As AI agents become increasingly prevalent, organizations are beginning to recognize the critical role of identity security, new findings reveal.

A recent survey by Okta indicates that 85% of companies now consider Identity and Access Management (IAM) a key component of their overall security strategy—rising from 79% the previous year.

However, managing identities for AI agents differs significantly from handling human identities. These non-human identities (NHIs) operate without personal accountability, possess fleeting and variable lifespans, and demand swift provisioning and deactivation. They authenticate via non-traditional means such as API keys and digital certificates.

Moreover, AI agents require narrowly defined, time-limited permissions and often access sensitive data, yet typically lack clear ownership trails and standardized logging. This absence of auditability makes post-incident investigations and recovery efforts particularly challenging.

Consequently, 78% of respondents identified controlling access and permissions for NHIs as their top security priority, followed by 69% citing lifecycle management concerns, 57% pointing to insufficient visibility, and 53% highlighting difficulties in addressing risky NHI accounts.

“One of my biggest worries is AI systems being granted excessive access without adequate oversight,” shared a C-suite executive in Australia’s healthcare and pharmaceutical sector.

“If not managed carefully, these systems could leak confidential information or be hijacked for malicious purposes. Robust monitoring and strict access controls are vital to securing AI environments.”

Despite these concerns, only 10% of organizations report having a mature strategy for NHI management. Less than a third (32%) consistently apply the same governance standards to digital workers as they do to human employees, and just 36% have established a centralized governance framework for AI.

“We lack a clear roadmap and organizational alignment on how to deploy AI effectively. Teams are working in isolation, which means our AI adoption remains fragmented,” admitted a retail vice president based in France.

Identity security demands strong safeguards

For effective governance, Okta advises including AI project leads—such as data officers, data scientists, and business unit leaders—in identity policy development.

Security measures must be integrated across the entire lifecycle, ensuring visibility, access control, and the capability to detect and respond to threats in real time.

Organizations should adopt a secure-by-design model, incorporating strong user authentication, API-level access restrictions, asynchronous processing safeguards, and authorization protocols for Retrieval Augmented Generation (RAG) systems.

“Digital workers must be governed with the same rigor as human employees,” Okta emphasized.

“Just as external personnel like contractors, vendors, and partners are held to strict IAM standards, so too should all non-human identities operating within your IT infrastructure.”

This report coincides with new research from Silverfort, which projects a 29% increase in NHI usage over the next 12 to 18 months. Additionally, 87% of organizations plan to boost investment in workforce identity security.

A significant majority—67%—are either very or moderately concerned about the risks posed by NHIs.

“The reality is, AI agents aren’t machines, nor are they people. They occupy a unique space in between, and thus require their own distinct identity classification,” the firm stated.

“To mitigate risk, AI agent security solutions must ensure each agent is linked to a responsible human operator and governed by policies designed to prevent—and detect—unauthorized or suspicious behavior.”

Be sure to follow php.cn on Google News for ongoing coverage of the latest tech news, expert analysis, and reviews.

The above is the detailed content of Identity security is more important than ever – here’s why. For more information, please follow other related articles on the PHP Chinese website!