CISOs have Machine Identities but programmes are rarely mature.
The number of ‘Machine identities’ is increasing, leading to two-thirds of UK organisations experiencing at least one certificate-related outage in the past year.
Named by CyberArk as including certificates, keys, secrets and access tokens, the company said Machine Identities “are exploding amid the rise of AI adoption, cloud native innovations and shorter machine identity lifespans.”
However nearly half (43 percent) of security leaders reported security incidents or breaches due to compromised machine identities. This led to delays in application launches, outages impacting customer experience and unauthorised access to sensitive data or networks.
Kurt Sand, GM of machine identity security at CyberArk, said: “Cyber-criminals are increasingly targeting machine identities – from API keys to code signing certificates – to exploit vulnerabilities, compromise systems and disrupt critical infrastructure, leaving even the most advanced businesses dangerously exposed.
“This research highlights the urgency for security leaders to establish a comprehensive, end-to-end machine identity security strategy that tackles the non-human identities that matter most to prevent potential attacks and outages—especially as AI agents continue to rise and the quantum attack timeline shortens.”
Research of the 1200 security leaders also found 86 percent have some form of machine identity security programme, many of these programmes lack maturity. This is the biggest concern for 40 percent, followed by challenges adapting to shorter machine identity lifecycles (36%) and expired certificates leading to service disruptions and outages (33%).
Written by
Dan Raywood is a B2B journalist with 25 years of experience, including covering cybersecurity for the past 17 years. He has extensively covered topics from Advanced Persistent Threats and nation-state hackers to major data breaches and regulatory changes.
He has spoken at events including 44CON, Infosecurity Europe, RANT Forum, BSides Scotland, Steelcon and the National Cyber Security Show, and served as editor of SC Media UK, Infosecurity Magazine and IT Security Guru. He was also an analyst with 451 Research and a product marketing lead at Tenable.
