Organizations small and large face a pressing issue in the AI era: unauthorized access to sensitive data. A survey by Frisco-based Netwrix, a provider of data security, identity security and IT compliance software, shows it’s an especially big concern for midsize organizations.

In the survey, 40% of midsize organizations — those with 500 to 999 employees — reported unauthorized access to sensitive data in the previous year. That compares with 27% at organizations with at least 10,000 employees and 18% at organizations with fewer than 500 employees.

Worse yet, about 80% of IT and security professionals at midsize organizations said they lacked a single view of where sensitive data is stored and who can access it. The figure fell to 70% for small and large companies.

‘An awkward spot’

Midsize organizations “are in an awkward spot,” Grady Summers, CEO of Netwrix, said in a statement.

“They’re big enough that access has become complicated, but they don’t necessarily have the people or tools of a large enterprise,” Summers said. “That’s how you end up with a lot of access that nobody has a complete picture of.”

The survey, conducted in April, questioned more than 2,300 IT and security professionals at small, midsize and large organizations in 110 countries. Fifty-seven percent of those professionals were in the U.S.

Netwrix reported the survey findings in its 2026 Data and Identity Security Report.

Who’s accessing sensitive data?

At organizations with fewer than 1,000 employees, the Netwrix survey found, 67% said AI and automation had increased the number of identities that can access sensitive data. That compares with 50% at organizations with fewer than 500 employees.

Market research company Gartner, which operates one of its three North American offices in Irving, said the growing use of agentic AI has introduced more challenges in identity and access management. Those challenges include cyberattacks.

The Netwrix survey found 43% of organizations where AI significantly expanded the number of identities with access reported a data breach in the past year. That compares with 11% at organizations where AI hadn’t materially changed access patterns.

Organizations hit by unauthorized access reported financial, reputational and operational damage, the survey said. The figure was 56% for financial damage exceeding $100,000, and 47% for reputational and operational damage.

Security in the AI era

Netwrix isn’t the only North Texas company diving into identity and data security amid the rise of AI.

For example, Dallas-based Island, which offers a secure enterprise browser, is adapting its browser to complications brought about by AI. Last month, Island announced a $400 million Series F round, valuing the company at $6.4 billion.

“We’ve entered a new era in which people and AI agents work side by side,” Island co-founder and CEO Mike Fey said in the funding announcement. “Just like humans, agents need the right context, access, guardrails and accountability to succeed.”

 Earlier this month, Tokyo-based NTT Data opened a Cyber Defense Center in Plano, with the company pointing to its “commitment to helping protect clients worldwide.” The center, staffed around the clock, aims to identify and squash attacks before the damage occurs.

In Irving, DigitalXForce launched a platform earlier this year that tackles increasingly sophisticated cybersecurity threats.

In a LinkedIn post earlier this year, DigitalXForce founder and CEO Lalit Ahluwalia pointed to the use of unapproved AI in the workplace, the rise of deepfakes and sensitive data exposed to external AI systems as current challenges.

“Is your organization prepared for the AI Cyberstorm?” Ahluwalia ominously asked.