Frisco, Texas, USA, September 30th / PRNewswire / -- Netwrix, a renowned company in the field of identity and data security, today released new findings from its "2026 Data and Identity Security Report" regarding the healthcare industry. The report indicates that 31% of medical institutions have experienced unauthorized access to sensitive data over the past year, compared to 24% in other industries. Among those institutions where such incidents occurred, 33% reported losses exceeding $250,000, while in other industries, this figure was 21%.

Among 16 industries, the healthcare industry has the lowest confidence that there is no risk of privilege escalation in its Active Directory ( AD ) environment, with 86% of respondents indicating that they do not have full confidence in its Active Directory security. Only 14% of medical institutions claim to have complete confidence, whereas the average level across all industries is 26%.

Netwrix Chief Product Officer Jeff Warren stated: "In the healthcare industry, no one starts from scratch. These systems are built upon decades of legacy systems and are typically supported by Active Directory and all the permissions accumulated within them. AI does not inherit the access rights you wish to grant it; rather, it inherits the rights that it already possesses."

AI is gaining identity at a faster pace than the governance of the healthcare industry.

79% of medical institutions indicate that their non-human identities have not been adequately managed. 75% of the institutions state that AI and automation have increased the risk of sensitive data related to identities over the past two years, and 70% of the institutions claim that their data access management lags behind the adoption speed of AI.

Most medical institutions are unable to immediately determine who has access to the data.

77% of organizations are unable to immediately determine who has access to certain sensitive data, and this challenge is likely to intensify further as the number of AI proxies increases. 61% of organizations stated that it takes several hours and the use of multiple tools to accomplish this task. 48% of organizations indicated that unauthorized access to sensitive data often begins with compromised identities.

In Active Directory, even accounts with limited permissions may be able to access more sensitive resources through delegation and group member relationships, among other pathways. No longer needed permissions can make these pathways more difficult to identify. Netwrix PingCastle can assess the security risks in the Active Directory environment and provide recommendations for remediation.

Netwrix Senior Security Researcher Darryl Baker stated: "Before adding more AI proxies and other non-human identities, medical institutions need to first understand the existing access permissions. An account may seem quite restricted, but it could still lead to more sensitive resources. Proactively identifying paths for permission escalation and clearing those permissions can give you a clearer understanding of what you are handing over to the new identities."

Methodology

Netwrix The "2026 Data and Identity Security Report" is based on a global survey conducted at the beginning of 2026 among 2,317 security professionals. This study conducted a benchmark analysis of 1,889 organizations across more than 60 industries and 12 security dimensions.

The healthcare industry found that based on 145 respondents from the healthcare sector, mainly from the United States, there was a sample size of 16 industries sufficient for industry-level comparisons. Wherever mentioned in the text, the responses from the healthcare industry were compared with those from other industries.

More resources

• Download Netwrix "2026 Data and Identity Security Report"
• Use Netwrix PingCastle to assess the security risks of Active Directory.
• Data, Identity, and AI Security Assessment: A free benchmark tool that evaluates an organization's AI readiness from 12 security dimensions and 5 maturity levels.

About Netwrix

The vision of Netwrix is to create a world where every organization can protect its data and identities. Its 1Secure™ platform unifies identity and data security, helping businesses to fully understand where their data is stored, who has access to it, and how to manage it. With the help of Netwrix, security teams can strengthen data protection, ensure identity security, and stay ahead of evolving threats. Today, more than 13,000 customers, including nearly 25% of the Fortune 500 companies, are using Netwrix solutions in hybrid and AI-driven environments. Netwrix boasts a customer satisfaction rating of 95% and offers flexible delivery models that facilitate rapid deployment, are easy to use, and can scale with the size of the organization.

Media contact: