Legacy IAM was built for humans — and AI agents now outnumber them 82 to 1

The landscape of identity management is rapidly evolving with the rise of AI agents and machine identities outnumbering humans by a staggering 82 to 1. Traditional identity and access management (IAM) systems like Active Directory, LDAP, and early PAM were designed with humans in mind, not machines. As a result, there is a critical need for organizations to adapt to this new reality and implement robust strategies to secure machine identities effectively.

AI agents, in particular, are a rapidly growing and under-regulated category of machine identities that pose significant security risks. These agents not only authenticate but also have the ability to take actions within an organization’s systems. The exponential growth of machine identities has led to a shift in focus towards identity as the control plane for enterprise AI risk.

Research from CyberArk and Gartner highlights the challenges that organizations face in managing machine identities within legacy IAM architectures. Traditional approaches designed for human users are ill-equipped to handle the unique requirements of machines such as devices and workloads. Retrofitting these approaches for machine identities leads to fragmented management and exposes organizations to unnecessary risks.

The governance gap is a major concern, with many organizations still defining only human identities as “privileged users” despite machine identities outnumbering humans. This lack of visibility and ineffective management of machine identities poses a significant security threat, with Gartner predicting that a quarter of enterprise breaches by 2028 will be attributed to AI agent abuse.

To address these challenges, organizations need to adopt dynamic service identities that are ephemeral, tightly scoped, and policy-driven. These identities reduce the attack surface and enable just-in-time access with zero standing privileges. Platforms that unify identity, endpoint, and cloud telemetry are essential for detecting and containing agent abuse in real-time.

Security and AI builders can take practical steps to enhance agentic identity management, including conducting comprehensive audits of all accounts and credentials, building and managing agent inventories before production, transitioning to dynamic service identities, implementing just-in-time credentials, establishing auditable delegation chains, deploying continuous monitoring, evaluating posture management, enforcing agent lifecycle management, and prioritizing unified platforms over point solutions.

As the gap between what AI builders deploy and what security teams can govern continues to widen, organizations must prioritize the security of machine identities to prevent breaches and protect sensitive data. The accelerating rate at which machine identities are proliferating underscores the urgency for organizations to adapt their identity security strategies to the new normal of machine-on-machine attacks. By recognizing the limitations of legacy IAM architectures and embracing dynamic, policy-driven approaches to identity management, organizations can strengthen their security posture and mitigate the risks associated with agentic AI.