AI Adoption and Fragmented Identities Slow Enterprise Response to Security Alerts, Study Finds

Enterprises spend 11 hours investigating each critical identity-related security alert, slowing teams amid rising AI-driven attack risks. Fragmented identities and over-privileged access worsen visibility and response times.

Published on: Aug 24, 2025
AI Adoption and Fragmented Identities Slow Enterprise Response to Security Alerts, Study Finds

Enterprises Spend 11 Hours on Identity-Related Security Alerts Amid Growing AI Risks

A recent study by Enterprise Strategy Group reveals that enterprises spend an average of 11 person hours investigating and remediating a single critical identity-related security alert. This lengthy response time is slowing security teams as they handle increasing alert volumes, a challenge heightened by the expanding use of artificial intelligence (AI).

Nearly half of businesses have already deployed AI, which introduces new identity types and attack vectors that often outpace existing organizational oversight. Fragmented identities and excessive access privileges across cloud platforms like Azure and AWS, developer tools like GitHub, identity providers such as Okta, and infrastructure components including databases and Kubernetes, add layers of complexity for security teams.

Identity Fragmentation and Alert Overload

Workforce identity teams typically rely on 11 different tools to trace security issues, creating a fragmented picture that limits visibility. This fragmentation results in blind spots, orphaned accounts, inconsistent access privileges, and gaps in audit trails. Each new application and service expands the security surface faster than many organizations can govern it.

“When it only takes minutes for threat actors to move laterally across your infrastructure, 11 hours to investigate an identity-related incident simply isn’t good enough,” said Ev Kontsevoy, CEO of Teleport, which sponsored the research. AI lowers the cost of identity attacks, making these incidents more frequent.

Credential Theft and Its Impact

Credential theft remains a major issue. Attackers use stolen static credentials—passwords and API keys—to impersonate legitimate users. The study found that credential theft accounts for one in five data breaches, with compromised credentials rising 160% so far in 2025.

AI adoption introduces additional risks. With 44% of businesses deploying AI, new silos of identities often emerge, frequently granted over-privileged access to sensitive systems. Over half of IT leaders (52%) cite data privacy as their top AI-related concern.

Addressing the Challenges with Identity Chain Observability

Security teams need tools that can quickly answer vital questions such as: Who accessed a specific database? Were the permissions appropriate? Is the activity unusual? What actions did an identity perform across different platforms during a session?

Current cybersecurity solutions often provide only partial views, leaving gaps that hinder both security and productivity. To address this, Teleport has introduced Identity Security—an identity chain observability solution aimed at reducing detection and response times from hours to minutes.

The study surveyed 370 IT and cybersecurity decision-makers from midmarket and enterprise organizations across financial, manufacturing, and technology sectors, emphasizing the widespread nature of these challenges.

What Executives Should Consider

  • Invest in integrated identity management tools that consolidate visibility across cloud services, developer platforms, and infrastructure.
  • Prioritize reducing over-privileged access to limit attack surfaces, especially as AI adoption grows.
  • Accelerate incident investigation capabilities to respond faster than lateral movement by threat actors.
  • Maintain strong credential management practices to combat rising credential theft.
  • Focus on data privacy concerns related to AI deployments, ensuring compliance and risk mitigation.

For executives steering enterprise cybersecurity strategy, aligning resources to streamline identity investigation workflows and embracing solutions that provide a full view of identity activity is critical. With AI expanding attack vectors and operational complexity, reducing investigation time and improving visibility is no longer optional.

To learn more about AI's role in enterprise security and how to build skills around it, explore the latest AI courses offered by Complete AI Training.