Unknown & uncontrolled machine identities within organizations leading to emergence of new identity security challenges

Experts are saying that organizations are inadvertently creating a new identity-centric attack surface through growing use of AI and cloud. As per CyberArk (NASDAQ: CYBR)’s 2025 Identity Security Landscape, machine identities are mostly unknown and uncontrolled within organizations, while the primary roadblocks to Agentic AI adoption involve security concerns around external manipulation and sensitive access, signposting the emergence of a new and potent identity security challenge.

“The rapid adoption of AI in India’s dynamic business environment has introduced complex challenges when it comes to managing machine identities and their privileged access” — Rohan Vaidya, Area Vice President, SAARC & India, CyberArk

“The rapid adoption of AI in India’s dynamic business environment has introduced complex challenges when it comes to managing machine identities and their privileged access,” said Rohan Vaidya, Area Vice President, SAARC & India, CyberArk. “As AI-driven processes gain momentum, security leaders in India must rethink their identity security strategies to address the growing risk of unmanaged identities, both human and machine. Modernizing these strategies is essential to protecting critical data, ensuring compliance, and mitigating the growing threat landscape.”

Rise of the machines’ contributes to unsecured privilege sprawl

Machine identities, driven primarily by cloud and AI, now vastly outnumber human identities within organizations and nearly half have sensitive or privileged access. However, many enterprises leave both human and machine access to critical systems under-secured. 

The study reports that there are 82 machine identities for every human in organizations worldwide. In 88% of organizations, the definition of a ‘privileged user’ applies solely to human identities – but 42% of machine identities have privileged or sensitive access. 58% do not have identity security controls in place to secure cloud infrastructure and workloads. And 76% of organizations experienced at least two successful identity-centric breaches in the past 12 months, ranging from phishing and vishing attacks including deepfakes, compromised privileged access to identity and third-party identity theft.

AI is everywhere & identity-centric agentic AI risk looms

Sanctioned and unsanctioned adoption of AI and large language models (LLMs) is simultaneously transforming organizations while amplifying cybersecurity risks. Concerns around the emergence of AI agents and their privileged access underscores the urgency for targeted identity security investment.

The study predicts that AI will drive the creation of the greatest number of new identities with privileged and sensitive access in 2025. 68% of organizations lack identity security controls for AI. 37% cannot secure shadow AI usage in their organization. And AI agent adoption roadblocks include manipulation and sensitive access concerns.

Meanwhile, complexity and identity silos are overwhelming security leaders and undermining business resilience. Fragmented identity security programs and poor environmental visibility are diminishing resilience in the face of evolving cybersecurity threats. Most organizations face increased privilege-related compliance pressure.

68% of Indian respondents say identity silos are a root cause of organizational cybersecurity risk. 77% of Indian security professionals agree that their organizations prioritize business efficiencies over robust cybersecurity. Human and machine identities – many of them with privileged access – are expected to double in 2025. And 85% of Indian organizations are under increased pressure from insurers mandating enhanced privilege controls.

Disclaimer: This article is based on a press release and has been published with minimal modifications for clarity and formatting.