As automation and Agentic AI drive an unprecedented surge in machine identities, Omer Grossman, Chief Trust Officer, CyberArk, says organisations are being forced to rethink identity security governance at scale.
The rapid acceleration of automation across enterprise IT has fundamentally reshaped how identities are created managed and secured. From provisioning and workload management to containers and Artificial Intelligence agents nearly every aspect of infrastructure is now automated. This shift has triggered an explosion in machine identities often referred to as identity sprawl.
Each machine or agent requires its own identity and CyberArk research shows that machine identities already outnumber human ones by 82 to 1. In the APAC region this growth is especially pronounced as organisations aggressively modernise cloud and DevOps environments.
Cloud platforms in particular generate short-lived high-privilege machine identities at massive scale. Security teams are being asked to balance what can be described as a three-legged stool: identities that are short-lived high-privilege and created at scale through automation.
A financial services firm in Singapore for example may start with 50,000 machine identities. Once it automates its DevOps pipeline that number can grow ten-fold to 500,000 in under 18 months.
Automation is essential for managing millions of certificates secrets and credentials. At the same time it amplifies security challenges. This reality demands a dynamic adaptive approach where identity lifecycle management becomes a core operational requirement and every identity interacting with a system is continuously verified.
The security risks tied to this growth are significant. The first wave of AI focused on Machine Learning and predictive analytics followed by Generative AI which made the technology conversational and creative. Today the third wave is Agentic AI.
Agentic AI systems are autonomous agents that can sense their environment reason make decisions and act without direct human oversight. These agents operate at machine speed and scale making manual oversight impractical.
One of the biggest issues is visibility. Many organisations lack a complete inventory of their machine identities particularly hybrid identities that are partially human-managed and partially automated. To avoid disrupting automated processes service accounts are often granted excessive permissions. If one such identity is compromised the resulting blast radius can be enormous.
Another challenge is credential hygiene. Machine identities rely on frequent rotation of secrets and certificates. Managing this manually becomes overwhelming when tens of thousands of machines require updates every few hours or days.
Security teams also face fragmented policy environments across AWS GCP on-premises infrastructure and software-as-a-service platforms. Maintaining consistency often requires switching between multiple dashboards which increases operational risk.
The danger is not theoretical. A service provider may discover that 30% of its machine identities are unmanaged and exposing critical APIs. Without unified automated governance maintaining control becomes impossible.
Deploying AI-driven solutions for machine identity management introduces its own risks. Over-reliance on automation means a single misconfigured policy can propagate instantly across thousands of services. Minor errors have already caused major outages due to automation amplifying mistakes at scale.
There are also concerns around AI bias and transparency. Models are only as reliable as the data they are trained on. If that data is biased then risk scoring user classification and access decisions will reflect those flaws. With agentic AI often operating as a black box misclassifications may only become visible after a serious failure or ethical issue emerges.
Integration remains another obstacle. Many organisations are introducing AI-based tools while still relying on legacy systems never designed for this level of automation. As a result teams often lack clear playbooks for aligning AI-driven operations with existing security and compliance frameworks.
As AI accelerates machine identity growth zero trust becomes even more critical. Its core principle of ‘always verify never trust’ must now apply equally to human and machine identities.
AI-powered machine identity security strengthens zero trust by enabling continuous contextual validation. Policies no longer need to be static. Behaviour-based rules can be adjusted in real time based on context and intent.
This approach supports just-in-time access and zero standing privileges where permissions are granted only when needed and removed immediately afterwards. The result is a reduced attack surface and lower risk of credential misuse.
Looking ahead security teams must adapt to a world where autonomous systems create and manage identities independently. AI tools are not a replacement for Security Operations Centre analysts but they can enhance pattern recognition and monitoring at scale.
A promising shift is emerging towards intent-based security. Rather than focusing solely on infrastructure protection organisations are beginning to assess the purpose and behaviour of agents themselves.
This requires a unified source of truth for autonomous entities similar to a configuration management database. From there organisations can apply behavioural analytics to detect privilege escalation or activity drift supported by auditable logging for compliance and traceability.
Humans will continue to define policies and interventions while AI handles continuous monitoring. Over time a central architectural control point is likely to emerge acting as a security gateway for AI agents. Much like an API gateway it would provide real-time tracking logging and enforcement allowing suspicious sessions to be terminated instantly.
Quantum computing adds another layer of urgency. Once mature it will be capable of breaking RSA and ECC undermining the cryptographic foundations of machine identities TLS certificates and API keys. Threat actors are already engaging in ‘harvest now decrypt later’ strategies by collecting encrypted data today.
Organisations must begin post-quantum planning now. The first step is building a full cryptographic inventory to understand where keys certificates and algorithms are used. High-risk systems should be prioritised alongside preparation for hybrid cryptography where post-quantum algorithms operate alongside existing standards.
Centralised key and encryption management will be essential for maintaining crypto agility. Using trusted vetted cryptographic libraries rather than bespoke implementations will simplify transitions as standards evolve.
Migrating to quantum-safe algorithms presents practical challenges. Shared services and libraries must be pre-architected so cryptographic updates can be made from one or two central points rather than across fragmented environments.
Interoperability will be a major hurdle particularly for legacy and IoT systems tied to static hardware or firmware. Some devices will need to be upgraded or retired entirely increasing operational complexity as machine identities scale into the millions.
Over the next three to five years Agentic AI governance will become a defining security issue. Two concepts are set to dominate. The first is Agentic lifecycle administration ensuring agents are governed from creation through retirement. The second is the emergence of guardian agents acting as independent supervisory layers for compliance ethics and security.
Identity security will also converge across humans machines and AI agents requiring unified platforms capable of managing all three. Predictive analytics will further enhance security by forecasting identity risks before incidents occur.
By understanding an agent’s motivation intent and logic organisations will be better positioned to anticipate threats rather than simply react to them.
