Identity security is more important than ever – here’s why
Agentic AI adoption means identity security is a critical focus for cyber professionals
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
You are now subscribed
Your newsletter sign-up was successful
Organizations are cottoning on to the importance of identity security with the arrival of AI agents, new research shows.
According to a survey from Okta, 85% now view Identity and Access Management (IAM) as important to their security posture, up from 79% last year.
Managing AI agent identity is different from managing human user identities, Okta noted.
They lack accountability, have short, dynamic lifespans requiring rapid provisioning and de-provisioning, and rely on various non-human authentication methods like API tokens and cryptographic certificates.
Similarly, they need very specific and granular permissions for limited periods and can access privileged information, while often lacking traceable ownership and consistent logging, complicating post-breach audits and remediation.
As a result, 78% of survey respondents said that controlling access and permissions for non-human identities (NHIs) was their main NHI-related security concern, with 69% similarly worried about lifecycle management, 57% about poor visibility and 53% about remediating risky NHI accounts.
“I’m most concerned about AI systems having too much access without proper controls,” said one Australian C-level executive in healthcare and pharmaceuticals.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
"If not carefully managed, they can expose sensitive data or be exploited for attacks. Strong oversight and access control are essential to keep AI secure.”
However, the study found only 10% of organizations have a well-developed strategy for managing NHIs. Fewer than a third (32%) said they always treat digital labor forces with the same degree of governance as human workforces, and only 36% currently have a centralized governance model for AI.
“We are missing a roadmap and are not aligned on how we as a group should implement AI. Some of the team are working as silos, so we do not yet have a cohesive approach to adopting AI.” said one retail VP in France.
Identity security needs strict guardrails
In terms of governance, Okta recommends involving AI project leaders, including data officers, data scientists, and line-of-business leaders.
Security, including visibility, access controls through the entire lifecycle and the ability to detect and respond to threats should be deeply embedded.
Enterprises are also advised to implement a secure-by-design approach, including user authentication, API access controls, asynchronous workflows, and authorization for Retrieval Augmented Generation (RAG).
"Treat your digital labor forces with the same degree of governance as human workforces,” Okta said.
“Just as contractors, consultants, vendors, partners, and other members of your extended workforce should be subject to the same strict IAM controls as your in-house workforce, so too should the NHIs operating within your IT environment."
The report comes as new research from Silverfort finds the use of NHIs is expected to grow by 29% over the next 12-to-18 months, with 87% of organizations planning to increase their spending on workforce identity security.
Two-thirds (67%) are either very concerned or concerned about the potential for damage relating to NHIs.
"The truth is, AI agents are not machines, nor are they human. They lie somewhere in between and therefore need to be treated as their own category of identity," said the firm.
"An AI agent security solution needs to address these concerns, so every AI agent is tied to a human and has the proper policies in place to prevent (and detect) improper activity."
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- How to implement identity and access management (IAM) effectively in your business
- Machine identity attacks will be top of mind for security leaders in 2025
- Palo Alto Networks eyes identity security gains with huge CyberArk acquisition
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
CISA shares lessons learned from Polish power grid hackNews New CISA guidance aims to help CNI operators implement secure communications
-
AI and Sustainability: The dual forces reshaping the data center ecosystem - and the channel opportunity aheadIndustry Insights Data centers face power and sustainability limits, creating new opportunities for channel partners
-
Notepad++ hackers remained undetected and pushed malicious updates for six months – here’s who’s responsible, how they did it, and how to check if you’ve been affectedNews Hackers remained undetected for months and distributed malicious updates to Notepad++ users after breaching the text editor software – here's how to check if you've been affected.
-
CISA’s interim chief uploaded sensitive documents to a public version of ChatGPT – security experts explain why you should never do thatNews The incident at CISA raises yet more concerns about the rise of ‘shadow AI’ and data protection risks
-
Former Google engineer convicted of economic espionage after stealing thousands of secret AI, supercomputing documentsNews Linwei Ding told Chinese investors he could build a world-class supercomputer
-
90% of companies are woefully unprepared for quantum security threats – analysts say they need to get a move onNews Quantum security threats are coming, but a Bain & Company survey shows systems aren't yet in place to prevent widespread chaos
-
LastPass issues alert as customers targeted in new phishing campaignNews LastPass has urged customers to be on the alert for phishing emails amidst an ongoing scam campaign that encourages users to backup vaults.
-
NCSC names and shames pro-Russia hacktivist group amid escalating DDoS attacks on UK public servicesNews Russia-linked hacktivists are increasingly trying to cause chaos for UK organizations
-
An AWS CodeBuild vulnerability could’ve caused supply chain chaos – luckily a fix was applied before disaster struckNews A single misconfiguration could have allowed attackers to inject malicious code to launch a platform-wide compromise
-
There’s a dangerous new ransomware variant on the block – and cyber experts warn it’s flying under the radarNews The new DeadLock ransomware family is taking off in the wild, researchers warn
