91% of Financial Firms Hit by Workforce Identity Incidents as AI Threats Scale

New research reveals that 91% of financial services firms have faced workforce identity incidents or near misses in the last two years. As AI-driven threats like employee impersonation and candidate fraud escalate, fintech leaders must address systemic confusion over who owns identity security and overcome tool sprawl to protect both human and non-human identities.

What was announced

Entrust has released findings detailing a significant gap between the rising sophistication of identity-based attacks and the defensive capabilities of financial institutions. The data shows that nearly all surveyed firms (96%) now consider insider risk a significant threat to their operations. These risks manifest through various vectors, including account takeovers, onboarding access abuse, and the use of AI to facilitate more convincing employee impersonation and candidate fraud.

A primary obstacle to securing these environments is "tool sprawl." According to the report, 56% of senior IT and security leaders in the financial sector identify fragmented systems and tool complexity as the main barriers to achieving robust workforce identity security. This technical debt is compounded by a lack of internal consensus regarding accountability. While 78% of CISOs believe the security team owns identity security, 49% of CIOs claim ownership for their department, and 47% of IT Security Directors point to the IT team. Only 4% of organizations report a shared responsibility model for identity security.

The research advocates for a "Know Your Employee" (KYE) framework to establish confidence in identities throughout the workforce lifecycle. Security leaders believe this shift would yield tangible benefits beyond risk mitigation; 51% stated that stronger identity verification would improve operational efficiency, while 50% noted it would enhance regulatory compliance.

"The voices of IT and security leaders in this survey make it clear why workforce identity is now a boardroom-level security conversation. Organizations have long understood the risks of identity-based attacks, but AI is accelerating the scale and sophistication of these threats while employee verification and access management have not kept pace. As enterprises deploy agentic AI in their environments, they introduce non-human identities that require the same level of trust and protection as human users. Organizations will need identity and authentication frameworks that ensure human and non-human access is verified, authorized, and governed."

Adam Dimopoulos, Chief Information Security Officer at Entrust.

The companies involved

Entrust is a global provider of trusted identities, payments, and data protection solutions. The company operates at the intersection of security and digital transformation, offering a broad portfolio that includes identity verification, certificate issuance, and cryptographic management. In the financial services sector, Entrust is a significant player, providing the infrastructure necessary for secure transactions and workforce management.

The firm has increasingly focused on the challenges posed by the rapid adoption of artificial intelligence within the enterprise. By positioning itself as a provider of identity and authentication frameworks, Entrust competes in a crowded market of cybersecurity vendors but distinguishes itself through its focus on the entire lifecycle of an identity—from initial onboarding to privileged access requests. The company’s emphasis on the "Know Your Employee" (KYE) standard reflects a broader industry move toward applying the same rigorous verification standards to internal staff that have long been required for external customers under Know Your Customer (KYC) regulations.

What FF News has reported before

FF News has extensively tracked Entrust’s efforts to modernize security for financial institutions. In September 2026, the company expanded its cryptographic security platform to address post-quantum risks and compliance. This followed the July 2026 launch of the Agentic AI Trust Accelerator, designed specifically to secure autonomous AI agents within financial environments. Earlier that year, FF News covered the release of a biometric authentication solution aimed at neutralizing AI-generated deepfakes. Additionally, Entrust’s collaboration with Veyco delivered integrated identity verification for UK property transactions, demonstrating the firm’s reach into specialized market segments.

What this means

The financial sector is facing a crisis of accountability in identity management. The fact that only 4% of firms have a shared responsibility model for identity security suggests a dangerous silo effect that AI-driven attackers are already exploiting. While "tool sprawl" is often cited as a technical hurdle, the real vulnerability is the internal friction between CISOs, CIOs, and IT directors. As "agentic AI" introduces non-human identities into the workforce, the traditional perimeter is dissolving. The industry is under pressure to move beyond simple credential checking toward a continuous, KYC-style verification of the person—or agent—behind the access request.