New research from Rubrik Zero Labs warns that agentic AI is reshaping the identity landscape faster than organisations can secure it.
The study reveals a surge in non-human identities created through automation and API driven workflows, with numbers now exceeding human users by a striking margin.
Most firms have already introduced AI agents into their identity systems or plan to do so, yet many struggle to govern the growing volume of machine credentials.
Experts argue that identity has become the primary attack surface as remote work, cloud adoption and AI expansion remove traditional boundaries. Threat actors increasingly rely on valid credentials instead of technical exploits, which makes weaknesses in identity governance far more damaging.
Rubrik’s researchers and external analysts agree that a single compromised key or forgotten agent account can provide broad access to sensitive environments.
Industry specialists highlight that agentic AI disrupts established IAM practices by blurring distinctions between human and machine activity.
Organisations often cannot determine whether a human or an automated agent performed a critical action, which undermines incident investigations and weakens zero-trust strategies. Poor logging, weak lifecycle controls and abandoned machine identities further expand the attack surface.
Rubrik argues that identity resilience is becoming essential, since IAM tools alone cannot restore trust after a breach. Many firms have already switched IAM providers, reflecting widespread dissatisfaction with current safeguards.
Analysts recommend tighter control of agent creation, stronger credential governance and a clearer understanding of how AI-driven identities reshape operational and security risks.
Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!
