World password day: Strengthening identity security in the age of AI

Identity security forms the foundation of enterprise cybersecurity. As cyber threats grow more sophisticated, organisations must move beyond basic access controls and adopt a comprehensive approach that incorporates Zero Trust principles, robust credential management, and continuous monitoring to secure digital identities across all environments.

Credential hygiene: A critical component of cybersecurity

Maintaining good credential hygiene should be a core element of any organisation’s cybersecurity strategy. By implementing MFA, encouraging the use of password managers, and promoting strong, unique password creation, organisations can significantly reduce the risk of cyberattacks and safeguard sensitive data.

However, users must understand the importance of proper credential hygiene. Overly complex password requirements or frequent forced changes can lead to user fatigue, poor compliance, and workarounds that may undermine security. User education, therefore, plays a vital role in maintaining both effectiveness and compliance.

AI Agents and Machine Identities: A new frontier in identity security

AI agents are being rapidly adopted across industries, delivering value in areas such as data science, R&D, customer service, marketing, and sales. However, this is just the beginning. These agents require digital identities to access systems and data, and must be governed with the same rigour as human identities.

Unlike human users, who authenticate using usernames, passwords, and biometrics, machine identities rely on API keys, tokens, and digital certificates. Poorly managed or overlooked machine credentials present a serious security risk.

Chern-Yue Boey, SVP and GM, APJ at SailPoint, explains, “As organisations increasingly embrace AI agents and machine identities such as service accounts and APIs to boost productivity and operational efficiency, it is critical that they adopt best-in-class identity security solutions to manage these identities and reduce their attack surface. While human identities are validated via passwords, usernames and biometrics, machine identities require credentials such as API keys, tokens and certificates. When these credentials are poorly managed or go undiscovered, they become potential points of compromise for attackers.”

The impact of poor credential hygiene

A significant number of high-profile breaches in recent years have been directly linked to poor credential hygiene. Weak or reused credentials enable attackers to move laterally through networks or escalate privileges, leading to data exfiltration, service disruption, or worse.

Storing passwords in plaintext or using weak hashing algorithms creates a critical vulnerability. The widespread theft and resale of credentials on the dark web only amplifies the threat.

According to a 2024 global SailPoint survey, nearly 70% of organisations now manage more machine identities than human ones. Gartner predicts that by 2028, one-third of enterprise software will include agentic AI, with agents autonomously handling up to 15% of daily work decisions. Alarmingly, 57% of surveyed organisations reported incidents where inappropriate access was granted to non-human identities.

Such breaches lead to application launch delays, service outages, and reputational damage demonstrating that the consequences extend beyond security to operational and commercial impact.

Implementing strong credential hygiene

To reduce the danger and these risks, and ensure the secure management of login credentials, such as passwords, tokens, and cryptographic keys, organisations must adopt a comprehensive approach known as strong credential hygiene. This involves a combination of policies, procedures, and technologies designed to protect authentication information from compromise. Key elements include the use of strong, unique passwords, the avoidance of password reuse, the consistent implementation of multi-factor authentication (MFA), and the regular rotation of credentials. In addition, establishing robust password policies and educating employees about phishing and other suspicious activities are essential to strengthening an organisation’s overall security posture. 

Employee education: A cornerstone of security

An organisation’s cybersecurity posture heavily relies on its employees’ understanding of good credential hygiene. This involves being aware of, and adhering to, best practices for managing passwords, tokens, and other authentication methods. While some employees may view password sharing as a harmless shortcut, it in fact exposes the organisation to significant security risks. Without proper education, staff may not fully appreciate the dangers of disclosing their credentials. Effective credential management is essential for maintaining workplace security. By implementing appropriate access controls, using password managers, enabling multi-factor authentication (MFA), and adopting Single Sign-On (SSO) solutions, businesses can significantly reduce the risks associated with credential sharing and unauthorised access. 

Chern-Yue Boey further emphasises, “To mitigate these risks, organisations must implement advanced identity security measures and stronger credential hygiene. Like human credentials, machine credentials must be regularly rotated and revoked to prevent misuse, especially since stale and exposed credentials are common entry points for attackers. Organisations must also enforce strong, unique cryptographic keys and digital certificates for all machine identities and adopt automated credential management and real-time monitoring to keep up with the scale and complexity of machine identities. 

As for AI agents, as they operate autonomously and require access to multiple data sources and systems to function effectively, it is crucial that they are managed with the same degree of visibility, governance, and control as human and machine identities.”

Safeguarding the digital workforce

Without effective credential hygiene, organisations risk exposing sensitive systems, experiencing data breaches, and facing disruptions in software development and deployment. Additionally, poor practices may lead to regulatory penalties and long-term reputational damage.

Boey concludes, “To protect the digital workforce, organisations should invest in innovative identity security solutions that simplify the lifecycle management of AI agents and machine identities. This includes automated identity governance, enforcing access certifications, and being able to track and manage every machine identity from creation to decommissioning, governing each one in line with the organisation’s security and compliance policies.

With this level of oversight, organisations can proactively address potential security risks and compliance issues, while scaling to manage an increasingly diverse and dynamic identity landscape.”

Identity security as a business imperative

In today’s complex threat landscape, safeguarding all digital identities including human, machine, and AI, is no longer optional. Identity security must be treated as a core component of enterprise risk management and business continuity.

Organisations that prioritise identity protection and credential hygiene are not only defending against cyber threats but are also enabling operational agility, regulatory compliance, and digital trust