AI Agents Now Outnumber Employees 45 to 1: Why Non-Human Identity Is Enterprise Security's Next Crisis

Walk into most enterprise security reviews in 2026 and you’ll hear a lot about AI agent sprawl, shadow deployments, and governance gaps. What you’ll hear a lot less about is the plumbing underneath all of it: identity. Every agent that files a ticket, queries a database, or calls an API has to authenticate as something. That something is a non-human identity (NHI) — and enterprises are now creating them faster than they can track, secure, or even count them.

The scale of the problem has quietly become staggering. The Cloud Security Alliance puts the average enterprise ratio of non-human to human identities at 45 to 1, climbing as high as 144 to 1 in cloud-native environments. Palo Alto Networks’ 2026 Identity Security Landscape report puts the figure even higher, at 109 to 1, up from 82 to 1 the year before — with AI agents alone accounting for roughly 73% of that machine-identity population, a share the report projects to keep growing as machine identities are expected to increase 77% over the next 12 months. Whichever number you trust, the direction is the same: identity sprawl is accelerating faster than any team can govern it by hand, and it’s becoming the operational reality behind the agent sprawl enterprises are already struggling to contain.

This post looks at why AI agents broke the old model of machine identity, how big the resulting gap actually is, and what a practical governance response looks like for enterprises deploying agents in 2026.

Why AI Agents Aren’t Like Old Service Accounts

Enterprises have managed non-human identities for decades — API keys, service accounts, cron jobs. What’s different about an AI agent’s identity is that it’s dynamic rather than static. A traditional service account is provisioned once and largely left alone; an agent identity is often spun up at the start of a task, used to call multiple downstream APIs and tools, then torn down within minutes.

That lifecycle should, in theory, make agent identities more secure: ephemeral credentials are harder to steal because they don’t exist for long. In practice, most identity and access management (IAM) infrastructure was built for humans and static machines, not for entities that are created and destroyed at machine speed. IANS Research faculty member Jake Williams put it bluntly in the firm’s 2026 identity security analysis: developers trying to work around clunky OAuth consent flows for agents are building “AuthN/AuthZ patterns that look like they belong in ‘Hello World’ examples, not enterprise applications.” Teams are bolting agent authentication onto frameworks that weren’t designed for autonomous, non-deterministic callers, and the gaps show.

The New Attack Surface

An over-permissioned agent identity is a bigger liability than an over-permissioned human account, because agents act continuously and at volume. The CSA whitepaper found that 1 in 20 non-human identities carries full administrative privileges, and 47% of NHIs go unchanged for over a year once created — meaning permissions granted for a single task quietly persist long after that task is done. That combination of high privilege and low review turns every forgotten agent credential into a standing liability, echoing the same blind spot enterprises are grappling with around vendor-embedded AI they never explicitly approved.

How Big Is the Governance Gap, Really?

The numbers on the management side are just as sobering as the growth numbers. According to the same CSA research, 51% of organizations report no clear ownership of their AI-related identities, 16% don’t even track the creation of new ones, and 78% have no documented policy for creating or removing an AI identity at all. Only 20% have a formal process for offboarding API keys once an agent or integration is retired.

Confidence hasn’t caught up to the risk, either: just 15% of organizations feel highly confident they could prevent an NHI-based attack, and only 8% express high confidence that their legacy IAM systems can handle AI-agent-scale identity risk. That gap between deployment and control is exactly the theme running through the broader shift toward agent fleets outpacing the governance structures built to manage them.

The credential-leak data adds urgency. GitGuardian-style tracking cited in the CSA report found AI-related secrets exposed in public repositories jumped 81% year-over-year in 2025 to 1.27 million exposures — the fastest-growing credential category tracked. And when a credential does leak, response times lag badly: 24% of organizations need more than 24 hours to rotate or revoke an exposed credential once it’s detected, and 30% take over a day just to triage a high-severity leak, per the same analysis.

Why Traditional Identity Tools Fall Short

At Identiverse 2026, Forrester’s recap of the industry’s flagship identity conference captured the shift succinctly: the conversation has moved from “actions, not access” — that is, from a model of granting static permissions up front to one of making continuous, real-time authorization decisions about what an agent is doing right now. That’s a fundamentally different engineering problem than classic role-based access control, and it’s why standards built for it — SPIFFE, the emerging Auth.md convention, and the AIUC-1 framework for agent identity — are all still under 12 months old and incomplete, according to Forrester’s session notes.

The recommended design pattern emerging from that conversation is delegation, not impersonation: an agent should act as a uniquely identifiable entity with its own scoped, auditable permissions, rather than borrowing a human user’s or a service account’s broader access. That distinction matters enormously for audit trails and incident response — if an agent’s actions are indistinguishable from a human’s in your logs, you cannot answer the basic question of what the agent actually did on its own.

Regulation Is Starting to Notice

Identity governance for agents isn’t purely a security-team concern anymore — it intersects directly with compliance. The EU AI Act’s Article 50 transparency obligations, which became enforceable on August 2, 2026, require disclosure whenever a user is interacting with an AI system rather than a human, adding a legal dimension to knowing exactly which identity — human or agent — performed a given action. That obligation sits alongside the broader compliance push enterprises are already navigating in preparing for AI Act enforcement deadlines.

What Enterprises Are Doing About It

Budget is starting to follow the risk, unevenly. IANS Research ranks “identity assurance for an AI world” as the second-highest CISO priority for 2026, behind only deploying AI within security operations itself, and its data shows large enterprises (over $5 billion in revenue) already allocate around 12% of security budget to IAM, compared to 6% at smaller organizations. That gap suggests smaller and mid-market companies — often the ones adopting agents fastest because they lack legacy process overhead — are also the least resourced to govern them.

On the practical side, three shifts show up repeatedly in how mature organizations are responding: inventory before policy — standing up continuous discovery for agent identities, including ones spun up by SaaS vendors’ embedded AI features, before writing any access rule for a population they can’t yet see; short-lived, scoped credentials by default — replacing long-lived API keys with credentials that expire with the task and carry fine-grained, purpose-bound permissions instead of broad roles; and real-time authorization over static roles — evaluating each significant agent action against context, the “actions, not access” model Forrester flagged as the direction the identity industry is converging on.

Actionable Takeaways

• Run an identity census, not just an agent census. Knowing which agents exist isn’t enough — you need to know what credentials each one holds, what scope those credentials grant, and who owns the decision to revoke them.
• Set an offboarding SLA for agent credentials. If your organization doesn’t have a documented process for retiring an agent’s access when a project ends, that’s the single highest-leverage gap to close first, given how many organizations report none at all.
• Default new agent integrations to least privilege and short-lived credentials. Don’t inherit the broad, static permission habits built for human service accounts — agents should get exactly what a task requires, for exactly as long as the task takes.
• Treat agent actions as auditable events tied to a unique identity. If your logs can’t distinguish an agent’s action from a human’s, you have an incident-response blind spot, not just a compliance gap.
• Budget for identity governance as part of the AI rollout, not after it. The organizations furthest behind are consistently the ones that deployed agents first and asked about identity later.

Frequently Asked Questions

What is a non-human identity (NHI)?

A non-human identity is any digital credential used by a system rather than a person — API keys, service accounts, and now AI agent identities. Unlike a human login, an NHI is typically automated, and increasingly, in the case of AI agents, created and destroyed dynamically as tasks start and finish.

How many non-human identities does the average enterprise actually have?

Estimates vary by methodology, but multiple 2026 reports agree non-human identities now vastly outnumber human accounts — from roughly 45 to 1 on average up to 109 to 1 or higher in cloud-native and AI-heavy environments, with AI agents making up the fastest-growing share of that population.

Why can’t existing IAM tools just manage AI agent identities?

Most IAM platforms were built around static, human-timescale identities: an employee logs in, keeps roughly the same permissions for months or years, and is reviewed periodically. AI agents are created and retired far faster than that review cycle, and their permissions need to be evaluated in real time against what the agent is actually doing, not just what it was originally provisioned to do.

Is this mainly a security problem or a compliance problem?

Both. Over-permissioned or unmonitored agent identities are a direct security risk — they’re a large, largely invisible attack surface. But they’re increasingly a compliance issue too, since regulations like the EU AI Act require organizations to be able to say definitively whether an action was taken by a human or an AI system.

What’s the single highest-priority fix for a company just starting on this?

Start with visibility: most organizations don’t have a complete inventory of their AI agent identities and the permissions attached to them. You can’t apply least privilege, set offboarding policies, or investigate an incident involving an identity you don’t know exists.

Does this only affect large enterprises?

No — if anything, smaller and mid-market companies are more exposed. They’re often adopting agents just as fast as large enterprises but, per IANS Research’s budget data, allocate roughly half the share of security budget to identity and access management that large enterprises do.

Sources

• CSA Whitepaper: Non-Human Identity & Agentic AI Governance - Cloud Security Alliance research on NHI ratios, governance maturity, and credential exposure data.
• Machine Identities Outnumber Humans 109 to 1 - Help Net Security coverage of Palo Alto Networks’ 2026 Identity Security Landscape report.
• Identiverse 2026 Recap: Identity Security For Agentic AI Dominates - Forrester’s summary of the “actions, not access” shift and emerging agent identity standards.
• AI Agents Are Creating an Identity Security Crisis in 2026 - IANS Research on CISO budget priorities and IAM spending by enterprise size.
• AI Agents at Work 2026: Securing the Agentic Enterprise - Okta survey data on executive confidence, shadow AI usage, and governance gaps.
• Transparency Obligations Under Article 50 of the AI Act - European Commission FAQ on the August 2026 AI Act transparency requirements.