Identity security is undergoing a significant transformation with the rise of generative AI. This technology is reshaping the landscape for both adversaries and defenders, as they engage in a constant battle to outpace each other in the gen AI arms race. Adversarial AI techniques such as voice phishing (vishing) and deepfakes are experiencing exponential growth rates, according to the latest security research.
CrowdStrike’s 2025 Threat Hunting report highlights a 442% surge in vishing attacks from the first half to the second half of 2024, signaling a significant evolution in eCrime tactics. Adversaries are leveraging AI-driven social engineering and deepfake tools to bypass Multi-Factor Authentication (MFA) and exploit credentials at scale. The report also reveals that 52% of all exploited vulnerabilities are related to initial access, often through compromised identities, with gen AI playing a key role in these trends.
Machine identities now outnumber human users by a ratio of 45:1 in the average enterprise, while attackers can move laterally within just 51 seconds. Traditional identity and access management systems that rely on static rules and periodic reviews struggle to keep up with threats moving at machine speed.
The adoption of gen AI capabilities has accelerated rapidly in 2024, with Gartner predicting that information security spending will reach $213 billion in 2025. This growth is expected to continue, with spending projected to reach $323 billion in 2029. Organizations are increasingly replacing legacy rule-based systems with AI-powered platforms that can learn, adapt, and respond autonomously.
IDC forecasts robust growth in the Identity and Access Management (IAM) market, projecting a doubling in market size from $23.5 billion in 2024 to $47.1 billion in 2028. Gartner emphasizes the importance of IAM strategies that prioritize optimal outcomes by addressing user constituencies and managing access through an integrated fabric of tools.
Security leaders are witnessing a shift in the threat landscape, with 79% of detections now being malware-free, indicating that attackers are gaining access through valid credentials. In response, organizations are increasingly focusing on identity as the new perimeter. With gen AI, defenders now have tools that can learn, adapt, and respond in real-time, cutting off lateral movement before attackers can exploit stolen credentials across various domains.
A case study of Cushman & Wakefield demonstrates the practical impact of gen AI on identity security. The company, as the world’s third-largest commercial real estate services firm, relies on CrowdStrike’s Falcon Next-Gen Identity Security platform to create behavioral baselines for every identity, monitor SaaS applications, assign dynamic risk scores, and take real-time actions when anomalies are detected.
The vendor landscape for identity security is rapidly evolving, with AI-driven solutions like CrowdStrike Charlotte AI, Ivanti Neurons, Microsoft Security Copilot, and Okta Adaptive MFA leading the way in delivering measurable results. These solutions leverage gen AI to enhance identity governance and vulnerability management, moving from reactive approaches to proactive, real-time security resilience.
In conclusion, gen AI is delivering measurable ROI in four key areas that CISOs need to prioritize: reducing investigation times, minimizing excessive privileges, decreasing mean-time-to-detect, and lowering false positives. This technology is already transforming identity governance and threat management into strategic advantages that organizations must embrace to stay ahead of evolving cyber threats.
