- New research from Delinea has found gaps in AI preparedness
- Organisations admit to compromising identity security
- The company suggests balancing needs and risks
A growing number of organisations are compromising identity security in the race to deploy artificial intelligence, according to new research from Delinea.
The report, Uncovering the Hidden Risks of the AI Race, finds that 90 per cent of organisations are pressuring security teams to loosen identity controls to support AI initiatives – despite significant shortcomings in how AI-driven identities are discovered, monitored and governed.
Based on a global survey of more than 2,000 IT decision-makers actively using or piloting AI, alongside analysis of real-world cyber incidents, the findings point to a structural challenge.
As automation expands, so does the number of identities within enterprise systems – particularly non-human identities (NHIs), such as those used by AI agents and machine processes.
Nearly 90 per cent of respondents reported at least one identity visibility gap, with the most pronounced weaknesses linked to these machine-driven accounts.
Critically, these gaps are more likely to persist in AI environments, occurring at nearly double the rate seen in legacy or on-premises systems. This suggests that as organisations modernise, they may inadvertently be introducing less mature security controls.
“The pressure to move fast on AI is real, but identity governance has not kept pace, which exposes enterprises to significant risk. As AI agents multiply across enterprise environments, these identities often have the least oversight. The organisations that will succeed in the AI era will be the ones that enforce real-time, contextual access across every human, machine, and agentic AI identity.” – Art Gilliland, CEO at Delinea.
The report also highlights a clear shift in the threat landscape, revealing that some 42 per cent of organisations identified AI expansion as a leading driver of increased NHI risk over the past 12 months – outpacing both increased automation and CI/CD velocity (26 per cent) and the growth of cloud-native workloads (26 per cent).
At the same time, accountability remains limited, with eighty per cent of organisations sharing they are unable to consistently determine why an NHI performed a privileged action, raising concerns about traceability in automated environments.
Compounding the issue, 59 per cent of organisations reported lacking viable alternatives to standing privileged access for NHIs and AI agents.
Perhaps what is most striking in the data is what Delinea describes as an ‘AI security confidence paradox’.
Despite clear governance gaps, 87 per cent of respondents believe their identity security posture is ready to support AI-driven automation.
Yet nearly half (46 per cent) acknowledge deficiencies in identity governance for AI systems. Organisations were also twice as likely to rate their ability to discover and manage identities in AI environments poorly compared with legacy systems.
A similar disconnect appears in monitoring practices.
While 82 per cent of respondents expressed confidence in their ability to discover NHIs with access to production systems, fewer than one in three organisations validate NHI or AI agent activity in real time.
As AI agents increasingly interact with sensitive data and infrastructure, the report argues that organisations must adopt more robust identity frameworks – ones that can scale alongside automation.
