Identity Management Found to be Critical Gap in Agentic AI Deployments, According to Survey of C-Level and IT Leaders by Technology Analysts

Rhea-AI Summary

Commvault (NASDAQ: CVLT) released findings from an IDC white paper on resilience operations showing a significant gap between rapid AI adoption and identity-management readiness. Among 539 North American IT and C-level resilience leaders surveyed, about 85% had experienced a cyber incident and 90% said they must improve identity-management to handle risks from agentic AI and other non-human identities.

Nearly two-thirds (58.7%) reported needing major upgrades or a complete overhaul of their identity-management approach, while only 26.7% have dynamic role-based access control for AI and analytics, and 24.7% have documented and tested Active Directory and Entra ID capabilities. The study also found that 57.7% have not fully defined their Minimum Viable Business, and 98.4% see the need for better IT–security team collaboration. According to Commvault, IDC’s new Cyber Readiness Assessment tool, based on this maturity framework and sponsored by Commvault, will be available in the coming months to help organizations benchmark and improve cyber resilience.

AI-generated analysis. How Rhea-AI works. Not financial advice.

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google Not now

90% of respondents say they need identity-management improvements to address AI-related risks, including the surge of non-human identities gaining always-on access to corporate data

TINTON FALLS, N.J., July 16, 2026 /PRNewswire/ -- Commvault (NASDAQ: CVLT), a leader in unified resilience at enterprise scale, today announced findings from the IDC White Paper, Resilience Operations: The Discipline that Makes Readiness Provable, July 2026, sponsored by Commvault, that reveal a gap between the rapid pace of AI adoption and the identity resilience capabilities needed to support it. In tandem, the company also announced the IDC Cyber Readiness Assessment, sponsored by Commvault, an interactive tool that organizations can use to evaluate resilience preparedness for an AI-driven future.

The research was conducted among 539 IT and resilience decision makers in North America, of which approximately 85% have experienced a cyber incident. It found that 90% of respondents believe they need to improve identity-management capabilities to address risks introduced by agentic AI systems. Identity management is a discipline of controlling and governing digital identities, including both human and agent identities, and their access to systems and data across their lifecycle – from creation to decommissioning.

As more organizations deploy agents in volume, the rise in non-human identities – many of which have always-on access and can multiply on demand – may rapidly outnumber human identities. Nearly two-thirds of respondents (58.7%) say significant improvements or a complete overhaul of their identity-management approach is required.

The research also found that:

• Among respondents, 26.7% have dynamic role-based access control (RBAC) supporting AI and analytics.
• Also, 24.7% of respondents have documented and tested their Active Directory and Entra ID capabilities.
• Almost all (98.4%) respondents expressed the need for better collaboration between the teams responsible for IT and security. Additionally, 49.7% say major improvements are needed.

"AI is fundamentally changing how organizations operate, make decisions, and manage risk," said Vidya Shankaran, Field CTO, Commvault. "But many organizations are discovering that the systems designed to govern people are not prepared to govern a growing population of AI agents, machine identities, and autonomous workflows. Identity is a critical Tier 0 application and has a pivotal role to play in an organization's confidence in a clean recovery."

Minimum Viability Awareness is Lacking
The research also points to a broader resilience challenge. More than half of the organizations surveyed (57.7%) have not fully defined their Minimum Viable Business (MVB). At the same time, many continue to face gaps in recovery orchestration, cleanroom capabilities, and cyber-resilience readiness.

To address these challenges, there is a growing need for Resilience Operations (ResOps), an emerging operational discipline that continuously brings together business, security, infrastructure, data protection, and recovery teams around a common objective: maintaining business operations and accelerating recovery in the face of disruption.

"IDC predicts that ResOps will mature from an emerging discipline into a mainstream enterprise capability over the next three to five years," said Frank Dickson, Group Vice President for IDC's Security & Trust research practice. "Organizations that build the governance structures, technical capabilities, and testing disciplines now, before the next major incident, will be better positioned to absorb disruption, protect their customers, and sustain competitive operations in an increasingly hostile threat environment."

Putting Readiness to the Test
To help businesses better understand their current preparedness state, IDC's Cyber Readiness Assessment, sponsored by Commvault, will enable organizations to evaluate their cyber resilience maturity and identify areas where identity, protection, detection, response, and recovery capabilities may require improvement. The assessment is based on the same maturity framework developed through the research and provides participants with a personalized readiness profile.

Methodology
IDC surveyed 539 North American enterprise organizations. Eighty percent of respondents were from the United States, and the remaining 20% in Canada. All respondents were either senior IT decision makers or C-level leaders with extensive knowledge of their organization's resilience posture and strategy.

More Details and Availability
Findings are detailed in the IDC White Paper, Resilience Operations: The Discipline that Makes Readiness Provable, sponsored by Commvault (Doc #US54630626, July 2026). The Cyber Readiness Assessment and white paper are available here. The Cyber Readiness Assessment tool will be available in the coming months.

About Commvault
Commvault (NASDAQ: CVLT) is a leader in unified resilience at enterprise scale. In a constantly evolving threat landscape, Commvault keeps customers ready by unifying data security, identity resilience, and cyber recovery, on one cloud-native, AI-enabled platform. Customers trust Commvault to conduct the fastest, most complete recoveries – not just their data, but their entire business. Purpose-built for the agentic enterprise, Commvault also enables organizations to safely embrace AI while protecting against AI-driven threats.

View original content to download multimedia:https://www.prnewswire.com/news-releases/identity-management-found-to-be-critical-gap-in-agentic-ai-deployments-according-to-survey-of-c-level-and-it-leaders-by-technology-analysts-302826656.html

SOURCE COMMVAULT

FAQ

What did Commvault (NASDAQ: CVLT) and IDC find about identity management for agentic AI in 2026?

Commvault reports that 90% of surveyed IT and C-level leaders believe identity-management capabilities must improve to address risks from agentic AI systems. According to Commvault, rising non-human identities with always-on access are outpacing traditional governance models and stressing existing resilience operations.

How many organizations in the IDC survey for Commvault CVLT have experienced cyber incidents?

According to Commvault, approximately 85% of the 539 North American IT and resilience decision makers surveyed reported experiencing a cyber incident. This high exposure rate underpins the reported urgency around identity resilience, recovery orchestration, and broader cyber-resilience readiness gaps.

What percentage of Commvault CVLT survey respondents need major identity-management changes for AI?

Commvault notes that nearly two-thirds of respondents, specifically 58.7%, say they require significant improvements or a complete overhaul of their identity-management approach. This reflects pressure from growing non-human identities, including AI agents, that often maintain scalable, always-on access to corporate data.

What is the IDC Cyber Readiness Assessment sponsored by Commvault (CVLT)?

The IDC Cyber Readiness Assessment is an interactive tool, sponsored by Commvault, designed to help organizations evaluate cyber resilience maturity. According to Commvault, it uses the survey’s maturity framework to highlight gaps in identity, protection, detection, response, and recovery capabilities.

When will the IDC Cyber Readiness Assessment tool linked to Commvault CVLT be available?

Commvault states that the IDC Cyber Readiness Assessment tool will be available in the coming months. Based on the white paper’s maturity framework, it will provide participants with a personalized readiness profile and identify improvement areas across cyber resilience disciplines.

How prepared are Commvault CVLT survey respondents in defining Minimum Viable Business (MVB)?

According to Commvault, 57.7% of surveyed organizations have not fully defined their Minimum Viable Business, the minimum operations required during disruption. This lack of clarity contributes to broader resilience challenges in recovery orchestration, cleanroom capabilities, and cyber-resilience readiness.

What collaboration issues between IT and security did the Commvault CVLT survey highlight?

Commvault reports that 98.4% of respondents see a need for better collaboration between IT and security teams, with 49.7% calling for major improvements. Stronger cooperation is presented as essential for implementing resilience operations and managing identity, recovery, and cyber threats effectively.