Machine identities lack essential security controls, pose major threat

Siloed approaches to securing human and machine identities are driving identity-based attacks across enterprises and their ecosystems, according to CyberArk.

The CyberArk 2024 Identity Security Threat Landscape Report was conducted across private and public sector organizations of 500 employees and above.

Machine identities often lack identity security controls

While the quantity of both human and machine identities is growing quickly, the report found that security professionals rate machines as the riskiest identity type. In part due to widespread adoption of multi-cloud strategies and growing utilization of AI-related programs like Large Language Models, machine identities are being created in vast numbers.

Many of these identities require sensitive or privileged access. However, contrary to how human access to sensitive data is managed, machine identities often lack identity security controls and, therefore, represent a widespread and potent threat vector ready to be exploited.

93% of organizations had two or more identity-related breaches in the past year. Machine identities are the #1 cause of identity growth and are considered by respondents to be the riskiest identity type.

50% of organizations expect identities to grow 3x in the next 12 months (average: 2.4x). 61% of organizations define a privileged user as human-only.

68% of respondents indicate that up to 50% of all machine identities have access to sensitive data, compared to 64% who report that about half of human identities have access to sensitive data.

Only 38% of organizations define all human and machine identities with sensitive access as privileged users. In the next 12 months, 84% of organizations will use three or more Cloud Service Providers (CSPs).

Organizations rely on AI for cyber defense

The report found that 99% of organizations are using AI in cybersecurity defense initiatives. Furthermore, the report predicts an increase in the volume and sophistication of identity-related attacks, as skilled and unskilled bad actors also increase their capabilities, including AI-powered malware and phishing.

In related findings, counter to expectations, the majority of respondents are confident that deepfakes targeting their organization won’t fool their employees.

99% of organizations have adopted AI-powered tools as part of their cyber defenses. 93% of respondents expect AI-powered tools to create cyber risk for their organization in the coming year.

70%+ are confident that their employees can identify deepfakes of their organizational leadership. Nine out of 10 organizations have been a victim of a successful identity-related breach due to a phishing or vishing attack.

“Digital initiatives to drive organizations forward inevitably create a plethora of human and machine identities, many of which have sensitive access and all of which must have identity security controls applied to them in order to guard against identity-centric breaches,” said Matt Cohen, CEO, CyberArk.

“The report shows that identity breaches have affected nearly all organizations – multiple times in nearly all cases – and demonstrates that siloed, legacy solutions are ineffective at solving today’s problems. To stay ahead a paradigm shift is required, where resilience is built around a new cybersecurity model that places identity security at its core,” concluded Cohen.