CyberArk Study Finds 95% of APJ Organisations Hit by Identity Breaches

Nearly every organisation in Asia Pacific and Japan (APJ) has suffered more than one identity-related breach within a year, according to new global research from CyberArk (NASDAQ: CYBR), the identity security company. The CyberArk 2024 Identity Security Threat Landscape Report, which includes APJ data, argues that treating human and machine identities as separate security problems is fuelling identity-based attacks on enterprises.

The report also looks at how artificial intelligence (AI) strengthens defenders and attackers alike, how quickly identities are now being created in new and complicated environments, and how widespread identity-related breaches have become.

Machines are the riskiest identities

Security professionals surveyed for the study ranked machine identities as the most dangerous type. A machine identity is the unique identifier that tells one piece of software code, an application or a virtual machine apart from others on a network, and it is used to authenticate that machine and authorise its access to resources and services.

Multi-cloud strategies and the spread of AI programs such as large language models are generating these identities in huge numbers, and many of them need sensitive or privileged access. Yet where human access to sensitive data is usually governed, machine identities are frequently left without identity security controls. CyberArk describes them as a broad and powerful threat vector waiting to be exploited. Among its APJ findings:

• 95% of organisations in the region had at least two identity-related breaches over the previous year.
• Organisations expect their number of identities to grow by an average of 2.6 times over the next 12 months.
• 62% define a privileged user as a human only. Just 38% treat every human and machine identity with sensitive access as a privileged user.

AI on both sides, and signs of complacency

CyberArk expects identity-related attacks to grow in number and sophistication as attackers, skilled and unskilled, gain new capabilities such as AI-powered malware and phishing. In APJ:

• Every organisation surveyed has adopted AI-powered tools for its cyber defences.
• 96% expect AI-powered tools to create cyber risk for their organisation in the coming year.
• Only about 70% are confident their employees could spot a deepfake of the organisation's leadership.
• 95% have fallen victim to a successful identity-related breach caused by phishing or vishing.
• 92% faced successful ransomware attacks.

Vincent Goh, CyberArk's president and general manager for Asia Pacific and Japan, linked the 95% breach figure partly to weaker security controls on machine identities than on human ones. He expects machine identities to keep widening the attack surface available to adversaries, particularly as AI adoption speeds up, and said organisations in the region need a holistic cybersecurity strategy that protects human and machine identities together if they are to defend themselves effectively.