70% of Enterprise AI Systems Share Authentication Credentials Across Multiple Agents

Enterprise artificial intelligence agent authentication management has serious vulnerabilities. According to a survey conducted by VentureBeat in June 2026 (targeting 107 companies with over 100 employees), 69% of companies are sharing API keys (authentication information used to access systems) among artificial intelligence agents in some form. In a situation where multiple agents reuse a single key, if one of them is compromised by an attacker, there is a risk that all the authority held by other agents will also be stolen simultaneously. Furthermore, it becomes difficult to keep records showing which agent did what and when, making damage tracking and root cause identification difficult.

Artificial intelligence agents are programs that autonomously perform tasks based on user instructions. They have been rapidly spreading as a means of business automation in enterprises in recent years. On the other hand, the establishment of identity management—determining what authority an agent has and who manages it—is not keeping pace with the speed of deployment. The survey reveals that only 32% of companies can assign individually managed identities to all agents, while the majority of the rest have some or most agents sharing authentication credentials.

These risks are already becoming a reality. In the survey, 54% of companies reported experiencing security incidents or near-incidents related to agents. Of these, 18% experienced actual incidents, and 36% came close to compromise but did not result in a breach. The survey suggests that while security teams often contain the situation at the final line of defense, their margin for error is small.

Against this background, major security companies have been making successive acquisitions. Palo Alto Networks completed the acquisition of CyberArk, a leading identity management company, for approximately 21.1 billion dollars on February 11, 2026. CrowdStrike acquired SGNL, a runtime authorization platform, for 740 million dollars and announced Continuous Identity for AI Agents on June 15, 2026. This is a product that verifies an agent's owner, caller origin, and device risk status in real time. Cisco also announced its intention to acquire Astrix Security, a non-human identity management specialist, for approximately 400 million dollars on May 4, 2026. The combined investment by all three companies exceeds 22 billion dollars.

These moves reflect the recognition that artificial intelligence agent security is becoming a core business issue. Traditional enterprise security has been built primarily on the premise of authenticating human users. However, in an era where artificial intelligence, not humans, operates autonomously and accesses internal systems and external services, a mechanism to identify and manage each agent as a distinct entity becomes essential. The intensive investment by major companies in this field can be seen as an effort to fill precisely that void.

It should be noted that this survey reflects the perspective of mid-sized enterprises and does not directly represent the situation of all large enterprises. Nevertheless, as organizations deploy more artificial intelligence agents, the risk that operations will proceed before authentication management systems are established increases. Narrowing agent permissions and establishing systems to track behavior become important prerequisites for future artificial intelligence utilization. VentureBeat plans to release the full version of the survey at VB Transform, scheduled for July 14-15, 2026 in Menlo Park, California.