Machine identities now dwarf human users by a staggering 82 to 1. This imbalance, revealed in CyberArk's 2025 research, is overwhelming legacy Identity and Access Management (IAM) systems. These systems, designed for human users, struggle to manage the explosion of AI agents and other non-human entities.
The problem intensified throughout 2025. Microsoft Copilot Studio users created over 1 million AI agents in a single quarter, a 130% increase. These AI agents don't just authenticate; they act, making them a significant security risk. ServiceNow's $11.6 billion investment in security acquisitions this year signals a shift towards identity-centric AI risk management.
Gartner predicts that by 2028, 25% of enterprise breaches will originate from AI agent abuse. Over-permissioned service accounts and shadow agents, often created due to slow cloud IAM and production pressures, exacerbate the problem. Builders prioritize speed, sometimes at the expense of security.
Traditional IAM architectures, including Active Directory, LDAP, and early PAM, were not built for this scale. They lack the agility and sophistication needed to govern the complex workflows of AI agents. This leaves organizations vulnerable to exploitation.
The industry is now racing to develop AI-native identity solutions. Experts believe a new approach is crucial to secure the future of enterprise AI. The focus is shifting towards dynamic, context-aware identity management that can keep pace with the rapidly evolving landscape of machine identities.
Discussion
Join the conversation
Be the first to comment