Rise in Machine Identities Poses New Risks

The proliferation of artificial intelligence agents, accelerated AI adoption, cloud-native innovations and shortened machine identity life cycles are fueling a significant increase in machine identity-related security incidents. These identities include certificates, keys, secrets and access tokens.

See Also: Cracking the Code: Securing Machine Identities

CyberArk’s 2025 State of Machine Identity Security Report shows that organizations are struggling to keep up. Siloed efforts to protect these identities are creating new risks. The report surveyed more than 1,200 security leaders across multiple countries.

The findings reinforce the need for security leaders to implement a cohesive, end-to-end strategy that manages high-priority non-human identities to prevent attacks and outages, especially as AI agents grow in use and the quantum attack timeline shortens.

Rohan Vaidya, area vice president for India and SAARC at CyberArk, told ISMG that prior to the COVID-19 pandemic, enterprises focused primarily on managing human identities, especially those with admin-level access. Privileged identity management solutions were used to manage identities. “We also expanded it a bit to machine identities and it was called Application Identity Management,” Vaidya said.

Most enterprise infrastructure before the pandemic was predominantly on-premises and behind firewalls. The risks grew as remote work became more prevalent and endpoint devices moved outside these firewalls. Cloud adoption also surged during the pandemic, requiring privileges to be reassessed and secured. The number of privileged credentials tied to human, application and machine identities grew exponentially, making traditional access management inadequate – especially against cloud-based attack vectors.

The ratio of machine identities to humans is 82:1, according to the report, and 94% respondents indicated an increase in machine identities over the past three years.

The introduction of AI, particularly AI agents, in enterprises further complicated identity access challenges because these agents act autonomously and present higher risks than generative AI. If an AI agent, for instance, augments a marketing manager, there is risk of data leakage. It is imperative to secure AI agents and other machine identities.

Securing Machine Identities

The CyberArk report outlines the substantial business consequences of failing to protect machine identities, leaving organizations vulnerable to costly outages and breaches. Seventy-two percent of organizations experienced at least one certificate-related outage over the past year – a sharp increase compared to prior years. Additionally, 50% reported security incidents or breaches stemming from compromised machine identities. Companies that have experienced non-human identity security breaches include xAI, Uber, Schneider Electric, Cloudflare and BeyondTrust, among others.

“Machine identities of all kinds will continue to skyrocket over the next year, bringing not only greater complexity but also increased risks,” said Kurt Sand, general manager of machine identity security at CyberArk. “Cybercriminals are increasingly targeting machine identities – from API keys to code-signing certificates – to exploit vulnerabilities, compromise systems and disrupt critical infrastructure, leaving even the most advanced businesses dangerously exposed.”

Key Findings

• Rising frequency of outages: Seventy-two percent of respondents reported at least one certificate-related outage in the past year. Monthly outages affected 67%, and 45% faced weekly outages. This marks a substantial increase from 2022, when just 26% reported monthly outages and 12% faced them weekly.
• Substantial business impact of machine identity-related compromises: Fifty percent of security leaders reported security incidents or breaches linked to compromised machine identities in the previous year. These incidents led to delays in application launches for 51% companies, customer-impacting outages for 44% and unauthorized access to sensitive systems for 43%.
• Machine identities outnumber human identities: The ratio of machine identities to humans now stands at 82:1. Seventy-nine percent of security leaders expect the number of machine identities to grow – by as much as 150% – in the next year.
• AI fuels the threat landscape: Eighty-one percent of security leaders indicated that machine identity security will be critical to securing AI systems. Seventy-nine percent underscored the importance of authentication and authorization for protecting AI models from manipulation and theft.
• Machine identity security programs lack maturity: Ninety-two percent of security leaders reported having some form of machine identity security program, but many of these programs lack cohesion. Forty-two percent cited a lack of a unified strategy as their top concern, 37% reported difficulties with adapting to shorter machine identity life cycles and 37% reported the possibility of adversaries exploiting stolen machine identities.
• Siloed approach to securing machine identities creates risk: Inefficiencies, risk and management challenges are created when multiple tools are used to secure machine identities exist within organizations. Security responsibilities are fragmented, with 53% falling to security teams, 28% to development teams and 14% to platform teams. This fragmentation leads to inefficiencies and increased risks.