SAN FRANCISCO, Sept. 25, 2025 — BeyondID, a KeyData Cyber company, today released a groundbreaking new report that reveals how identity credentials have become the primary currency of today’s cybercrime. The research details how identity credentials – usernames, passwords, tokens, and access rights – are now the “currency of choice” for attackers, and why organizations must urgently prioritize identity-first security strategies.
The report entitled “The Identity Economy: How Gaps in Identity Management Enable and Sustain Cybercrime” explores how attackers exploit systemic weaknesses in identity and access management (IAM), why identity has become the most overlooked area of security investment, and how businesses can strengthen defenses against increasingly AI-powered threats. It also introduces the concept of Identity Exploit Vectors (IEVs) – the systemic weaknesses in IAM practices that attackers consistently exploit – and provides actionable steps to close these gaps.
“Identity has become the new perimeter, yet many organizations still underestimate its role in sustaining the global cybercrime economy. Cybercrime once relied on brute force or network flaws, but now depends on identity,” said Arun Shrestha, CEO of BeyondID. “The stakes have never been higher; yet identity remains one of the most overlooked areas of cybersecurity investment. This report is a wake-up call to prioritize identity as a front-line defense, not a backend concern.”
Key findings from The Identity Economy include:
- Identity credential theft now impacts more than 9 in 10 companies, making it the most widespread security problem across industries.
- Attacks using stolen credentials are not only the most common initial vector but also the longest lasting – an average of 10 months before detection.
- 60% of stolen credentials can be traced to internal actors, most often through inadvertent mistakes.
- AI is a force multiplier, powering more convincing phishing, automating credential harvesting, and even targeting agentic AI identities that carry their own access risks.
- Financial services and healthcare are the most frequently breached industries, with the U.S. healthcare sector reporting a breach affecting 500+ individuals nearly every business day.
BeyondID’s CEO Arun Shrestha will present these findings today alongside Laura Curtaccio, Head of Access Automation, Cybersecurity at Biogen, during a session at Oktane 2025. They will discuss how modern cybercrime is driven by a thriving black market built on stolen credentials and identity exploits, how identity management gaps are being exploited at scale, and how identity-first security strategies and AI-powered defenses can help organizations outpace attackers.
Download the full report and learn how to identify and shut down systemic identity gaps here.
About BeyondID
BeyondID, a KeyData Cyber Company, is a leading AI-powered, Managed Identity Solutions Provider (MISP). By delivering secure solutions and services that help manage digital identities, BeyondID enables organizations to control access to applications, data, networks, and devices while facilitating continuous regulatory compliance and ensuring seamless user experiences. BeyondID has created Secure Total Experiences for organizations like Inception Health, Johnson Financial Group, Biogen, Northern Trust, and Cone Health. More information about BeyondID can be found at www.beyondid.com.
