The rapid adoption of autonomous AI agents in enterprise environments has created a significant security vulnerability: the widespread use of shared credentials. According to research, 69% of enterprises currently run AI agents using shared API keys or borrowed service accounts, a practice that allows a single compromised agent to inherit the permissions and access rights of every workflow the key touches. This systemic risk is driving a major wave of enterprise security acquisitions, including Palo Alto Networks’ $21.1 billion acquisition of CyberArk and CrowdStrike’s purchase of SGNL.
The Security Risks of Shared Agent Credentials
The core of the current enterprise security challenge lies in identity management. When multiple AI agents utilize the same API key, the forensic trail for any malicious activity becomes obscured. Security teams cannot distinguish which agent initiated a specific action, making incident response difficult.
This lack of granular control is compounded by the sheer scale of machine identities. CyberArk research indicates that there are now 82 machine identities for every human identity within organizations, with AI agents representing the fastest-growing segment. Adam Meyers, senior vice president of counter-adversary operations at CrowdStrike, noted that the complexity is often exacerbated when humans provide their own identities to AI agents to perform tasks, effectively "murkying the water" and preventing clear attribution of actions.
Why Enterprise Acquisitions are Targeting Agent Security
The surge in security-focused acquisitions reflects a move to address the "containment gap"—the lack of isolation between agents and the broader infrastructure. While many companies have invested in detection, few have successfully implemented robust sandboxing or scoped identity management.
Major industry players are moving to fill this void through high-value acquisitions:
- Palo Alto Networks: Finalized the acquisition of CyberArk on February 11 for $21.1 billion.
- CrowdStrike: Acquired runtime authorization platform SGNL for $740 million, integrating it into a new product, Continuous Identity for AI Agents, by June 15.
- Cisco: Announced the intent to acquire non-human identity specialist Astrix Security on May 4 for a reported $400 million to better manage API keys and OAuth tokens.
These moves are designed to address the fact that larger organizations face higher incident rates. Data suggests that while 49% of companies with 101 to 1,000 employees report agent-related security incidents, that figure climbs to 63% for organizations with more than 1,000 employees.
Limitations of Default Security Controls
A significant portion of enterprises (82%) currently rely on native guardrails provided by model hyperscalers like OpenAI, Google, and Microsoft. While these tools are frequently enabled by default, they primarily function as prompt-and-output filters rather than identity-management systems.
Elia Zaitsev, CTO at CrowdStrike, emphasized that these filters address the "intent" of a query, which is a difficult problem to solve, rather than the "kinetic actions" taken by an agent. Because default tools often fail to provide scoped identities or isolation boundaries, they do not offer the level of protection required to prevent a compromised agent from accessing unauthorized systems.
Recommended Security Strategies for Organizations
Security directors are increasingly tasked with closing the gap between current tooling and actual exposure. Experts recommend three primary actions to improve agent security:
- Eliminate Shared Credentials: Audit all agent access and transition toward unique, scoped identities. Organizations should aim for zero shared credentials between agents and zero reliance on borrowed human identities.
- Prioritize Sandboxing: Implement isolation layers for the highest-risk agents. This is the most effective way to limit the "blast radius" of a potential compromise, particularly for larger organizations where internal isolation is currently lowest.
- Align Budget with Risk: While many enterprises report high satisfaction with current security tools, low budget allocation—often 5% or less of total security spending—does not match the high frequency of reported near-misses and incidents.
As the landscape evolves, the market is shifting toward purpose-built identity and authorization platforms that can provide the runtime visibility and control necessary to secure autonomous agent deployments.