Machine Identities Outnumber Humans by More Than 80 to 1: New Report Exposes the Exponential Threats of Fragmented Identity Security

• More than two-thirds of organizations unprepared for threats targeting AI
• Machine identities – most with unsecured access - are skyrocketing, increasing enterprise risk
• Primary causes of risk-generating identity silos are hybrid infrastructures and shadow AI

NEWTON, Mass. & PETACH TIKVA, Israel--(BUSINESS WIRE)--CyberArk (NASDAQ: CYBR), the global leader in identity security, today announced the release of the 2025 Identity Security Landscape, an international study revealing how organizations are inadvertently creating a new identity-centric attack surface through growing use of AI and cloud. The report shows that machine identities are mostly unknown and uncontrolled within organizations, while the primary roadblocks to Agentic AI adoption involve security concerns around external manipulation and sensitive access, signposting the emergence of a new and potent identity security challenge.

2025 Identity Security Landscape Highlights

‘Rise of the machines’ contributes to unsecured privilege sprawl: Machine identities, driven primarily by cloud and AI, now vastly outnumber human identities within organizations, and nearly half have sensitive or privileged access. However, many enterprises leave both human and machine access to critical systems under-secured.

• There are 82 machine identities for every human in organizations worldwide.
• Eighty-eight percent of respondents say that, in their organization, the definition of a ‘privileged user’ applies solely to human identities – but 42% of machine identities have privileged or sensitive access.
• Sixty-one percent do not have identity security controls in place to secure cloud infrastructure and workloads.
• Eighty-seven percent say their organization experienced at least two successful identity-centric breaches in the past 12 months, ranging from supply chain attacks and compromised privileged access to identity and credential theft.

AI is everywhere and identity-centric agentic AI risk looms: Sanctioned and unsanctioned adoption of AI and large language models (LLMs) is simultaneously transforming organizations and amplifying cybersecurity risks. Concerns around the emergence of AI agents and their privileged access underscores the urgency for targeted identity security investment.

• AI is expected to drive the creation of the greatest number of new identities with privileged and sensitive access in 2025.
• Sixty-eight percent say their organizations lack identity security controls for AI.
• Forty-seven percent cannot secure shadow AI usage in their organization.
• AI agent adoption roadblocks include manipulation and sensitive access concerns.

Complexity and identity silos are overwhelming security leaders and undermining business resilience: Fragmented identity security programs and poor environmental visibility are diminishing resilience in the face of evolving cybersecurity threats. Most organizations face increased privilege-related compliance pressure.

• Seventy percent of respondents say identity silos are a root cause of organizational cybersecurity risk.
• Seventy-five percent of security professionals agree that their organizations prioritize business efficiencies over robust cybersecurity.
• Human and machine identities – many of them with privileged access – are expected to double in 2025.
• Eighty-eight percent of respondents are under increased pressure from insurers mandating enhanced privilege controls.

“The race to embed AI into environments has inadvertently created a new set of identity security risks centered around the access of unmanaged and unsecured machine identities – and the privileged access of AI agents will represent an entirely new threat vector,” said Clarence Hinton, Chief Strategy Officer at CyberArk. “To stay resilient, CISOs and security leaders must modernize their identity security strategies to contend with a new and expanding attack surface characterized by the proliferation of identities with privileged access and made worse by damaging identity silos.”

Further information:

• Download the 2025 Identity Security Landscape.
• Blog: The Cybersecurity Investment Most Organizations Are Failing To Secure.
• Identity Security ProTalks: AI, Human Behavior and the Identity Security Risks You Can’t Ignore.

About the report:
The 2025 Identity Security Landscape was conducted across private and public sector organizations of 500 employees and above. It was conducted by market researchers Vanson Bourne amongst 2,600 cybersecurity decision makers. Respondents were based in Brazil, Canada, Mexico, US, France, Germany, Italy, the Netherlands, Spain, UK, UAE, Saudi Arabia, South Africa, Australia, India, Hong Kong, Israel, Japan, Singapore and Taiwan.

About CyberArk
CyberArk (NASDAQ: CYBR) is the global leader in identity security, trusted by organizations around the world to secure human and machine identities in the modern enterprise. CyberArk’s AI-powered Identity Security Platform applies intelligent privilege controls to every identity with continuous threat prevention, detection and response across the identity lifecycle. With CyberArk, organizations can reduce operational and security risks by enabling zero trust and least privilege with complete visibility, empowering all users and identities, including workforce, IT, developers and machines, to securely access any resource, located anywhere, from everywhere. Learn more at cyberark.com.

Copyright © 2025 CyberArk Software. All Rights Reserved. All other brand names, product names, or trademarks belong to their respective holders.