, Aug 2025
Salesforce, Salesforce pricing update announcement
Salesforce raised list prices by an average of 6% on August 1, 2025 for Enterprise and Unlimited Editions of Sales Cloud, Service Cloud, Field Service and select Industries Clouds.
20%
Slack Business+ price increase
CIO Dive (reporting Salesforce/Slack announcement), Salesforce preps price hike amid AI blitz
Slack raised its Business+ plan 20% to $15 per user per month for annual billing in June 2025, as part of Salesforce's AI-driven pricing changes.
up to 10%
Atlassian cloud price increase, Oct 2025
Atlassian Investor Relations, Notice of FY26 Cloud Pricing Changes from Atlassian
Atlassian raised cloud list prices on October 15, 2025: 5% for Standard, 7.5% for Premium and 7.5% to 10% for Enterprise editions of Jira, Confluence and Jira Service Management, with Bitbucket up 10%.
$12 to $14
Workspace Business Standard price per user
9to5Google (reporting Google announcement), Google Workspace details 2025 Gemini price increase
Google raised Workspace Business Standard from $12 to $14 per user per month on annual plans in 2025 as it bundled Gemini AI into all Business plans, a roughly 17% increase.
37%
of software vendors plan to reprice for AI
ICONIQ, 2025 State of AI: The Builder's Playbook
ICONIQ found that while many software companies include AI features for free today, 37% plan to change their pricing in the next year to reflect AI value and usage.
+8%
Microsoft 365 E3 list price increase (July 2026)
Microsoft, Microsoft 365 packaging and pricing updates (effective July 1, 2026)
Microsoft is raising Microsoft 365 E3 from $36 to $39 per user per month (8%) and Office 365 E3 from $23 to $26 (13%) on July 1, 2026, alongside new AI capabilities in the suites.
+$2
per user per month added to Workspace for bundled Gemini
Google, Google Workspace enables the future of AI-powered work for every business (Workspace blog)
When Google bundled Gemini into Workspace in January 2025, Business Standard rose to $14 per user per month, $2 (about 17%) more than the plan cost without Gemini.
+$3/mo
first Microsoft 365 consumer price rise, with Copilot
Microsoft, Copilot is now included in Microsoft 365 Personal and Family (Microsoft 365 blog)
Microsoft raised U.S. Microsoft 365 Personal and Family prices by $3 per month in January 2025, the first increase since launch, when it bundled Copilot into the plans.
73%
of software vendors raised prices in 2023
Vertice, SaaS Inflation Index (press release)
Vertice's SaaS Inflation Index found that 73% of software vendors raised their prices in 2023, and SaaS inflation ran at 8.7%, more than double US CPI.
9%
Salesforce average list price increase, 2023
CFO Dive (reporting Salesforce announcement), Escalating SaaS prices outpace CPI inflation
Salesforce raised list prices by an average of 9% across several offerings in 2023, its first list price increase in seven years.
37.6%
monthly budget variance on consumption-priced tools
Vertice, Vertice Insights: Budget variance rates - consumption vs seat pricing
Consumption-priced SaaS tools show a 37.6% average monthly budget variance, versus 4.1% for seat-based tools, according to Vertice.
36.5%
of SaaS contracts now priced per usage
Vertice, Vertice Insights: SaaS pricing models
Per-usage pricing became the single most common SaaS pricing model in Q2 2026 at 36.5% of contracts, overtaking per-user pricing at 32.4%, according to Vertice.
1 in 3+
AI tools billed purely on usage or tokens
BetterCloud, 2026 State of SaaS
More than a third of the AI tools in today's tech stacks are billed only on usage or token consumption, not per seat, according to BetterCloud.
22.6%
cost increase, seat to consumption pricing switch
Vertice, Vertice Insights: Consumption pricing - contract cost changes
When a SaaS vendor moves a customer from seat-based to consumption pricing, contract costs rise 22.6% on average, according to Vertice.
37%
higher cost per user under consumption pricing
Vertice, Vertice Insights: Consumption pricing - cost-per-user vs seat-based
Pure consumption pricing drives the effective cost per user up by as much as 37%, and hybrid models by 21% on average, compared with seat-based pricing, Vertice reports.
82%
expect per-seat SaaS pricing to fade within five years
EY US, EY US AI Pulse Survey (fifth wave)
82% of senior leaders at organizations investing in AI expect traditional per-seat SaaS pricing to become less relevant in their industry within five years, according to EY's US AI Pulse Survey.
85%
of software companies use usage-based pricing
Metronome, State of Usage-Based Pricing 2025
A January 2025 survey of 100 SaaS companies by Metronome and Greyhound Capital found 85% have adopted usage-based pricing.
78%
adopted usage-based pricing in last 5 years
Metronome, State of Usage-Based Pricing 2025
78% of software companies with usage-based pricing adopted it within the last five years, and nearly half within the last two, Metronome found.
41%
of software companies now use hybrid pricing
Growth Unhinged (Kyle Poyar), 2025 State of B2B Monetization
Hybrid pricing rose from 27% to 41% of software companies in a year while pure seat-based pricing fell from 21% to 15%, according to Growth Unhinged's 2025 State of B2B Monetization survey.
25%
expect outcome-based pricing by 2028
Growth Unhinged (Kyle Poyar), 2025 State of B2B Monetization
Only 5% of software companies use outcome-based pricing as their primary model today, but 25% expect to by 2028, per Growth Unhinged's 2025 State of B2B Monetization survey.
3 in 4
software companies changed pricing last year
Growth Unhinged (Kyle Poyar), 2025 State of B2B Monetization
Three in four software companies changed their pricing in the past year, according to Growth Unhinged's 2025 State of B2B Monetization survey.
Waste & renewals · 53 stats
Many licenses sit idle, and most contracts renew without anyone taking a second look.
Source: Torii, SaaS Benchmark Annual Report 2026, "License Utilization Audit" chart.
See the full chart in the benchmark reportSource: Torii, SaaS Benchmark Annual Report 2026, "Account Decay by Application" chart.
See the full chart in the benchmark report65%
of SaaS licenses unused or underutilized
Vertice, Vertice Insights: Unused SaaS applications
According to Vertice, 65% of all SaaS licenses were either entirely unused or underutilized as of Q2 2026, up from 62% a year earlier.
55%
of Salesforce licenses go unused
Torii, SaaS Benchmark Annual Report 2026
Salesforce tops Torii's License Utilization Audit with a 55% non-utilization rate, followed by PagerDuty (45%) and monday.com (40%), according to Torii's 2026 SaaS Benchmark.
62.1%
of Crunchbase licenses idle 90+ days
Torii, SaaS Benchmark Annual Report 2026
62.1% of active Crunchbase licenses had no activity in over 90 days, the highest account decay rate in Torii's 2026 SaaS Benchmark.
14%
of SaaS licenses completely unused
Vertice, Vertice Insights: Unused SaaS applications
As of Q2 2026, Vertice's spend data shows 14% of SaaS licenses are fully unused and a further 51% are underutilized (under half of purchased seats in use), so over half of all licenses sit in the underused bucket.
$18.9M
wasted yearly on unused software per large enterprise
Vertice, Vertice Insights: Wasted SaaS spend
Vertice estimates that enterprises with 10,000+ employees waste $18.9M a year on unused and underutilized software, roughly 10 times what a 1,000 to 2,500-employee company wastes.
$1.75M
yearly SaaS waste at 500-1,000 employee companies
Vertice, Vertice Insights: Wasted SaaS spend
Vertice found that wasted software spend ranges from $1.75M a year at companies with 500 to 1,000 employees up to $18.9M at enterprises with 10,000+ employees.
29%
of cloud spend estimated wasted
Flexera, 2026 State of the Cloud Report
Estimated wasted cloud spend rose to 29% in 2026, the first increase in five years, driven by AI workloads, according to Flexera's 2026 State of the Cloud Report.
25%
SaaS overspend without centralized management
Gartner (via USU reprint), 2026 Gartner Magic Quadrant for SaaS Management Platforms
Gartner predicts that through 2028, organizations that fail to attain centralized visibility and coordinate SaaS life cycles will overspend on SaaS by at least 25%, due to unused entitlements and overlapping tools.
52%
of large organizations overspent on SaaS
Capgemini Research Institute, On-Demand Tech (FinOps) report
52% of large organizations overspent their SaaS budgets, according to Capgemini Research Institute.
$1 in $5
of software spend wasted to complexity
Freshworks, The Cost of Complexity Report
Companies waste $1 of every $5 spent on software to failed implementations, underused tools and unexpected costs, according to Freshworks' 2025 Cost of Complexity report.
35%
say SaaS waste increased over the past year
Flexera, 2025 State of ITAM Report
35% of IT asset management professionals say SaaS waste increased over the past year, according to Flexera's 2025 State of ITAM Report.
31%
of organizations don't track unused software licenses
Ivanti, 2025 Technology at Work Report
Nearly one in three IT professionals (31%) say their organizations do not track unused or underused software licenses, according to Ivanti's 2025 Technology at Work report.
58%
of IT pros say wasteful IT spend is a problem
Ivanti, 2025 Technology at Work Report
58% of IT professionals say wasteful IT spending is a problem in their organization, and 21% call it a major problem, according to Ivanti.
17%
of midsize IT leaders waste half or more of software/SaaS budget
Block 64, Block 64 Market Survey
33% of midsized-enterprise IT leaders estimate they waste 10% of their IT budget on underused software and SaaS licenses, 46% say 25%, and 17% say half or more, according to a Block 64 survey.
$135K+
wasted on unused licenses per company
BetterCloud, State of SaaSOps 2024
Companies waste more than $135,000 a year on unused software licenses on average, according to BetterCloud.
45%
believe they overspend on software
Cledara, The 2025 Software Spend Report
45% of companies believe they are overspending on software, according to Cledara's 2025 Software Spend Report.
48%
of software spend wasted at 200+ staff companies
Cledara, The 2025 Software Spend Report
Companies with more than 200 staff waste 48% of their software spend, according to Cledara.
20%
of SaaS spend self-estimated as wasted
Flexera, 2024 State of ITAM Report
Even advanced IT asset management practitioners self-estimate that 20% of SaaS spend is wasted, alongside 30% of desktop software spend, according to Flexera's 2024 State of ITAM Report.
25%
of provisioned SaaS licenses not regularly used
Gartner (reproduced by Viio), Magic Quadrant for SaaS Management Platforms 2024 (Market Overview)
Gartner estimates that as many as 25% of provisioned SaaS licenses are not regularly used by employees.
20-25%
estimated overspend across cloud, software, SaaS and hardware
Flexera, 2025 IT Priorities Report
IT leaders estimate they overspend by around 20-25% across cloud, software, SaaS and hardware, according to Flexera's 2025 IT Priorities Report.
32%
of SaaS spend underutilized or wasted
Flexera, 2023 State of ITAM Report
Respondents to Flexera's 2023 State of ITAM Report estimated 32% of SaaS spend was underutilized or wasted.
49.96%
of installed software unused by employees
Nexthink, Soft-WASTE: How Much Does IT Waste on Unused Software Licenses?
Nexthink found that half (49.96%) of all installed software went unused by employees, costing businesses about $45M per month across 30+ popular tools.
35%
regret software that cost more than expected
Capterra (Gartner Digital Markets), 2024 U.S. Tech Trends Report
The number-one product-related reason for software purchase regret is the software being more expensive than expected, cited by 35% of regretful US buyers, according to Capterra.
72.3%
of SaaS contracts auto-renew
Vertice, Vertice Insights: Contracts containing auto-renewal clauses by category
As of Q2 2026, 72.3% of SaaS contracts auto-renew on average, up from 60.6% one quarter earlier, according to Vertice.
72%
of tail-spend contracts renew with no review
Vertice, Vertice Insights: Renewals triggered without review
In Q2 2026, 72% of tail-spend software contracts renewed without any review, compared with 14.1% of larger contracts, according to Vertice.
23.3%
more saved by negotiating 120+ days early
Vertice, Vertice Insights: Renewal savings vs. negotiation time
Organizations that begin negotiating 120+ days before a SaaS contract expires save an average of 23.3% more than those who wait until the final month, according to Vertice.
40%
still track SaaS renewals manually
BetterCloud, 2025 State of SaaS
40% of organizations still track SaaS renewals manually, according to BetterCloud's 2025 State of SaaS report.
39%
savings when renewal prep starts 6 months out
Tropic, The State of Software Procurement in 2026
Companies that start renewal prep six months out save up to 39% on average, compared with 14% at 30 days, according to Tropic.
96.1%
of CRM contracts auto-renew
Vertice, Vertice Insights: Contracts containing auto-renewal clauses by category
Vertice data shows 96.1% of CRM contracts now auto-renew, the highest of any software category.
31.9%
average discount on short-term contracts
Tropic, 2026 Software and AI Pricing Trends Report
Tropic found the deepest software discounts came from short-term contracts (31.9%), while 12 to 24-month deals averaged 26.3%.
49%
savings when negotiating 90 days before renewal
Cledara, SaaS Renewal Benchmarks 2026
Cledara found that companies starting renewal negotiations 90 days ahead achieved average savings of 49%, compared with 19% when they started 30 to 90 days out.
45%
say price hikes are their top renewal frustration
Spendflo, State of SaaS Procurement 2025
45% of leaders name price hikes as their top frustration at SaaS renewal time, and 30% say they miss contract alerts and get auto-renewed, according to Spendflo.
14.2 months
average software contract length
Tropic, 2025 Software Buying Trends
The average software contract length rose to 14.2 months in 2024, a 6% increase from the year before, according to Tropic.
200-600
software renewals handled per company each year
Tropic, Tropic product press release (Purchase Prep Assistant)
Tropic says the average company handles between 200 and 600 software renewals a year, more than one every business day in most cases.
18%
of renewals signed as multi-year deals
Vendr, The SaaS Trends Report Q3 2023
Multi-year commitments made up just 18% of software renewal transactions on Vendr's platform in 2023, as multi-year renewals fell 28% compared with 2021, according to Vendr.
33.8%
average negotiated discount off list price
Vertice, Vertice Insights: Average discount from list price
Companies using pricing benchmarks secured an average discount of 33.8% off list price on SaaS contracts, according to Vertice.
3x
price gap between worst and best deals
Vertice, Vertice Insights: SaaS benchmark prices deviation
Vertice's benchmarks show a poorly negotiated deal in categories like CRM, ERP and project management can cost up to three times what a well-negotiated one does for comparable software.
~12%
average final AI uplift after negotiation
Tropic, 2026 Software and AI Pricing Trends Report
Negotiation cut AI-driven renewal price asks by about 55% on average, but final uplifts still averaged around 12%, according to Tropic.
29%
achieved expected SaaS cost savings
Capgemini Research Institute, On-Demand Tech (FinOps) report
Only 29% of large organizations achieved the SaaS cost savings they expected, according to Capgemini Research Institute.
20%
drop in average contract value in 2024
Vendr, Vendr SaaS Trends Report 2025 (Plus 2024 Year-in Review)
Vendr reported that average contract values fell 20%, from $50,000 to $40,000, during 2024 as buyers rightsized at renewal in what it called the 'Year of the Descope'.
56%
are rightsizing contracts and subscriptions
Flexera, 2025 State of ITAM Report
56% of organizations are rightsizing contracts and subscriptions and 59% are actively tracking usage to cut SaaS costs, Flexera's 2025 State of ITAM Report found.
63%
cite unused apps or budget as consolidation driver
BetterCloud, 2025 State of SaaS (as summarized on BetterCloud's SaaS statistics page)
63% of IT teams say too many unused or underutilized SaaS apps and licenses, or budget pressure, are driving app consolidation, per BetterCloud's 2025 State of SaaS report.
45%
saved by reusing licenses instead of buying
Flexera, 2024 State of ITAM Report
Reusing licenses instead of buying new ones (non-cloud) was the top way SAM teams achieved significant savings in the past year, cited by 45%, ahead of better vendor negotiation at 37%, per Flexera's 2024 State of ITAM Report.
16.49%
average savings on negotiated software deals
Vendr, SaaS statistics: trends, data and insights (updated 2023)
Vendr's analysis of more than 20,000 software deals found negotiation saved buyers 16.49% on average, a total of $349 million.
55%
saved $1M+ a year through SAM
Flexera, 2023 State of ITAM Report
55% of organizations saved more than $1 million through software asset management in a year, and 16% saved more than $10 million, according to Flexera's 2023 State of ITAM Report.
48%
were hit by a software audit last year
Flexera, 2026 State of ITAM Report
Nearly half (48%) of organizations were audited by a software vendor in the last year, according to Flexera's 2026 State of ITAM Report.
38%
of respondents report Oracle audits
Flexera, 2026 State of ITAM Report
Respondents reporting Oracle audit activity rose to 38% from 24% a year earlier, and Adobe from 24% to 32%, according to Flexera's 2026 State of ITAM Report.
22%
of ITAM team time spent on audit response
Flexera, 2026 State of ITAM Report
IT asset management teams spend 32% of their time on software optimization and another 22% responding to audits, according to Flexera's 2026 State of ITAM Report.
44%
spent over $1M on software audits in three years
Flexera, 2026 State of ITAM Report
44% of organizations spent more than $1 million on software audits over the past three years, according to Flexera's 2026 State of ITAM Report.
45%
spent over $1M on software audits in 3 years
Flexera, 2025 State of ITAM Report
45% of organizations spent more than $1 million on software audits over the past three years, according to Flexera's 2025 State of ITAM Report.
50%
were audited by Microsoft in 3 years
Flexera, 2025 State of ITAM Report
Half of organizations say Microsoft audited them in the past three years, followed by IBM at 37% and SAP at 32%, per Flexera's 2025 State of ITAM Report.
23%
of software producers call license overuse a major problem
Revenera, Monetization Monitor 2026 Outlook
23% of software producers report customer license overuse (unintentional or otherwise) as a major problem and another 47% as a moderate concern, according to Revenera's Monetization Monitor 2026 Outlook.
22%
paid $5M+ in audit costs over 3 years
Flexera, 2024 State of ITAM Report
22% of IT leaders paid more than $5 million in software audit costs over three years, up from 15% the previous year, according to Flexera's 2024 State of ITAM Report.
AI spend · 78 stats
AI budgets are climbing fast, the bills are hard to forecast, and the returns are still arriving.
Source: Torii, SaaS Benchmark Annual Report 2026, "Overage Frequency" chart.
See the full chart in the benchmark reportSource: Torii, SaaS Benchmark Annual Report 2026, "Overage Intensity" chart.
See the full chart in the benchmark report$37B
enterprise generative AI spend in 2025
Menlo Ventures, 2025: The State of Generative AI in the Enterprise
According to Menlo Ventures, enterprise generative AI spend reached $37B in 2025, up from $1.7B in 2023, and now equals 6% of the global SaaS market.
$11.95
median AI spend per employee per month
Ramp (Ramp Economics Lab), Ramp AI Index, August 2026 update
Ramp's spend data shows the median U.S. business spent $11.95 per employee on AI in July 2026, while the top 1% spent a median $7,400 per employee.
94% vs 8%
YoY spend growth, AI-native vs traditional SaaS
Tropic, 2026 Software and AI Pricing Trends
For mid-market and enterprise companies, spend on AI-native software grew 94% year over year while spend on traditional SaaS grew just 8%, according to Tropic.
4.8%
of software budgets go to AI-native vendors
Tropic, AI Spending and Pricing Trends H1 2026
AI-native vendors took 4.8% of the average software budget in July 2026, more than double the 2.3% share in January 2025, according to Tropic.
$2.7T
worldwide AI spending forecast for 2026
Gartner, Press release: Gartner Forecasts Worldwide AI Spending to Grow 49.5% in 2026
Gartner forecasts worldwide AI spending will total $2.7 trillion in 2026, a 49.5% increase over 2025.
$207M
average planned AI spend over next 12 months ($1B+ firms)
KPMG US, AI Quarterly Pulse Survey, Q1 2026
According to KPMG's Q1 2026 AI Quarterly Pulse, large U.S. organizations plan to spend an average of $207 million on AI over the next 12 months, nearly double a year earlier.
1.7%
of revenue companies plan to spend on AI in 2026
BCG's AI Radar 2026 found companies plan to double AI spending in 2026 to about 1.7% of revenues, drawing on budgets beyond the tech pool.
94%
of CEOs will keep investing even without payoff
BCG found 94% of CEOs will keep investing in AI at current or higher levels even if the investments don't pay off in the next year.
$2,068
expected AI spend per employee in 2026
Atlanta Fed survey data show U.S. firms spent $1,358 per employee on AI in 2025 and expect to spend $2,068 per employee in 2026, about a 50% increase.
14x
AI spend gap: top 10% of firms vs the median
According to the Atlanta Fed, more than half of firms expect to spend no more than $200 per employee on AI in 2026, while the top 10% plan at least $2,800, a 14-fold gap.
~75%
expected growth in enterprise LLM budgets next year
Andreessen Horowitz (a16z), How 100 Enterprise CIOs Are Building and Buying Gen AI in 2025
According to a16z's 2025 survey of 100 enterprise CIOs, LLM budgets are expected to grow about 75% over the next year.
7%
of LLM spend still from innovation budgets
Andreessen Horowitz (a16z), How 100 Enterprise CIOs Are Building and Buying Gen AI in 2025
a16z found that innovation budgets fell from a quarter of enterprise LLM spending to just 7% in 2025, as AI moved into centralized IT and business-unit budgets.
$85,521
average monthly AI spend expected in 2025
CloudZero, The State Of AI Costs In 2025
CloudZero's State of AI Costs survey found average monthly AI spend of $62,964 in 2024, rising to an expected $85,521 in 2025, a 36% increase.
45%
plan to spend $100K+ per month on AI
CloudZero, The State Of AI Costs In 2025
According to CloudZero, the share of organizations planning to spend over $100,000 a month on AI tools more than doubled, from 20% in 2024 to 45% in 2025.
91%
plan to increase AI investment again
Deloitte, AI ROI: The paradox of rising investment and elusive returns
Deloitte found 85% of organizations increased AI investment in the past 12 months and 91% plan to increase it again.
36%
of digital initiative budgets go to AI
Deloitte, Tech value survey 2025 (AI and tech investment ROI)
According to Deloitte's 2025 Tech Value Survey, organizations now allocate an average of 36% of their digital initiative budgets to AI automation.
42% vs 18%
above-average profitability with vs without CFO authority
Deloitte, C-suite leadership and AI returns (Tech Value Survey analysis)
Deloitte found that when the CFO had full decision-making authority over digital investments, 42% of organizations achieved above-average profitability, versus 18% where the CFO had none.
27% to 52%
spending a quarter+ of IT budget on AI, now vs next year
EY, EY US AI Pulse Survey, wave 4 (press release)
EY found 27% of organizations investing in AI commit a quarter or more of their IT budget to AI today, a share set to nearly double to 52% next year.
10-20%
of R&D budgets going to AI development
ICONIQ, 2025 State of AI: The Builder's Playbook
ICONIQ's 2025 State of AI report found AI-enabled software companies allocate 10-20% of R&D budgets to AI development, a share growing in every revenue band.
446%
12-month growth in AI spend (vs 36% for SaaS)
Cledara, The 2025 Software Spend Report
AI spending grew 446% over 12 months, compared with 36% growth in overall SaaS spending, according to Cledara's transaction data.
60%
of 2024 GenAI spend came from innovation budgets
Menlo Ventures, 2024: The State of Generative AI in the Enterprise
In 2024, Menlo Ventures found that 60% of enterprise generative AI spend came from innovation budgets rather than permanent budget lines.
43.8%
of U.S. businesses paying Anthropic (vs 39.8% OpenAI)
Ramp (Ramp Economics Lab), Ramp AI Index, September 2026 update
According to the Ramp AI Index, 43.8% of U.S. businesses paid for Anthropic subscriptions or tokens in August 2026, ahead of OpenAI at 39.8%.
37%
of enterprises use 5+ AI models
Andreessen Horowitz (a16z), How 100 Enterprise CIOs Are Building and Buying Gen AI in 2025
According to a16z, 37% of enterprises now use five or more AI models, up from 29% a year earlier.
3.6%
of businesses use open-source AI models
Ramp (Ramp Economics Lab), Ramp AI Index, September 2026 update
According to Ramp, only 6.4% of AI-spending businesses (3.6% of all businesses) use open-source models.
50.4%
of businesses now pay for AI services
Ramp, Spring 2026 Business Spending Report
Ramp's Spring 2026 spending report found that more than half of businesses (50.4%) now pay for AI services, and Anthropic's share of paid AI customers jumped from 16.7% to 30.6% in one quarter.
2.4
AI coding tools in use at once, on average
Mavvrik and Benchmarkit, 2026 State of AI Cost Governance Report
Mavvrik found engineering organizations run an average of 2.4 AI coding tools at once, 39% report coding-tool costs above expected license or usage, and only 42% include developer AI tools in AI cost reporting.
30%+
of AI investment committed to agentic AI
According to BCG, CEOs have committed more than 30% of their organizations' 2026 AI investment to agentic AI.
88%
of organizations use AI; agent use still single digits
Stanford HAI, AI Index Report 2026, Economy chapter
Stanford's 2026 AI Index reports organizational AI adoption rose to 88% of surveyed organizations in 2025, but AI agent deployment was still in the single digits across nearly all business functions.
12%
of knowledge workers using agentic AI by 2030
Goldman Sachs Research, AI Agents Forecast to Boost Tech Cash Flow as Usage Soars
Goldman Sachs Research forecasts only 12% of knowledge workers will use agentic AI by 2030, rising to 37% by 2040.
76%
of enterprise AI solutions bought, not built
Menlo Ventures, 2025: The State of Generative AI in the Enterprise
Menlo Ventures found that 76% of enterprise AI use cases are now purchased rather than built internally, up from 53% purchased in 2024.
40%
Anthropic's share of enterprise LLM API spend
Menlo Ventures, 2025: The State of Generative AI in the Enterprise
According to Menlo Ventures, Anthropic holds 40% of enterprise LLM API market share in 2025, versus 27% for OpenAI.
16%
of enterprise AI deployments are true agents
Menlo Ventures, 2025: The State of Generative AI in the Enterprise
Menlo Ventures found that only 16% of enterprise AI deployments (and 27% of startup deployments) qualify as true agents.
60%
of the top 50 AI apps by spend are horizontal tools
a16z and Mercury's ranking of the top 50 AI apps by actual startup spend found horizontal tools make up 60% of the list, led by #1 OpenAI and #2 Anthropic.
67%
deployment rate for bought AI tools (vs 33% built)
MIT NANDA (Project NANDA, MIT Media Lab), The GenAI Divide: State of AI in Business 2025
MIT NANDA found that AI tools bought from external partners reached deployment about 67% of the time, versus about 33% for internally built tools.
50%
of GenAI budgets flow to sales and marketing
MIT NANDA (Project NANDA, MIT Media Lab), The GenAI Divide: State of AI in Business 2025
MIT NANDA estimates about 50% of generative AI budgets go to sales and marketing, even though back-office automation often delivers better ROI.
50%
of CEOs say AI investment left disconnected tech
IBM Institute for Business Value, 2025 CEO Study (press release)
IBM found half of CEOs say rapid AI investment has left their organization with disconnected, piecemeal technology.
2.8
AI models used per company for customer-facing products
ICONIQ, 2025 State of AI: The Builder's Playbook
According to ICONIQ, software companies use an average of 2.8 AI models for customer-facing products.
3+
foundation models in a typical enterprise AI stack
Menlo Ventures, 2024: The State of Generative AI in the Enterprise
Menlo Ventures found that organizations typically deploy three or more foundation models, routing between them by use case.
1%
of enterprise AI buyers cited price as a concern
Menlo Ventures, 2024: The State of Generative AI in the Enterprise
Menlo Ventures found that just 1% of enterprise leaders named price as a selection concern when choosing generative AI tools.
35.4%
overage frequency for ChatGPT
Torii, SaaS Benchmark Annual Report 2026
ChatGPT exceeds its contracted ceiling 35.4% of the time with a median overage of 13.0%, according to Torii's 2026 SaaS Benchmark.
Majority
of chronic contract overages are AI apps
Torii, SaaS Benchmark Annual Report 2026
The majority of applications that consistently exceed their contracted ceilings are AI-powered, according to Torii's 2026 SaaS Benchmark.
11%
can forecast AI costs within ±10%
Mavvrik and Benchmarkit, 2026 State of AI Cost Governance Report
Mavvrik's 2026 State of AI Cost Governance report found only 11% of organizations can forecast AI costs within ±10%, down from 15% in 2025.
80%
of enterprises miss AI cost forecasts by 25%+
Mavvrik and Benchmarkit, 2025 State of AI Cost Management (State of AI Cost Governance)
According to Mavvrik and Benchmarkit, 80% of enterprises miss their AI infrastructure cost forecasts by more than 25%, and 24% are off by 50% or more.
20.5%
median overage for Cursor
Torii, SaaS Benchmark Annual Report 2026
Cursor AI runs a median 20.5% over contract when it overages, the highest intensity in Torii's 2026 SaaS Benchmark.
59%
say wasted AI spend rose this year
Flexera, 2026 State of ITAM Report
59% of IT asset managers say wasted AI spend increased year over year, according to Flexera's 2026 State of ITAM Report.
31%
have accurate visibility into AI software
Flexera, 2026 State of ITAM Report
Only 31% of organizations have accurate visibility into their AI software, according to Flexera's 2026 State of ITAM Report.
50%
higher AI tool expense without central management
Gartner (via USU reprint), 2026 Gartner Magic Quadrant for SaaS Management Platforms
Gartner predicts that through 2029, organizations that do not centrally monitor and manage SaaS-hosted AI tools will incur at least 50% higher expense and be at least five times more likely to suffer a cyber incident.
-41%
drop in effective price per million tokens
Ramp (Ramp Economics Lab), Ramp AI Index, September 2026 update
Ramp's token price index shows the effective price businesses pay per million AI tokens fell 41% to $0.68 by September 2026, down from a 2026 peak of $1.15 in March.
5x+
rise in inference cost per agentic workflow by 2028
Gartner predicts AI inference costs per agentic workflow will rise more than fivefold through 2028, even as per-token prices fall, because agents consume far more tokens per task.
40%
escalated surprise AI costs to the board
Mavvrik and Benchmarkit, 2026 State of AI Cost Governance Report
According to Mavvrik, 40% of organizations had to escalate a surprise AI cost to the board in the past year, 33% imposed emergency spending freezes and 25% delayed or cancelled an AI initiative.
49%
had to reprice AI products after cost surprises
Mavvrik and Benchmarkit, 2026 State of AI Cost Governance Report
According to Mavvrik, 49% of companies were forced to reprice AI-powered products because of unforeseen AI cost increases.
15%
can't attribute AI agent costs at any level
Mavvrik and Benchmarkit, 2026 State of AI Cost Governance Report
Mavvrik found only 44% of organizations include on-prem AI infrastructure in cost reporting, and 15% of those running agentic workloads cannot attribute agent costs at any level.
1 in 3
organizations overspent on AI applications
Flexera, Flexera 2026 AI Pulse Report
According to Flexera's 2026 AI Pulse Report, 80% of organizations increased AI investment, yet more than a third say they overspent on AI applications and 14% report wasted AI spend.
74%
now require cost reviews before approving AI
KPMG US, Quarterly AI Pulse Survey, Q3 2026
KPMG's Q3 2026 AI Pulse found 74% of large organizations now include cost reviews in AI approvals (up from 61% a quarter earlier), and 43% have usage or token budgets.
~1 in 2
rephased AI deployments when costs outran value
KPMG International, Global AI Pulse Q2 2026
KPMG's Global AI Pulse found nearly half of organizations have rephased AI deployments when costs began to outweigh expected value.
5x
more likely to see ROI with full AI cost visibility
KPMG International, Global AI Pulse Q2 2026
According to KPMG, organizations with full visibility into AI operating costs are five times more likely to report established ROI than those without (15% vs. 3%).
60-70%
annual decline in inference cost per token
Goldman Sachs Research, AI Agents Forecast to Boost Tech Cash Flow as Usage Soars
Goldman Sachs Research says chipmakers are cutting the cost per token for AI inference by 60-70% a year, while forecasting agentic AI will drive a 24-fold increase in token consumption by 2030.
85%
of tech execs lack real-time visibility into AI spend
IBM Institute for Business Value, CIO/CTO AI control gap study (with Oxford Economics)
85% of technology executives lack full visibility into real-time AI spend, and AI is projected to grow from under 15% of IT budgets in 2025 to nearly 25% by 2027, according to IBM.
1 in 3
IT leaders believe they overspend on AI apps
Flexera, Flexera IT Priorities Report (2026 strategy)
80% of IT leaders report increased spending on AI applications and over a third believe they are overspending, according to Flexera's 2026 IT Priorities report.
84%
see 6%+ gross margin erosion from AI costs
Mavvrik and Benchmarkit, 2025 State of AI Cost Management (State of AI Cost Governance)
Mavvrik and Benchmarkit found 84% of companies see gross margins eroded by 6% or more because of AI infrastructure costs, with 26% hit by 16% or more.
90%+
of CIOs say AI cost limits the value they get
According to a Gartner survey of over 300 CIOs, more than 90% said managing cost limits their ability to get value from AI.
500-1,000%
possible error in GenAI cost estimates
Gartner estimates that CIOs who don't understand how their generative AI costs scale could make a 500% to 1,000% error in their cost calculations.
95%
of organizations getting zero return from GenAI
MIT NANDA (Project NANDA, MIT Media Lab), The GenAI Divide: State of AI in Business 2025
MIT NANDA's GenAI Divide report found that despite $30-40 billion in enterprise investment, 95% of organizations are getting zero return from generative AI.
28%
of I&O AI use cases fully meet ROI expectations
Gartner, Press release: Gartner Says AI Projects in I&O Stall Ahead of Meaningful ROI Returns
A Gartner survey of 782 infrastructure and operations leaders found only 28% of AI use cases in I&O fully succeed and meet ROI expectations, while 20% fail outright.
20%
already growing revenue with AI (74% hope to)
Deloitte AI Institute, The State of AI in the Enterprise, 2026
Deloitte's State of AI in the Enterprise 2026 found 74% of organizations hope to grow revenue through AI, but only 20% are already doing so.
~40%
of AI time savings lost to rework
Workday, Beyond Productivity: Measuring the Real Value of AI (press release)
Workday research found nearly 40% of the time employees save with AI is lost to rework, and only 14% consistently get clear, positive net outcomes from AI.
19%
say AI initiatives met or beat ROI goals
Foundry (CIO.com), 2026 State of the CIO Study
Only 19% of IT leaders say AI initiatives have met or exceeded ROI goals, according to Foundry's 2026 State of the CIO study.
47%
of AI deals reach production (vs 25% for SaaS)
Menlo Ventures, 2025: The State of Generative AI in the Enterprise
According to Menlo Ventures, 47% of AI deals go to production once an organization commits to exploring a solution, nearly twice the 25% rate for traditional SaaS.
51%
can confidently evaluate AI ROI
CloudZero, The State Of AI Costs In 2025
CloudZero found only about half (51%) of organizations can confidently evaluate the ROI of their AI costs.
2-4 yrs
typical payback on an AI use case
Deloitte, AI ROI: The paradox of rising investment and elusive returns
Deloitte found most organizations achieve satisfactory ROI on a typical AI use case only after two to four years; just 6% saw payback in under a year.
10%
of agentic AI users see significant ROI
Deloitte, AI ROI: The paradox of rising investment and elusive returns
According to Deloitte, just 10% of organizations using agentic AI say they are currently realizing significant ROI from it.
60%
of companies report minimal AI value
Boston Consulting Group (BCG), The Widening AI Value Gap (press release)
BCG found 60% of companies are AI 'laggards' reporting minimal revenue and cost gains, while just 5% qualify as 'future-built' for AI.
25%
of AI initiatives delivered expected ROI
IBM Institute for Business Value, 2025 CEO Study (press release)
IBM's 2025 CEO Study found only 25% of AI initiatives have delivered expected ROI over the last few years, and only 16% have scaled enterprise-wide.
64%
of CEOs invest in tech before understanding its value
IBM Institute for Business Value, 2025 CEO Study (press release)
According to IBM, 64% of CEOs admit fear of falling behind drives them to invest in technologies before they clearly understand the value.
70%
of employees given AI tools; about half use them
ICONIQ, 2025 State of AI: The Builder's Playbook
ICONIQ found most companies give about 70% of employees access to internal AI tools, but only about half use them regularly.
26%
of failed AI pilots blamed on implementation costs
Menlo Ventures, 2024: The State of Generative AI in the Enterprise
According to Menlo Ventures, implementation costs were cited in 26% of failed generative AI pilots, ahead of data privacy (21%) and disappointing ROI (18%).
30%
of GenAI projects abandoned after proof of concept
Gartner predicted at least 30% of generative AI projects would be abandoned after proof of concept by the end of 2025, citing poor data quality, risk controls, escalating costs or unclear value.
74%
of companies have yet to show tangible AI value
Boston Consulting Group (BCG), Where's the Value in AI? (press release)
BCG's 2024 research found 74% of companies have yet to show tangible value from their use of AI, and only 4% have cutting-edge AI capabilities across functions.
Joiners & leavers · 70 stats
Access outlives the job. Departing employees keep seats, tokens and data long after they leave.
Source: Torii, SaaS Benchmark Annual Report 2026, "The Living Dead" chapter.
See the full chart in the benchmark report2.5%
of seats are assigned to offboarded users
Torii, SaaS Benchmark Annual Report 2026
An average of 2.5% of license seats are assigned to offboarded users, roughly 1 in 40, according to Torii's 2026 SaaS Benchmark.
38%
of employees have accessed a former employer's account
1Password, Annual Report 2025: The Access-Trust Gap
38% of employees say they have successfully accessed a prior employer's account, according to 1Password's 2025 Access-Trust Gap report.
38%
of IdP accounts dormant but still enabled
Veza, 2026 State of Identity & Access Report
Veza's 2026 State of Identity & Access report found 38% of identity provider accounts were dormant (inactive 90+ days) but still active, up from 20% the year before.
87%
of anomalous cloud file exfiltration by departing employees
Proofpoint, 2024 Data Loss Landscape
Proofpoint platform data shows departing employees caused 87% of anomalous file exfiltration among its cloud tenants over a nine-month period.
5 hours
to offboard one employee's SaaS access
Nudge Security, Employee offboarding by the numbers
IT teams spend an average of 5 hours per departing employee offboarding cloud and SaaS access, per a 2023 Nudge Security survey.
83%
of ex-employees still had access to old employer's assets
Beyond Identity, Former Employees Admit to Using Continued Account Access to Harm Previous Employers
In a 2022 Beyond Identity survey, 83% of former employees said they still had access to the digital assets of a previous employer.
76%
of IT leaders call offboarding a significant security threat
Torii, Offboarding Security for a Remote Workforce
76% of IT leaders agree or strongly agree that employee offboarding is a significant security threat, according to Torii's 2021 survey.
1 in 4
organizations automate offboarding
BetterCloud, 2026 State of SaaS Report
Only 1 in 4 organizations automates offboarding, according to BetterCloud's 2026 State of SaaS report, and 18% experienced a data breach caused by an offboarded user who still had access.
51%
can't properly offboard dormant SaaS accounts
51% of organizations lack the ability to properly offboard dormant identities and accounts across their SaaS estate, according to Valence Security's 2025-26 State of SaaS Security research with the Cloud Security Alliance.
88%
of orgs have stale but enabled ghost users
Varonis, 2025 State of Data Security Report
88% of organizations have stale but still-enabled 'ghost' user accounts, according to Varonis's 2025 State of Data Security Report.
3%
of ex-employees still hold active credentials
Veza, 2026 State of Identity & Access Report
Across enterprises Veza analyzed, 78,000 ex-employees (3% of all employees) still held active credentials.
8%
of IdP accounts are orphaned (no HR owner)
Veza, 2026 State of Identity & Access Report
Veza found 8% of identity provider accounts were orphaned, with no matching owner in HR systems, a 40% year-over-year increase.
#3
riskiest user group: departing employees
Proofpoint, 2024 Data Loss Landscape
Security professionals rank departing employees as the third riskiest category of user, per Proofpoint's 2024 Data Loss Landscape survey.
50%
of IT departments take 24+ hours to offboard a leaver
BetterCloud, State of SaaSOps 2024
Half of IT departments take more than 24 hours to offboard departing employees, according to BetterCloud's 2024 State of SaaSOps research.
70%
hit by ineffective offboarding
Nudge Security, Employee offboarding by the numbers
70% of IT professionals have experienced the impacts of ineffective offboarding, from business disruption to unauthorized access (Nudge Security, 2023).
69%
need 3+ sources to find a leaver's access
Nudge Security, Employee offboarding by the numbers
69% of IT teams use three or more sources just to identify all of a departing employee's cloud and SaaS access (Nudge Security, 2023).
56%
used lingering access to harm a former employer
Beyond Identity, Former Employees Admit to Using Continued Account Access to Harm Previous Employers
Beyond Identity's 2022 survey found 56% of former employees who retained access said they had used it to harm their former employer.
24%
kept a password on purpose after leaving
Beyond Identity, Former Employees Admit to Using Continued Account Access to Harm Previous Employers
Nearly a quarter (24%) of former employees admitted deliberately keeping a password after leaving a job, per Beyond Identity's 2022 survey.
74%
of employers hurt by an ex-employee breach
Beyond Identity, Former Employees Admit to Using Continued Account Access to Harm Previous Employers
74% of business leaders surveyed by Beyond Identity said their company had been negatively impacted by a former employee breaching its digital security.
9%
recall IT being involved in their exit
Beyond Identity, Former Employees Admit to Using Continued Account Access to Harm Previous Employers
Only 9% of departing employees in Beyond Identity's 2022 survey remembered an IT specialist being involved in their exit.
70%
of fired employees used access to cause harm
Beyond Identity, Former Employees Admit to Using Continued Account Access to Harm Previous Employers
Among employees who had been fired, 70% said they had intentionally caused harm using continued access, according to Beyond Identity's 2022 survey.
1 in 3
departing employees take IP with them
Mimecast (Code42 Incydr), Departing Employee Data Theft (use-case page)
Mimecast says that when employees leave, there is a 1 in 3 chance they take IP with them.
2%
of granted cloud permissions actually used
Microsoft, 2024 State of Multicloud Security Risk Report
Microsoft found that just 2% of the permissions granted to human and workload identities were actually used in 2023.
88
OAuth grants per employee (31 with data access)
Nudge Security, The Hidden Risk in Your OAuth Grant Inventory (blog)
Nudge Security customers average 88 OAuth grants per employee, 31 of them carrying data-level permissions.
16.5%
of permissions belong to inactive users
Veza, 2026 State of Identity & Access Report
According to Veza, 16.5% of all permissions belong to inactive users, up from 12% a year earlier.
96,000
entitlements held by the average worker
Veza, 2026 State of Identity & Access Report
The average worker in Veza's 2026 dataset holds 96,000 entitlements.
27.8%
of permissions ungoverned (outside SSO/IGA)
Veza, 2026 State of Identity & Access Report
Veza reports that 'safe, compliant' permissions fell from 70% in 2024 to 55.3% in 2025, driven by ungoverned permissions rising from 5% to 27.8%.
3.3%
of permissions are residual (should have been revoked)
Veza, 2026 State of Identity & Access Report
Veza classed 3.3% of enterprise permissions as 'residual': access that should have been revoked after a termination, job change or finished task.
82%
breached via improper access or over-privileged users
ConductorOne, Future of Identity Security Report 2025
82% of security leaders say their organization suffered a cyberattack or breach in the past year due to improper access or over-privileged users, up from 77% in 2024 (ConductorOne).
50%+
of cloud identities had access to everything
Microsoft, 2024 State of Multicloud Security Risk Report
More than half of cloud identities had access to all permissions and all resources in 2023, according to Microsoft's 2024 multicloud risk report.
51,000+
grantable cloud permissions, up from 40,000
Microsoft, 2024 State of Multicloud Security Risk Report
Over 51,000 permissions can now be granted to users and workloads across major clouds, up from 40,000 in 2022, per Microsoft.
1%
of granted permissions used by identities
Microsoft, 2023 State of Cloud Permissions Risks
Microsoft's 2023 State of Cloud Permissions Risks report found identities used just 1% of the permissions they were granted, and over 60% of all identities were inactive.
28.1%
of help desk tickets are app access requests
Fixify, 2026 IT Help Desk Benchmark Report
App assignment requests make up 28.1% of all IT help desk tickets, more than four times the next most common request, according to Fixify's 2026 IT Help Desk Benchmark Report.
12x
growth in access requests in two years
Access requests have surged more than 12x and access certifications more than 9x over the past two years, according to Okta's Businesses at Work 2026 report.
70%
of CISOs to use identity visibility tools by 2028
Gartner predicts that by 2028, 70% of CISOs will use identity visibility and intelligence capabilities to shrink the IAM attack surface.
55%
of new hires lacked full access on day one
allwhere, Employee Onboarding Statistics 2026
Only 45% of employees had their accounts, software and system access fully set up on their first day; 48% said some access was missing or delayed (allwhere survey).
16%
considered quitting over bad onboarding
allwhere, Employee Onboarding Statistics 2026
16% of employees seriously considered quitting in their first month because of a bad onboarding experience, per an allwhere survey.
40%
of help desk tickets are access, permissions or offboarding
Fixify, 2026 IT Help Desk Benchmark Report
App assignment, permissions management and employee offboarding together account for 40% of all IT help desk tickets, according to Fixify's 2026 benchmark.
63%
stuck at the earliest stages of identity maturity
SailPoint, 2025 Horizons of Identity Security
63% of organizations remain stuck in the earliest stages of identity security maturity, per SailPoint's 2025 Horizons of Identity Security report.
14%
say their last identity deployment fully succeeded
SailPoint, 2025 Horizons of Identity Security
Only 14% of organizations say their most recent identity security deployment was completely successful, and 48% ran over budget (SailPoint, 2025).
46%
plan AI agents for access requests and provisioning
ConductorOne, Future of Identity Security Report 2025
Access requests and account provisioning are among the top three tasks security leaders expect to hand to AI agents, cited by 46% (ConductorOne, 2025).
50%
say system complexity is their top IAM challenge
ConductorOne, Future of Identity Security Report 2025
Half of security leaders cite the complexity of existing systems as their biggest identity and access management challenge (ConductorOne, 2025).
34%
of organizations automate employee onboarding
BetterCloud, State of SaaS 2025
Only 40% of organizations automate offboarding and 34% automate onboarding, even though IT ranks them as top challenges, according to BetterCloud's 2025 State of SaaS report.
54%
lack automation for identity lifecycle management
Cloud Security Alliance, State of SaaS Security Report 2025
57% of organizations report fragmented SaaS administration and 54% lack automation for identity lifecycle management, according to the Cloud Security Alliance's State of SaaS Security 2025 report.
42%
say timely access reviews would have prevented incidents
Identity Defined Security Alliance (IDSA), 2024 Trends in Securing Digital Identities
In IDSA's 2024 study, 42% of organizations said more timely reviews of access to sensitive data could have prevented their identity incidents, and 50% pointed to privileged access reviews.
47%
say access policies hinder productivity
ConductorOne, Identity Security Outlook Report 2024
47% of security leaders say their identity security strategy and access policies hinder team productivity, per ConductorOne's 2024 Identity Security Outlook.
<1 in 3
have automated most of offboarding
Nudge Security, Employee offboarding by the numbers
Fewer than one in three IT teams have automated 75% or more of their offboarding process, per Nudge Security's 2023 survey.
51%
of new hires frustrated by onboarding tech issues
BambooHR, Onboarding study (press release: 44% of New Hires Regret their Decision Within a Week)
51% of new hires name technology issues among their top onboarding frustrations, per BambooHR's 2023 onboarding study.
44 days
to convince a new hire to stay
BambooHR, Onboarding study (press release: 44% of New Hires Regret their Decision Within a Week)
70% of new hires decide whether a job is the right fit within the first month, and companies have about 44 days to convince them to stay (BambooHR, 2023).
51%
can't keep pace with access change requests
Saviynt (research by Ponemon Institute), State of Enterprise Identity
51% of IT and security practitioners say they cannot keep pace with the number of access change requests, per Saviynt/Ponemon research.
46%
failed a compliance requirement due to access issues
Saviynt (research by Ponemon Institute), State of Enterprise Identity
46% of organizations failed to comply with regulations because of access-related issues, according to Saviynt and Ponemon's 2022 study.
16%
have a fully mature IAM strategy
Saviynt (research by Ponemon Institute), State of Enterprise Identity
Only 16% of organizations have a fully mature IAM strategy in place (Saviynt/Ponemon, 2022).
$19.5M
average annual cost of insider incidents
Ponemon Institute / DTEX Systems, 2026 Cost of Insider Risks Global Report
The 2026 Ponemon Cost of Insider Risks report puts the average annual cost of insider security incidents at $19.5M per organization.
67 days
average time to contain an insider incident
Ponemon Institute / DTEX Systems, 2026 Cost of Insider Risks Global Report
Insider incidents took 67 days on average to contain in Ponemon's 2026 study, down from 86 days in 2023.
$10.3M
annual cost of negligent insiders
Ponemon Institute / DTEX Systems, 2026 Cost of Insider Risks Global Report
Negligent insiders cost organizations $10.3M a year on average, up 17% year over year, per Ponemon's 2026 Cost of Insider Risks report.
19%
of IT budget spent on insider risk management
Ponemon Institute / DTEX Systems, 2026 Cost of Insider Risks Global Report
Organizations now allocate 19% of their IT budget to insider risk management, up from 8.2% in 2023, according to Ponemon and DTEX.
12%
of breaches involved internal actors
Verizon, 2026 Data Breach Investigations Report
Internal actors were involved in 12% of breaches in Verizon's 2026 DBIR, down from 18% the year before.
60%
of insider misuse breaches driven by convenience
Verizon, 2026 Data Breach Investigations Report
Deliberate privilege misuse by insiders accounted for just under 4% of breaches in the 2026 DBIR, and 60% of those were motivated by convenience rather than money.
19%
of insider breach actors were system admins
Verizon, 2026 Data Breach Investigations Report
End-users made up 75% of internal actors in breaches, and system administrators 19%, per Verizon's 2026 DBIR.
4%
of breaches were deliberate insider privilege misuse
Verizon, 2026 Data Breach Investigations Report
Verizon's 2026 DBIR notes that insiders walking off with proprietary data are 'frequently the hardest to catch without specific offboarding processes in place.'
80%
had an access-related breach last year
ConductorOne (C1), 2026 Future of Identity Report
80% of IT and security leaders surveyed by ConductorOne (C1) experienced at least one access-related breach in the past year.
$211,021
spent containing each insider incident vs $37,756 monitoring
Ponemon Institute / DTEX Systems, 2025 Cost of Insider Risks Global Report
For every insider incident, companies spend about $211,021 on containment but just $37,756 on monitoring, per Ponemon's 2025 Cost of Insider Risks report.
$18.7M
annual cost when containment takes 91+ days
Ponemon Institute / DTEX Systems, 2025 Cost of Insider Risks Global Report
Insider incidents that took more than 91 days to contain cost $18.7M on average, versus $10.6M for those contained in under 31 days (Ponemon, 2025).
1%
of users cause 88% of data loss events
Proofpoint, 2024 Data Loss Landscape
Just 1% of users are responsible for 88% of data loss events, according to Proofpoint platform data.
85%
of organizations had a data loss incident last year
Proofpoint, 2024 Data Loss Landscape
85% of organizations surveyed by Proofpoint experienced at least one data loss incident in the past year, averaging just over 15 incidents each.
28%
rise in monthly insider data-loss events since 2021
Code42 (Mimecast), 2024 Data Exposure Report
Monthly insider-driven data exposure, loss, leak and theft events have risen 28% on average since 2021, according to Code42's 2024 Data Exposure Report, a survey of 700 US cybersecurity professionals.
$15M
average cost of a single insider data event
Mimecast (Code42), 2024 Data Exposure Report
Security leaders estimate an average insider-driven data event costs $15 million, per Code42's 2024 Data Exposure Report.
3 hours
per day spent investigating insider data events
Code42 (Mimecast), 2024 Data Exposure Report
Cybersecurity professionals surveyed for Code42's 2024 Data Exposure Report say they spend an average of 3 hours a day investigating insider-driven data events.
90%
had an identity-related incident last year
Identity Defined Security Alliance (IDSA), 2024 Trends in Securing Digital Identities
90% of organizations experienced at least one identity-related incident in the past year, according to IDSA's 2024 research.
84%
saw direct business impact from identity incidents
Identity Defined Security Alliance (IDSA), 2024 Trends in Securing Digital Identities
84% of organizations hit by an identity-related incident reported a direct business impact, up from 68% in 2023 (IDSA).
Agents & NHIs · 92 stats
Machine identities outnumber people many times over, and AI agents are the newest and least governed.
Sources: CyberArk, 2025 Identity Security Landscape (archived copy) · Entro Labs, NHI & Secrets Risk Report H1 2025
82:1
machine identities for every human
CyberArk, 2025 Identity Security Landscape archived copy
According to CyberArk's 2025 Identity Security Landscape, there are 82 machine identities for every human in organizations worldwide.
144:1
non-human identities per human (Entro telemetry)
Entro Security, NHI & Secrets Risk Report H1 2025
Entro Labs found the average ratio of non-human to human identities grew from 92:1 to 144:1 in one year, a 56% jump.
+44%
year-over-year growth in NHIs
Entro Security, NHI & Secrets Risk Report H1 2025
Non-human identities grew 44% year over year from H1 2024 to H1 2025, according to Entro Labs.
150%
expected growth in machine identities next year
CyberArk, 2025 State of Machine Identity Security Report archived copy
79% of security leaders expect the number of machine identities in their organization to grow, by as much as 150% over the next year, per CyberArk.
40%+
of identities are machine identities
SailPoint, Horizons of Identity Security 2024
Machine identities now make up more than 40% of all identities in an organization, per SailPoint's 2024 Horizons report.
68%
can't tell AI agent activity from human
68% of organizations cannot clearly distinguish between human and AI agent activity, according to a 2026 Cloud Security Alliance survey.
82%
found unknown AI agents in the past year
82% of organizations discovered previously unknown AI agents in their environment in the past year, according to a 2026 Cloud Security Alliance survey.
80%
say AI agents took unintended actions
SailPoint, AI Agents: The New Attack Surface (AI agent adoption report)
According to SailPoint's 2025 AI agent research, 80% of companies say their AI agents have taken unintended actions, such as accessing unauthorized systems.
75%
of organizations use Claude Code
Netskope Threat Labs, Netskope AI Report: 2026
According to Netskope's AI Report 2026, 75% of organizations use Claude Code and 58% use Codex, up from negligible adoption a year earlier.
4x
increase in MCP traffic
Netskope Threat Labs, Netskope AI Report: 2026
According to Netskope's AI Report 2026, MCP traffic increased 4x as organizations connect AI systems to sensitive data stores, driving a sharp rise in downstream data policy violations.
1 in 5
developers give AI coding agents unrestricted access
UpGuard, YOLO Mode: Hidden Risks in AI Coding Agents (press release)
According to UpGuard's analysis of 18,000+ AI agent configuration files on GitHub, 1 in 5 developers have granted AI coding agents unrestricted access to perform high-risk actions without human oversight.
50%
of agent tools can run shell commands
Reco, The State of Agent Security 2026
According to Reco's State of Agent Security 2026, 50% of 500 published AI agent tools (MCP servers) can execute shell commands on the host machine.
36%
say humans approve most AI actions first
ISACA, 2026 AI Pulse Poll (preview, RSA Conference)
According to ISACA's 2026 AI Pulse Poll, only 36% of respondents say humans approve most AI-generated actions before execution.
77%
comfortable letting AI act without human review
Ivanti, Ivanti 2026 cybersecurity research (agentic AI)
According to Ivanti's 2026 research, 87% of security teams say adopting agentic AI is a priority, and 77% report at least some comfort allowing autonomous AI to act without human review.
24,008
secrets exposed in MCP config files
GitGuardian, The State of Secrets Sprawl 2026
GitGuardian found 24,008 unique secrets exposed in Model Context Protocol (MCP) configuration files on public GitHub in 2025.
78%
have no policy for creating or removing AI identities
78% of organizations have no documented, formally adopted policy for creating or removing AI identities, per the Cloud Security Alliance.
21%
keep a real-time inventory of AI agents
Cloud Security Alliance (commissioned by Strata Identity), Securing Autonomous AI Agents
Only 21% of organizations maintain a real-time registry or inventory of their AI agents, according to the Cloud Security Alliance.
84%
doubt they'd pass an AI-agent access audit
Cloud Security Alliance (commissioned by Strata Identity), Securing Autonomous AI Agents
84% of organizations doubt they could pass a compliance audit focused on AI agent behavior or access controls, per the Cloud Security Alliance.
44%
use static API keys for AI agents
Cloud Security Alliance (commissioned by Strata Identity), Securing Autonomous AI Agents
44% of organizations use or plan to use static API keys to authenticate AI agents, and 43% username and password combinations, per the Cloud Security Alliance.
43%
run AI agents on shared service accounts
43% of organizations run AI agents on shared service accounts and 31% let agents operate under human user identities, per the Cloud Security Alliance.
45%
treat AI agents like humans for access controls
CyberArk, Privileged access study (January 2026) archived copy
45% of organizations apply the same privileged access controls to AI agents as they do to human identities, per CyberArk.
1 in 5
companies have mature AI agent governance
Deloitte AI Institute, The State of AI in the Enterprise, 2026
According to Deloitte, only one in five companies has a mature governance model for autonomous AI agents, even as agentic AI use is poised to rise sharply.
44%
of orgs using AI agents have policies to secure them
SailPoint, AI Agents: The New Attack Surface (AI agent adoption report)
According to SailPoint's 2025 AI agent research, 82% of organizations already use AI agents, but only 44% have policies in place to secure them.
23%
had AI agents tricked into revealing credentials
SailPoint, AI Agents: The New Attack Surface (AI agent adoption report)
According to SailPoint's 2025 AI agent research, 23% of organizations reported their AI agents have been tricked into revealing access credentials.
98%
plan to expand AI agent use despite the risk
SailPoint, AI Agents: The New Attack Surface (AI agent adoption report)
According to SailPoint's 2025 AI agent research, 96% of technology professionals consider AI agents a growing risk, yet 98% of organizations plan to expand their use within the next year.
81%
of leaders expect agents in their AI strategy within 18 months
Microsoft, 2025 Work Trend Index: The Year the Frontier Firm Is Born
According to Microsoft's 2025 Work Trend Index, 81% of leaders expect AI agents to be moderately or extensively integrated into their company's AI strategy in the next 12 to 18 months.
46%
of leaders say agents fully automate workflows
Microsoft, 2025 Work Trend Index: The Year the Frontier Firm Is Born
According to Microsoft's 2025 Work Trend Index, 46% of leaders say their companies are using AI agents to fully automate workflows or processes.
68%
lack identity security controls for AI
CyberArk, 2025 Identity Security Landscape archived copy
68% of security decision makers surveyed by CyberArk say their organizations lack identity security controls for AI.
72%
say AI agents riskier than machine identities
SailPoint, AI agents: The new attack surface
72% of technology professionals say AI agents pose a greater risk than other machine identities, per SailPoint.
53%
of MCP servers use long-lived static secrets
Astrix Security, State of MCP Server Security 2025
Of more than 5,200 open-source MCP servers Astrix analyzed, 88% require credentials, 53% rely on long-lived static API keys or personal access tokens, and only 8.5% use OAuth.
79%
of MCP servers pass API keys via env variables
Astrix Security, State of MCP Server Security 2025
79% of MCP servers that use API keys take them from plain environment variables, according to Astrix Security.
64%
of tech executives plan to deploy agentic AI within 24 months
Gartner found that 64% of technology executives plan to deploy agentic AI within the next 24 months, while AI investment is expected to grow more than 35% year over year in a constrained IT budget environment.
29M
secrets leaked on public GitHub in 2025
GitGuardian, The State of Secrets Sprawl 2026
GitGuardian detected about 29 million new hardcoded secrets in public GitHub commits in 2025, a 34% increase year over year and the largest single-year jump it has recorded.
64%
of valid 2022 leaked secrets still not revoked
GitGuardian, The State of Secrets Sprawl 2026
GitGuardian found that 64% of valid secrets first detected in 2022 were still not revoked in 2026.
59%
of AWS IAM users have keys over a year old
Datadog, State of Cloud Security 2025
59% of AWS IAM users have an active access key older than one year, according to Datadog's 2025 State of Cloud Security.
+81%
rise in leaked AI-service secrets in 2025
GitGuardian, The State of Secrets Sprawl 2026
Leaked secrets tied to AI services rose 81% year over year in 2025, to 1,275,105, according to GitGuardian.
6x
more likely: secrets in internal vs public repos
GitGuardian, The State of Secrets Sprawl 2026
Internal repositories are about 6 times more likely than public ones to contain hardcoded secrets, per GitGuardian.
28%
of secret leaks start in collaboration tools
GitGuardian, The State of Secrets Sprawl 2026
About 28% of secrets-leak incidents GitGuardian found originate in collaboration and productivity tools rather than code repositories.
2x
secret-leak rate in AI-assisted commits
GitGuardian, The State of Secrets Sprawl 2026
Claude Code-assisted commits leaked secrets at about 3.2%, roughly twice the public GitHub baseline, according to GitGuardian.
60%
of secrets violations are long-lived credentials
GitGuardian, The State of Secrets Sprawl 2026
About 60% of secrets policy violations GitGuardian sees are long-lived credentials that persist over time.
1.6x
faster growth of secrets than developers
GitGuardian, The State of Secrets Sprawl 2026
Since 2021, leaked secrets have grown about 1.6 times faster than the active developer population, per GitGuardian.
14%
fully automate AI identity lifecycle
Only 14% of organizations have fully automated the creation and removal of AI-related identities; 27% do it entirely by hand, per the Cloud Security Alliance.
24%
take 24+ hours to revoke an exposed credential
Nearly a quarter (24%) of organizations take more than 24 hours to rotate or revoke a credential after a potential exposure, per the Cloud Security Alliance.
33%
don't know how often AI agent credentials rotate
A third of organizations (33%) do not know how often their AI agent credentials are rotated, per the Cloud Security Alliance.
54%
find unmanaged privileged accounts and secrets weekly
CyberArk, Privileged access study (January 2026) archived copy
54% of organizations uncover unmanaged privileged accounts and secrets every week, according to a 2026 CyberArk study.
114,000
internal certificates per org, managed by 4 staff
CyberArk / Ponemon Institute, Trends in PKI Security: A Global Study of Trends, Challenges & Business Impact archived copy
The average organization oversees more than 114,000 internal certificates but has only four full-time staff dedicated to managing them, according to Ponemon research for CyberArk.
56%
had outages from expired certificates
CyberArk / Ponemon Institute, Trends in PKI Security: A Global Study of Trends, Challenges & Business Impact archived copy
56% of organizations have suffered unplanned outages due to expired certificates or configuration errors, per Ponemon research for CyberArk.
7.5%
of NHIs are 5 to 10 years old
Entro Security, NHI & Secrets Risk Report H1 2025
7.5% of non-human identities are 5 to 10 years old, with some exceeding a decade, per Entro Labs.
55%
of Google Cloud service accounts have keys over a year old
Datadog, State of Cloud Security 2025
55% of Google Cloud service accounts have active keys older than a year, and 40% of Microsoft Entra ID applications have credentials older than a year, per Datadog.
25%
of AWS access keys are over 3 years old
Datadog, State of Cloud Security 2025
The share of cloud access keys older than three years rose to 25% in both AWS and Google Cloud, according to Datadog.
86%
had a certificate-related outage last year
Keyfactor, Digital Trust Digest: The Automation Edition
86% of companies suffered at least one outage from expired or mismanaged digital certificates in the past year, and 10% have one every week, according to Keyfactor.
17%
have full real-time visibility of certificates
Keyfactor, Digital Trust Digest: The Automation Edition
Only 17% of certificate practitioners have complete, real-time visibility across all their certificates, per Keyfactor.
94 days
median time to fix a leaked secret
Verizon, 2025 Data Breach Investigations Report
The median time to remediate leaked secrets discovered in a GitHub repository was 94 days, according to Verizon's 2025 DBIR.
50%
of leaked dev/CI-CD secrets are GitLab tokens
Verizon, 2025 Data Breach Investigations Report
GitLab tokens made up 50% of all development and CI/CD secrets found leaked in public code repositories, per Verizon's 2025 DBIR.
72%
had a certificate outage in the past year
CyberArk, 2025 State of Machine Identity Security Report archived copy
72% of organizations suffered at least one certificate-related outage in the past year, and 45% have one weekly, per CyberArk, up from 12% weekly in 2022.
45%
of NHI attacks traced to unrotated credentials
Cloud Security Alliance and Astrix Security, State of Non-Human Identity Security Survey Report
Lack of credential rotation was the most common cause of NHI-related attacks (45%), ahead of inadequate monitoring (37%) and over-privileged identities (37%), per CSA and Astrix.
71%
of NHIs not rotated on time
Entro Security, Entro Labs NHI research security advisory (2024)
71% of non-human identities are not rotated within recommended time frames, per Entro Labs.
9
certificate incidents per org per year
Keyfactor, 2024 PKI & Digital Trust Report
The average organization experienced nine certificate-related incidents in the past 12 months, taking 2.6 hours to identify and 2.7 hours to fix each outage, according to Keyfactor.
89%
struggle to manage secrets at scale
Venafi (a CyberArk company), The Impact of Machine Identities on the State of Cloud Native Security in 2024 archived copy
89% of organizations face challenges managing and securing secrets at scale, according to Venafi.
40%
of workload identities inactive
Microsoft, 2024 State of Multicloud Security Risk Report
40% of workload identities were inactive in 2023, according to Microsoft Entra Permissions Management data.
1%
have fully adopted just-in-time privileged access
CyberArk, Privileged access study (January 2026) archived copy
Only 1% of organizations have fully implemented just-in-time privileged access, and 91% say at least half of their privileged access is always on, per CyberArk.
59%
of compromised machines were CI/CD runners
GitGuardian, The State of Secrets Sprawl 2026
In the Shai-Hulud 2 supply-chain attack, 59% of compromised machines were CI/CD runners rather than personal workstations, GitGuardian found.
79%
lack high confidence in stopping NHI attacks
79% of organizations rate their confidence in preventing attacks via non-human identities as low or moderate, per a 2026 Cloud Security Alliance survey commissioned by Oasis Security.
92%
doubt legacy IAM can handle AI and NHIs
92% of IT and security professionals are not confident their legacy IAM tools can manage the risks of AI and non-human identities, per the Cloud Security Alliance.
18%
highly confident IAM can manage AI agents
Cloud Security Alliance (commissioned by Strata Identity), Securing Autonomous AI Agents
Only 18% of security professionals are highly confident their IAM systems can manage AI agent identities, per the Cloud Security Alliance.
74%
say AI agents get more access than needed
74% of organizations say AI agents often receive more access than necessary, per the Cloud Security Alliance.
9%
say IAM owns AI agent identity
Only 9% of organizations say their IAM team is the primary owner of AI agent identity and access, per the Cloud Security Alliance.
65%
had an AI agent incident in the past year
65% of organizations experienced an AI agent-related incident in the past 12 months, with 61% reporting data exposure, per the Cloud Security Alliance.
53%
had AI agents exceed their permissions
Cloud Security Alliance (commissioned by Zenity), Enterprise AI Security Starts with AI Agents
53% of organizations have had AI agents exceed their intended permissions, and only 8% say their agents never do, according to the Cloud Security Alliance.
54%
have up to 100 unsanctioned AI agents
Cloud Security Alliance (commissioned by Zenity), Enterprise AI Security Starts with AI Agents
54% of organizations report between 1 and 100 unsanctioned AI agents, and only 15% say most of their agents have a defined owner, per the Cloud Security Alliance.
<50%
of orgs actively secure non-human identities
IBM, Cost of a Data Breach Report 2026
Fewer than half of organizations are actively securing non-human identities, according to IBM's 2026 Cost of a Data Breach Report.
10%
have a strategy for governing non-human identities
78% of organizations cite controlling non-human identity access and permissions as a top concern, but only 10% have a strategy for governing them (Okta, 2026).
42%
of machine identities have privileged or sensitive access
CyberArk, 2025 Identity Security Landscape archived copy
CyberArk's 2025 Identity Security Landscape found that 42% of machine identities have privileged or sensitive access.
88%
define 'privileged user' as humans only
CyberArk, 2025 Identity Security Landscape archived copy
88% of security decision makers told CyberArk that their organization defines a 'privileged user' as human identities only.
87%
had 2+ identity-centric breaches in a year
CyberArk, 2025 Identity Security Landscape archived copy
87% of organizations surveyed by CyberArk experienced at least two successful identity-centric breaches in the past 12 months.
61%
lack identity controls for cloud workloads
CyberArk, 2025 Identity Security Landscape archived copy
61% of organizations surveyed by CyberArk do not have identity security controls in place to secure cloud infrastructure and workloads.
1 in 20
AWS machine identities have full admin
Entro Security, NHI & Secrets Risk Report H1 2025
1 in 20 AWS machine identities carries full-admin privileges, according to Entro Labs.
8.7%
of NHIs are overprivileged and idle
Entro Security, NHI & Secrets Risk Report H1 2025
Entro Labs found 8.7% of non-human identities are both overprivileged and idle.
12.2%
of third-party cloud integrations dangerously overprivileged
Datadog, State of Cloud Security 2025
12.2% of third-party integrations into AWS accounts are dangerously overprivileged, letting the vendor access all data or take over the account, per Datadog.
13
third-party integration roles per org in AWS
Datadog, State of Cloud Security 2025
The average organization deploys 13 third-party SaaS integration roles in AWS, up from 10.2 in 2024, per Datadog.
19.4%
of EC2 instances overprivileged
Datadog, State of Cloud Security 2025
Almost one in five AWS EC2 instances (19.4%) is overprivileged, according to Datadog.
50%
had incidents from compromised machine identities
CyberArk, 2025 State of Machine Identity Security Report archived copy
Half (50%) of security leaders reported security incidents or breaches linked to compromised machine identities in the past year, according to CyberArk's 2025 State of Machine Identity Security Report.
53%
say security owns machine identity risk
CyberArk, 2025 State of Machine Identity Security Report archived copy
Responsibility for preventing machine identity compromises is split among security (53%), development (28%) and platform (14%) teams, per CyberArk.
46%
struggle to monitor NHIs in SaaS
Cloud Security Alliance, State of SaaS Security Report: Trends and Insights for 2025-2026
46% of organizations struggle to monitor non-human identities created by SaaS-to-SaaS integrations and GenAI tools, and 56% worry about over-privileged API access, per the Cloud Security Alliance.
44%
of machine identities owned by IAM teams
Gartner, Gartner Identifies the Top Cybersecurity Trends for 2025 (press release)
A Gartner survey of 335 IAM leaders found IAM teams are responsible for only 44% of their organization's machine identities.
1 in 5
organizations had an NHI security incident
Cloud Security Alliance and Astrix Security, State of Non-Human Identity Security Survey Report
Nearly 1 in 5 organizations have experienced a security incident related to non-human identities, according to a 2024 Cloud Security Alliance and Astrix survey.
15%
highly confident they can secure NHIs
Cloud Security Alliance and Astrix Security, State of Non-Human Identity Security Survey Report
Only 15% of organizations are highly confident in their ability to secure non-human identities, versus nearly 1 in 4 for human identities, per CSA and Astrix.
85%
lack full visibility into OAuth-connected vendors
Cloud Security Alliance and Astrix Security, State of Non-Human Identity Security Survey Report
38% of organizations report no or low visibility into third-party vendors connected by OAuth apps, and another 47% have only partial visibility, according to CSA and Astrix.
97%
of NHIs have excessive privileges
Entro Security, Entro Labs NHI research security advisory (2024)
Entro Labs found 97% of non-human identities have excessive privileges, and 92% of organizations expose NHIs to third parties.
91%
of former employees' tokens remain active
Entro Security, Entro Labs NHI research security advisory (2024)
91% of former employees' tokens remain active after they leave, according to Entro Labs.
56%
had a service-account machine identity incident
Venafi (a CyberArk company), The Impact of Machine Identities on the State of Cloud Native Security in 2024 archived copy
56% of organizations had a security incident involving machine identities such as access tokens used with service accounts in the past year, according to Venafi.
88%
say tokens and service accounts are attackers' next target
Venafi (a CyberArk company), The Impact of Machine Identities on the State of Cloud Native Security in 2024 archived copy
88% of security leaders believe machine identities, specifically access tokens and their connected service accounts, are the next big target for attackers, per Venafi.
Security · 72 stats
Most SaaS breaches start with a login, not an exploit, and often through a connected third party.
83%
of cloud and SaaS incidents began with identity compromise
Google Cloud, Cloud Threat Horizons Report H1 2026
Threat actors exploited identity issues to gain initial access in 83% of incidents involving major cloud and SaaS-hosted environments, according to Google Cloud's H1 2026 Threat Horizons Report.
99%
of SaaS compromises started at the identity provider
Obsidian Security, 2025 SaaS Security Threat Report
99% of SaaS compromises Obsidian Security investigated originated at the identity provider, according to its 2025 SaaS Security Threat Report.
97%
of identity attacks are password attacks
Microsoft, Microsoft Digital Defense Report 2025
More than 97% of identity attacks are password attacks, according to Microsoft's 2025 Digital Defense Report.
39%
of breaches involve credential abuse
Verizon, 2026 Data Breach Investigations Report
Counting every stage of an attack, credential abuse appears in 39% of breaches, the most common action, according to Verizon's 2026 DBIR.
31%
of breaches began with vulnerability exploitation
Verizon, 2026 Data Breach Investigations Report
For the first time in the DBIR's history, vulnerability exploitation (31% of breaches) overtook credential abuse (13%) as the most common way attackers get in, per Verizon's 2026 report.
95 days
median gap from credential leak to ransomware
Verizon, 2026 Data Breach Investigations Report
Half of ransomware victims with a prior credential or infostealer leak had that leak within 95 days of the attack, per Verizon's 2026 DBIR.
20
credential leak events a year at larger orgs
Verizon, 2026 Data Breach Investigations Report
Small organizations saw a median of seven credential leak events a year and larger organizations around 20, according to Verizon's 2026 DBIR.
82%
of detections were malware-free
CrowdStrike, 2026 Global Threat Report
82% of CrowdStrike detections in 2025 were malware-free, as adversaries used valid credentials, trusted identity flows and approved SaaS integrations.
35%
of cloud incidents involved valid account abuse
CrowdStrike, 2026 Global Threat Report
Valid account abuse accounted for 35% of cloud incidents in 2025, and cloud-conscious intrusions rose 37%, according to CrowdStrike's 2026 Global Threat Report.
23%
of cloud compromises began with voice phishing
Google Cloud (Mandiant), M-Trends 2026
Voice phishing was the number one initial infection vector in cloud-related compromises in 2025, at 23%, according to Mandiant's M-Trends 2026.
52.2%
of valid-account intrusions led to more credential theft
Microsoft, Microsoft Digital Defense Report 2026
52.2% of intrusions that used a valid account went on to steal more credentials, according to Microsoft's 2026 Digital Defense Report.
78%
of attacks on critical infrastructure used cloud identity abuse
Microsoft, Microsoft Digital Defense Report 2026
78% of observed attack techniques against critical infrastructure used cloud identity abuse, according to Microsoft's 2026 Digital Defense Report.
36%
of breaches used stolen credentials
Verizon, 2026 Data Breach Investigations Report
The use of stolen credentials appeared in 36% of breaches in the 2026 Verizon DBIR.
80%
of Snowflake-attack accounts had prior credential exposure
Verizon, 2025 Data Breach Investigations Report
In the 2024 Snowflake customer breaches, about 80% of the accounts the attacker used had prior credential exposure, and around 165 organizations were affected, per Verizon's 2025 DBIR.
22%
of breaches started with credential abuse
Verizon, 2025 Data Breach Investigations Report
Credential abuse (22%) was the leading initial attack vector in Verizon's 2025 DBIR, just ahead of vulnerability exploitation (20%).
54%
of ransomware victims' domains were in credential dumps
Verizon, 2025 Data Breach Investigations Report
54% of 2024 ransomware victims had their domains appear in infostealer credential dumps, per Verizon's 2025 DBIR.
53%
of material breaches traced to compromised credentials
1Password, 2025 Annual Report: The Access-Trust Gap
Compromised credentials were the root cause of 53% of material breaches over the past three years, according to 1Password's 2025 Access-Trust Gap report.
32%
rise in identity-based attacks, H1 2025
Microsoft, Microsoft Digital Defense Report 2025
Identity-based attacks rose 32% in the first half of 2025, according to Microsoft.
79.7%
of abused Snowflake accounts had previously leaked credentials
Google Cloud (Mandiant), UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion
At least 79.7% of the Snowflake customer accounts used in the 2024 UNC5537 campaign had prior credential exposure, much of it from infostealer infections dating back to 2020, Mandiant found.
48%
of breaches involved a third party
Verizon, 2026 Data Breach Investigations Report
Breaches with third-party involvement rose 60% year over year to 48% of all breaches, according to Verizon's 2026 DBIR.
700+
companies hit through one compromised SaaS integration
Obsidian Security, The rise of SaaS supply chain attacks (blog)
The 2025 Salesloft Drift OAuth token compromise extended into Salesforce and other tools at more than 700 companies, according to Obsidian Security.
~8 months
to fix half of third-party cloud credential issues
Verizon, 2026 Data Breach Investigations Report
For weak passwords and permission misconfigurations in third parties' cloud accounts, it took almost eight months to resolve half of all findings, per Verizon's 2026 DBIR.
21%
of cloud intrusions came through a compromised third party
Google Cloud, Cloud Threat Horizons Report H1 2026
21% of cloud and SaaS intrusions in the second half of 2025 involved compromised trusted relationships with third parties, such as stolen Salesloft Drift and Gainsight OAuth tokens, per Google Cloud's H1 2026 Threat Horizons Report.
78%
cover less than half their vendors
SecurityScorecard, 2026 Supply Chain Cybersecurity Trends Report
78% of organizations say their cybersecurity programs cover less than half of their vendor ecosystem, according to SecurityScorecard's 2026 Supply Chain Cybersecurity Trends Report.
2x
third-party share of breaches doubled to 30%
Verizon, 2025 Data Breach Investigations Report
Third-party involvement in breaches doubled in a year, from 15% to 30%, according to Verizon's 2025 Data Breach Investigations Report.
123%
growth in SaaS-to-SaaS integrations
Obsidian Security, The rise of SaaS supply chain attacks (blog)
SaaS integrations created in Obsidian Security's network grew 123% and AI agents created grew 223%, widening the SaaS supply chain attack surface.
10x
bigger blast radius than direct Salesforce attacks
Obsidian Security, The rise of SaaS supply chain attacks (blog)
Obsidian Security found the blast radius of the Salesloft Drift supply chain attack was 10 times greater than previous incidents in which attackers went after Salesforce directly.
35.5%
of 2024 breaches were third-party related
SecurityScorecard, 2025 Global Third-Party Breach Report
35.5% of all breaches in 2024 were third-party related, according to SecurityScorecard's 2025 Global Third-Party Breach Report.
41.4%
of ransomware attacks start through a third party
SecurityScorecard, 2025 Global Third-Party Breach Report
41.4% of ransomware attacks now start through third parties, according to SecurityScorecard's 2025 Global Third-Party Breach Report.
70%+
had a material third-party cyber incident last year
SecurityScorecard, 2025 Supply Chain Cybersecurity Trends Survey
More than 70% of organizations had at least one material third-party cybersecurity incident in the past year, according to SecurityScorecard's 2025 Supply Chain Cybersecurity Trends survey.
1,000+
apps connected to the average Microsoft 365 tenant
AppOmni, The State of SaaS Security 2024
49% of frequent Microsoft 365 users thought fewer than 10 apps were connected to their tenant; AppOmni's platform data shows more than 1,000 connections on average.
33%
of third-party SaaS integrations hold sensitive permissions
Valence Security, 2024 State of SaaS Security Report
Every organization in Valence Security's 2024 data granted API access to at least one third-party vendor, and 33% of those integrations had access to sensitive permissions and data.
99%
of Global 2000 firms connect to a breached vendor
SecurityScorecard and Cyentia Institute, Global 2000 supply chain research
99% of Global 2000 companies are directly connected to vendors that have had a recent breach, and supply chain incidents cost 17 times more to remediate than first-party breaches, according to SecurityScorecard and the Cyentia Institute.
34%
of SaaS apps are not protected by SSO
1Password, Annual Report 2025: The Access-Trust Gap
1Password's 2025 report found at least one-third (34%) of SaaS apps are not protected by single sign-on.
23%
of third parties fully fixed cloud MFA gaps
Verizon, 2026 Data Breach Investigations Report
Only 23% of third-party organizations fully remediated missing or weak MFA on their cloud accounts, according to Verizon's 2026 DBIR.
37%
of orgs had an IaaS admin account without MFA
Verizon, 2026 Data Breach Investigations Report
In a cloud exposure snapshot in Verizon's 2026 DBIR, 37% of organizations had an admin account with MFA disabled on an IaaS platform, versus 14% on Snowflake after its 2024 breach campaign.
46%
of SaaS breaches tied to weak or exploited MFA
Valence Security, The State of SaaS Security: Trends and Insights for 2026
46% of SaaS breaches were linked to weak or exploited MFA protections, according to Valence Security's State of SaaS Security: Trends and Insights for 2026.
31%
of MFA-bypass attacks used token theft
Verizon, 2025 Data Breach Investigations Report
Token theft was the most common technique in attacks that bypassed MFA on Microsoft 365 accounts, at 31%, according to Verizon's 2025 DBIR.
84%
of SaaS breaches got past MFA
Obsidian Security, 2025 SaaS Security Threat Report
MFA failed to prevent the attack in 84% of the SaaS incident responses Obsidian Security took part in, per its 2025 SaaS Security Threat Report.
~50%
can't enforce MFA and SSO across all SaaS apps
Nearly half of organizations cannot enforce consistent MFA and single sign-on across all users and SaaS applications, according to Valence Security's 2025-26 research with the Cloud Security Alliance.
99%
of identity attacks blocked by phishing-resistant MFA
Microsoft, Microsoft Digital Defense Report 2025
Phishing-resistant MFA can block more than 99% of identity-based attacks, according to Microsoft's 2025 Digital Defense Report.
1 in 7
orgs don't enforce MFA across SaaS and cloud
Varonis, 2025 State of Data Security Report
1 in 7 organizations do not use or enforce MFA across their SaaS and multi-cloud environments, according to Varonis's 2025 State of Data Security Report.
13%
of enterprise users still lack MFA
Veza, 2026 State of Identity & Access Report
Veza found 13% of enterprise users still lack MFA, a figure that did not change year over year.
37%
of corporate apps not behind SSO (IT estimate)
Dashlane, Shadow IT and IT burnout survey
39% of employees use apps not managed by their company on work devices, and IT leaders estimate 37% of corporate apps are not behind single sign-on, according to Dashlane.
80%
of SSO-capable AI apps aren't behind SSO
Grip Security, 2025 SaaS Security Risks Report
80% of popular AI apps that support SAML single sign-on are not federated through it, according to Grip Security's 2025 SaaS Security Risks Report.
73%
of cloud incidents were aimed at stealing data
Google Cloud, Cloud Threat Horizons Report H1 2026
Attackers targeted data in 73% of cloud-related incidents in the second half of 2025, according to Google Cloud's H1 2026 Threat Horizons Report.
41%
of SaaS incidents came from permission issues
AppOmni, The State of SaaS Security 2025
41% of SaaS security incidents stemmed from permission issues and 29% from misconfigurations, according to AppOmni's 2025 report.
63%
of orgs report external data oversharing in SaaS
Cloud Security Alliance (commissioned by Valence Security), State of SaaS Security Report 2025
63% of organizations report external data oversharing in their SaaS apps, according to the Cloud Security Alliance's State of SaaS Security 2025 survey.
66%
of companies expose cloud data to anonymous users
Varonis, 2025 State of Data Security Report
66% of companies have cloud data exposed to anonymous users, according to Varonis's 2025 State of Data Security Report.
94%
of external SaaS data shares are inactive
Valence Security, 2024 State of SaaS Security Report
94% of external data shares in enterprise SaaS apps are inactive, meaning outsiders keep access they no longer need, according to Valence Security's 2024 State of SaaS Security report.
75%
of orgs had a SaaS security incident last year
AppOmni, The State of SaaS Security 2025
75% of organizations had a SaaS security incident in the past year, up 33% from 2024, according to AppOmni's State of SaaS Security 2025 report.
91%
are confident in SaaS security, despite incidents
AppOmni, The State of SaaS Security 2025
91% of organizations say they are confident in their SaaS security posture, even though three-quarters had a SaaS incident in the past year, per AppOmni's 2025 report.
94%
of orgs had cloud intrusions that exposed data
CrowdStrike, State of Cloud Detection and Response (CDR) Survey
94% of organizations report cloud intrusions that resulted in data exposure or exfiltration, according to CrowdStrike's 2026 State of Cloud Detection and Response survey.
34%
name cloud applications a top attack target
Thales (research by S&P Global 451 Research), 2026 Data Threat Report
Cloud applications are among the top three attack targets for 34% of organizations, and only about half of sensitive data in the cloud is encrypted, according to Thales's 2026 Data Threat Report.
89%
of breached orgs thought they had enough SaaS visibility
AppOmni, The State of SaaS Security 2025
89% of organizations that suffered a SaaS incident believed they had 'appropriate visibility' into their SaaS environment, according to AppOmni's 2025 report.
13%
of orgs use a dedicated SSPM tool
AppOmni, The State of SaaS Security 2025
Just 13% of organizations use a dedicated SaaS Security Posture Management (SSPM) tool, though nearly a third say they need one, per AppOmni's 2025 report.
300%
year-over-year increase in SaaS breaches
Obsidian Security, 2025 SaaS Security Threat Report
SaaS breaches rose 300% year over year between September 2023 and September 2024, according to Obsidian Security's 2025 SaaS Security Threat Report.
76%
of orgs are increasing SaaS security budgets
Cloud Security Alliance (commissioned by Valence Security), State of SaaS Security Report 2025
SaaS security is a high priority for 86% of organizations and 76% are increasing their SaaS security budgets, per the Cloud Security Alliance's 2025 survey.
42%
lack full SaaS discovery capabilities
42% of organizations lack comprehensive SaaS discovery and cannot tell whether employees are using risky GenAI apps, according to Valence Security's 2025-26 research with the Cloud Security Alliance.
34%
don't strictly enforce their sanctioned-app policies
AppOmni, The State of SaaS Security 2024
34% of organizations with policies requiring only sanctioned SaaS apps admit those rules are not strictly enforced, up 12 points from 2023, per AppOmni's 2024 report.
$4.99M
global average cost of a data breach (2026)
IBM, Cost of a Data Breach Report 2026
The global average cost of a data breach rose 12% to a record $4.99 million in IBM's 2026 Cost of a Data Breach Report.
247 days
average time to identify and contain a breach
IBM (reported by Help Net Security), Cost of a Data Breach Report 2026
The average time to identify and contain a breach rose to 247 days in IBM's 2026 Cost of a Data Breach Report, reversing five straight years of decline.
29 min
average attacker breakout time
CrowdStrike, 2026 Global Threat Report
The average eCrime breakout time fell to 29 minutes in 2025, with the fastest observed at 27 seconds, according to CrowdStrike's 2026 Global Threat Report.
68%
need 15+ minutes to detect a cloud intrusion
CrowdStrike, State of Cloud Detection and Response (CDR) Survey
68% of organizations take 15 minutes or more to detect a cloud intrusion and over half need at least an hour, according to CrowdStrike's 2026 State of CDR survey.
14 days
global median attacker dwell time
Google Cloud (Mandiant), M-Trends 2026
The global median dwell time rose to 14 days in 2025 from 11 days in 2024, according to Mandiant's M-Trends 2026.
22 sec
from initial access to hand-off between attackers
Google Cloud (Mandiant), M-Trends 2026
The median time between initial access and hand-off to a second threat group collapsed from more than 8 hours in 2022 to 22 seconds in 2025, according to Mandiant's M-Trends 2026.
52%
of intrusions were detected internally
Google Cloud (Mandiant), M-Trends 2026
Organizations detected 52% of intrusions themselves in 2025, up from 43% in 2024, while 14% were disclosed by the attackers, according to Mandiant's M-Trends 2026.
$4.44M
global average cost of a data breach (2025)
IBM, Cost of a Data Breach Report 2025
The global average cost of a data breach was $4.44 million in IBM's 2025 Cost of a Data Breach Report, the first decline in five years.
$10.22M
average U.S. breach cost (2025)
IBM, Cost of a Data Breach Report 2025
The average cost of a data breach in the U.S. hit a record $10.22 million in IBM's 2025 Cost of a Data Breach Report.
241 days
average time to identify and contain a breach
IBM, Cost of a Data Breach Report 2025
It took organizations an average of 241 days to identify and contain a breach, according to IBM's 2025 Cost of a Data Breach Report.
9 min
from initial access to SaaS data exfiltration
Obsidian Security, 2025 SaaS Security Threat Report
In the fastest SaaS breach Obsidian Security observed, attackers went from initial access to data exfiltration in 9 minutes.
165
organizations exposed in the Snowflake credential campaign
Google Cloud (Mandiant), UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion
Mandiant and Snowflake notified about 165 organizations potentially exposed in the 2024 UNC5537 campaign that used stolen credentials against Snowflake customer accounts without MFA.
IT teams · 64 stats
IT teams run bigger, faster-moving stacks with fewer people per employee.
1:108
IT staff to employee ratio
BetterCloud, 2025 State of SaaS
There is now one IT person for every 108 employees, according to BetterCloud's 2025 State of SaaS report.
62%
of IT leaders say manual work blocks strategic projects
BetterCloud, 2026 State of SaaS Report
62% of IT leaders say manual work is actively preventing them from doing strategic projects, according to BetterCloud's 2026 State of SaaS report.
34%
still track IT assets in spreadsheets
Ivanti, 2025 Digital Employee Experience Report
34% of organizations still rely on spreadsheets to track IT assets, according to Ivanti's 2025 Digital Employee Experience report.
60%
of IT professionals feel burnt out
60% of IT professionals say they feel burnt out by their work, according to Auvik's 2025 IT Trends Report.
58%
spend half their week or more on end-user tickets
58% of IT professionals spend half or more of their work week on tickets resolving end-user requests, according to Auvik's 2025 IT Trends Report.
36%
of IT time spent building custom integrations
MuleSoft (Salesforce), 2026 Connectivity Benchmark Report
IT teams spend an average of 36% of their time designing, building and testing custom integrations between systems, according to MuleSoft.
90%
of organizations lack cross-app automation orchestration
BetterCloud, 2026 State of SaaS Report
90% of organizations still lack true cross-app orchestration, according to BetterCloud's 2026 State of SaaS report.
29%
of IT leaders' top priority is automating IT and SaaS ops
BetterCloud, 2026 State of SaaS Report
29% of IT leaders name automating more IT and SaaS operations as their top priority for the next 12 to 18 months, ahead of SaaS security (19%), according to BetterCloud.
1.6
IT and security staff per 100 employees (median)
Fixify, 2026 IT Help Desk Benchmark Report
The median company has 1.6 IT and security staff per 100 employees, with a practical range of 0.7 to 4.3, according to Fixify's 2026 IT Help Desk Benchmark Report.
1 in 5
help desk tickets stop someone from working
Fixify, 2026 IT Help Desk Benchmark Report
More than 1 in 5 IT help desk tickets is a work stoppage where the employee cannot work, according to Fixify's 2026 benchmark.
3.3%
of IT orgs have fully autonomous AI in service management
SysAid, State of Service Management 2026
61% of IT organizations now use AI in service management, but only 3.3% have reached fully autonomous execution, according to SysAid's 2026 research.
33%
of AI self-service adopters don't measure ticket reduction
SysAid, State of Service Management 2026
33% of organizations using AI-powered self-service in IT are not measuring ticket reduction, according to SysAid's 2026 research.
69%
of IT leaders expect budget increases in 2026
Foundry (CIO.com), 2026 State of the CIO Study
69% of IT leaders expect their IT budgets to increase in 2026, with an average expected rise of 6.93%, according to Foundry's 2026 State of the CIO study.
34%
of IT leaders held back by staff and skills shortages
Foundry (CIO.com), 2026 State of the CIO Study
Staffing and skills shortages are a distraction for 34% of IT leaders, according to Foundry's 2026 State of the CIO study.
56%
of organizations expanding business process and IT automation
Foundry (CIO.com), 2026 State of the CIO Study
56% of organizations are expanding business process and IT automation initiatives in 2026, according to Foundry's State of the CIO study.
1.6
roles the average CIO holds
Foundry (CIO.com), 2026 State of the CIO Study
Three quarters of CIOs say it is difficult to balance business innovation with operational excellence, and the average CIO juggles 1.6 roles, according to Foundry.
78%
plan to add or replace an IT automation platform
Stonebranch, 2026 Global State of IT Automation Report
78% of organizations plan to add (56%) or replace (22%) an IT automation platform in the near term, according to Stonebranch's 2026 Global State of IT Automation report.
46%
say new software deployments drive up ticket volume
Ivanti, 2025 Technology at Work Report
46% of IT professionals say new software deployments drive up help desk ticket volume, according to Ivanti's 2025 Technology at Work report.
38%
say tech complexity is a significant barrier to IT operations
Ivanti, 2025 Technology at Work Report
38% of IT professionals say tech complexity has become a significant barrier to effective IT operations, up four points in a year, according to Ivanti.
37%
say complexity stops them upholding basic security
Ivanti, 2025 Technology at Work Report
37% of IT professionals say their tech infrastructure is so complex they cannot uphold basic security practices, according to Ivanti.
2 in 3
IT pros say daily operations crowd out employee experience
Ivanti, 2025 Digital Employee Experience Report
Nearly 2 in 3 IT professionals say day-to-day IT operations are so overwhelming that employee experience takes a back seat, according to Ivanti.
44%
say workload outweighs their ability to be productive
44% of IT professionals say the burden of work is outweighing their ability to be productive, according to Auvik's 2025 IT Trends Report.
47%
of SME IT admins say too many point solutions is their top challenge
JumpCloud, Q1 2025 SME IT Trends Report
26% of SME IT admins juggle 11 or more IT tools, and 47% rank managing too many point solutions as their top challenge, according to JumpCloud.
74%
of IT leaders say their environment is too complex
JumpCloud, Q3 2025 IT Trends Report
74% of IT leaders say their IT environment is too complex, and organizations rely on more than nine platforms to run IT, according to JumpCloud's Q3 2025 IT Trends Report.
19%
of organizations have fully unified their IT stack
JumpCloud, Q3 2025 IT Trends Report
Only 19% of organizations have fully unified their IT stack, according to JumpCloud's Q3 2025 IT Trends Report.
55%
of companies plan to raise IT budgets in 2026 (down from 62%)
Spiceworks (Ziff Davis / Aberdeen), 2026 State of IT
55% of companies plan to increase IT budgets in 2026, down from 62% in 2025, according to Spiceworks' 2026 State of IT report.
33%
of IT budgets still go to keeping the lights on
IBM Institute for Business Value, Intelligent IT automation
33% of IT budgets are still devoted to maintaining existing systems, according to IBM Institute for Business Value research.
90 vs 140
IT staff per $1B revenue, automated vs not
IBM Institute for Business Value, Intelligent IT automation
Highly automated organizations employ only 90 IT staff per $1 billion in revenue, versus 140 for less automated peers, according to IBM Institute for Business Value.
78%
of IT teams handle password issues every week
Dashlane, Shadow IT and IT burnout survey
78% of IT leaders say their teams deal with employee password issues at least weekly, and 28% daily or more, according to Dashlane research.
73%
of European IT pros have experienced stress or burnout
ISACA, Tech Workplace and Culture survey (Europe findings)
73% of European IT professionals have experienced work-related stress or burnout, and 61% blame heavy workloads, according to ISACA.
31%
IT cost reduction attributed to intelligent automation
IBM Institute for Business Value, Intelligent IT automation
Organizations attribute a 31% reduction in IT costs to intelligent automation, according to IBM Institute for Business Value benchmarking.
23%
of IT pros saw a colleague quit from burnout
Ivanti, 2024 Everywhere Work Report
Nearly one in four IT professionals (23%) say a colleague has resigned due to burnout, according to Ivanti's 2024 Everywhere Work report.
76%
say AI and automation can cut ticket volume
Ivanti, 2024 Everywhere Work Report
76% of IT professionals say AI and automation can help decrease ticket volume and provide better service, according to Ivanti's 2024 Everywhere Work report.
29%
of network and SaaS tasks still done manually
Auvik, IT Trends 2024: Industry Report
On average, 29% of network and SaaS-related tasks are still done mostly or completely manually, according to Auvik's 2024 IT Trends Report.
84%
of IT leaders saw burnout in their direct reports
Gartner Peer Community, One-Minute Insights: Managing Burnout in IT
In a Gartner Peer Community poll, 84% of IT leaders said at least one of their direct reports showed signs of burnout in the past year, and 68% blamed work overload.
60%
of IT leaders felt burnout in the past year
Gartner Peer Community, One-Minute Insights: Managing Burnout in IT
In a Gartner Peer Community poll, 60% of IT leaders said they had personally felt burnout in their role in the past 12 months, with 67% citing an unmanageable workload.
8%
of organizations prioritized automating repetitive IT tasks (2023)
Ivanti, Defending IT Talent Report (Everywhere Work series)
A quarter of IT professionals were seriously considering leaving their jobs within six months, and only 8% of organizations prioritized automation for repetitive tasks, according to Ivanti's 2023 Defending IT Talent report.
29%
of IT workers have high intent to stay
Gartner, Gartner Survey Finds Only 29% of IT Workers Have High Intent to Stay With Current Employer
Gartner found only 29.1% of IT workers globally have high intent to stay with their current employer, the lowest of any corporate function.
36%
have complete IT asset visibility
Flexera, 2026 State of ITAM Report
Only 36% of organizations have complete visibility into their IT estate, down from 43% in 2025, according to Flexera's 2026 State of ITAM report.
70%
of tech execs say the business deploys tech faster than IT can track
IBM Institute for Business Value, CIO/CTO AI control gap study (with Oxford Economics)
70% of CIOs and CTOs say teams across the business are deploying technology faster than IT can track, according to a 2026 IBM Institute for Business Value study.
$3B+
in shadow software spend identified
Tropic, The State of Software Procurement in 2026
Tropic has found more than $3 billion in 'shadow spend' across customer software portfolios, spending that existed before organizations had the visibility to see it.
66%
have visibility into their SaaS environment
Flexera, 2026 State of ITAM Report
66% of organizations have visibility into their SaaS environment, but only 31% have visibility into AI software, according to Flexera.
12%
of SaaS spending is unmanaged
Capgemini Research Institute, On-Demand Tech (FinOps) report
12% of all SaaS spending at large organizations is unmanaged, according to Capgemini Research Institute.
43%
have complete visibility across the tech stack (down from 47%)
Flexera, 2025 State of ITAM Report
Flexera's 2025 State of ITAM Report found complete visibility across the technology stack fell to 43% from 47% a year earlier.
85%
of IT leaders say visibility gaps are a risk
Flexera, 2026 IT Priorities Report
85% of IT leaders say gaps in IT visibility pose a risk to their organization, according to Flexera's 2026 IT Priorities Report.
29%
lack visibility into SaaS spend
BetterCloud, State of SaaSOps 2024
29% of companies say they lack sufficient visibility into their SaaS spend, according to BetterCloud's State of SaaSOps 2024.
47%
of software vendors can see if customers use it
Revenera, Monetization Monitor 2025 Outlook
Only 47% of software producers can see whether a customer is using their software at all, according to Revenera's Monetization Monitor 2025 Outlook.
70%
of organizations will use SMPs by 2028
Gartner (via USU), 2025 Gartner Magic Quadrant for SaaS Management Platforms
Gartner predicts that by 2028 over 70% of organizations will centralize SaaS management using SaaS management platforms, up from less than 30% in 2025.
<10%
of organizations centralized SaaS management on an SMP in 2024
Gartner (quoted by Josys), Magic Quadrant for SaaS Management Platforms 2024
Gartner's 2024 (inaugural) Magic Quadrant for SaaS Management Platforms predicted that through 2027, over 50% of organizations will centralize SaaS management using an SMP, up from less than 10% in 2024.
64%
of ITAM teams manage SaaS licenses
Flexera, 2026 State of ITAM Report
Only 64% of IT asset management teams manage SaaS licenses, compared with 75% that manage cloud software licenses, according to Flexera.
32%
of ITAM team time goes to software optimization
Flexera, 2026 State of ITAM Report
IT asset management teams spend the largest share of their time (32%) on software optimization, followed by audit response (22%), according to Flexera's 2026 State of ITAM Report.
47%
name security and governance their top SaaS management challenge
BetterCloud, 2026 State of SaaS Report
Security and governance became IT's biggest SaaS management challenge for 47% of IT leaders in 2026, up from 28% a year earlier, according to BetterCloud.
86%
of IT leaders call SMPs crucial to AI governance
BetterCloud, 2026 State of SaaS Report
86% of IT leaders say SaaS management platforms are crucial to good AI governance, according to BetterCloud's 2026 State of SaaS report.
90%
of FinOps teams now manage or plan to manage SaaS
FinOps Foundation, State of FinOps 2026 (6th annual)
90% of FinOps practitioners now manage SaaS spend or plan to within a year, up from 65% in 2025, according to the FinOps Foundation's State of FinOps 2026.
5x
more susceptible to a cyber incident without central SaaS management
Gartner (quoted by BetterCloud), Magic Quadrant for SaaS Management Platforms 2025
Gartner warns that through 2027, organizations that fail to centrally manage SaaS life cycles will remain five times more susceptible to a cyber incident or data loss.
52%
of CIOs under pressure to reduce costs
Gartner, The CIO Agenda 2026 / 2026 CIO and Technology Executive Survey
According to Gartner's 2026 CIO and Technology Executive Survey, 57% of CIOs face pressure to improve productivity and 52% face pressure to reduce costs.
38%
of ITAM teams collaborate with FinOps
Flexera, 2025 State of ITAM Report
ITAM teams increasingly work with FinOps: 38% collaborate with FinOps teams and 44% with cloud teams, according to Flexera's 2025 State of ITAM Report.
70%
of IT teams prefer a unified SaaS management platform
BetterCloud, State of SaaS 2025
70% of IT teams prefer a unified SaaS management platform, and 51% find point solutions harder to manage SaaS with, according to BetterCloud's 2025 State of SaaS report.
88%
of IT decision-makers open to switching tech vendors
Spiceworks (Ziff Davis / Aberdeen), 2026 State of IT
88% of IT decision-makers are open to switching at least some tech vendors, and re-evaluating vendors or contracts (39%) is their top cost-saving measure, according to Spiceworks' 2026 State of IT.
52%
report more scrutiny on SaaS purchasing
BetterCloud, State of SaaSOps 2024
52% of IT professionals say SaaS purchases now face more scrutiny than before, according to BetterCloud.
15%
of enterprises prioritized SaaS backup in 2024 (75% by 2028)
Gartner predicts that by 2028, 75% of enterprises will prioritize backup of SaaS applications as a critical requirement, up from 15% in 2024.
48%
invest most heavily in SaaS monitoring and management
Auvik, IT Trends 2024: Industry Report
48% of IT teams say they are investing most heavily in SaaS monitoring and management tools, according to Auvik's 2024 IT Trends Report.
55%
of finance leaders blame tech leaders for lack of transparency
Vertice, Finance vs tech leaders cloud spending survey
71% of finance leaders list SaaS fees among their top three cost-saving priorities, and 55% blame a lack of transparency from tech leaders, according to a Vertice survey.
40%
of multi-SaaS organizations to centralize on an SMP by 2027 (2022 forecast)
In its 2022 Market Guide for SaaS Management Platforms, Gartner predicted that by 2027, 40% of organizations using multiple SaaS applications would centralize management using an SMP, up from less than 25% in 2022.
No statistics match that search.
Try:
Figures marked Torii data come from the Torii SaaS Benchmark Annual Report 2026: aggregated, anonymized discovery data covering the apps, licenses and spend that actually appear in the environments Torii connects to. The 2026 report covers January to December 2025. It does not publish a sample size, and some charts state no measurement window of their own. Where that is the case, the figure says so.
Each third-party statistic links to the page or PDF where the organization that ran the research published it. We excluded roundups and aggregator sites, re-fetched every source to confirm the number is there, and labeled each one as observed data, a survey or a forecast. Vendor research carries the vendor's name, since most of it comes from companies that sell into the problem they measured.
Apps per company ranges from 101 to 957 depending on what is counted. Waste estimates range from 20% to 65%. Read the method line on any card before comparing two figures. A few CyberArk links point to archived copies because the original pages now redirect after its acquisition.
Every statistic on this page, with its source link, method and sample, in one file.
Use Copy citation on any card, or link straight to a statistic with its # link. For Torii figures: Torii, SaaS Benchmark Annual Report 2026, toriihq.com/articles/saas-statistics.
Go deeper
Get the data behind the numbers
Read Torii's full benchmark, and see why Gartner named Torii a Leader in SaaS management platforms.
Gartner, Magic Quadrant for SaaS Management Platforms, Tom Cipolla, et al, 18 June 2026. GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, and MAGIC QUADRANT is a registered trademark of Gartner, Inc. and/or its affiliates and are used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
It depends on what is counted. Torii's discovery data finds 831 apps in the average organization (median 682), shadow IT included. Okta counts 101 apps connected to its single sign-on, and BetterCloud's survey of IT teams puts it at 106.
In Torii's 2026 SaaS Benchmark, 61.3% of apps in the average portfolio are shadow IT, discovered through usage, browser activity or direct sign-up rather than procurement. Only 15.5% are formally approved.
Very. 26 of the top 50 shadow IT apps in Torii's 2025 data were pure-play AI tools, and Torii discovered 694 new AI-native apps in 2025. In Microsoft and LinkedIn's 2024 survey, 78% of AI users said they bring their own AI tools to work.
Estimates vary by method. Vertice's platform data puts 65% of SaaS licenses as unused or underutilized, while Flexera's survey respondents estimate 20% to 32% of SaaS spend is wasted. Torii finds Salesforce licenses have a 55% non-utilization rate.
CyberArk's 2025 survey reports 82 machine identities for every human. Entro's observed data puts the ratio at 144 to 1.
Torii is named a Leader in the 2026 Gartner Magic Quadrant for SaaS Management Platforms, which evaluated 16 vendors. Torii has been a Leader in every edition since the first Magic Quadrant for the category in 2024. The report is available from Torii.
Torii's own figures come from the 2026 SaaS Benchmark Annual Report, based on aggregated, anonymized discovery data. Every other figure links to the organization that published the research. The page holds 694 statistics from 106 publishers.
Citation copied
