The bottom line: The majority of enterprises are unprepared for the rapid growth of AI agents, whose numbers will soon exceed human identities.
90 percent of IT decision-makers see a need to catch up on identity management for non-human identities. An IDC study for Commvault reveals massive gaps in controlling AI agents and machine identities in enterprises.
The IDC whitepaper “Resilience Operations: The Discipline that Makes Readiness Provable” (published July 2026) is based on a survey of 539 IT and resilience decision-makers from North America (80 percent USA, 20 percent Canada). All participants were IT executives or C-level positions with knowledge of their organization’s resilience strategy. Approximately 85 percent of respondents had already experienced a cyberattack.
90 percent of respondents stated they need to improve their identity management capabilities to mitigate risks from agent-based AI systems. The reason lies in the increasing deployment of AI agents: these non-human identities could soon exceed the number of human identities. AI agents often have persistent access to critical systems and can be rapidly replicated as needed. 58.7 percent of respondents must significantly improve or completely overhaul their identity management approach.
In practical implementation, considerable deficiencies are evident: only 26.7 percent of participants have implemented dynamic role-based access controls that support AI and analytics functions. Only 24.7 percent have already documented and tested how Active Directory and Entra ID can be protected against manipulation and restored in emergencies. Another problem: 57.7 percent of respondents have not fully defined their minimum viability concept—that is, the definition of critical systems, processes, and functions for business continuity.
For decision-makers, it is relevant that 98.4 percent of respondents consider close collaboration between IT and security teams to be essential. Almost 50 percent demand significantly greater efforts than previously undertaken. Gaps also exist in recovery planning, clean room capacity, and general cyber resilience. Commvault CTO Vidya Shankaran emphasizes: “User identity management systems are not prepared for the growing number of AI agents, machine identities, and autonomous workflows. Identity is a critical tier-0 application that is crucial for confidence in smooth recovery.”
Source: www.it-daily.net · Published July 29, 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.7.3.