The Non-Human Identity Crisis: Why Your AI Agents Outnumber Your Employees 144 to 1

Walk into most enterprise security reviews in 2026 and you’ll hear the same confession: nobody actually knows how many AI agents are running inside the company, what they can touch, or who — or what — is responsible for them. It’s not a failure of any one security team. It’s the byproduct of a shift that outran the infrastructure built to govern it. Every AI agent an enterprise deploys — a coding assistant, a customer-support bot, a document-processing pipeline, a scheduling agent buried inside a SaaS tool — needs an identity: a way to authenticate, a set of permissions, a credential that proves it is who it claims to be. Most enterprises never built that layer. They bolted agents onto systems designed for humans logging in with a password, and the gap between those two worlds has become one of the most consequential governance problems in enterprise AI.

This is the non-human identity crisis, and unlike a lot of AI risk narratives, it isn’t speculative. It’s showing up in funding rounds, in national standards bodies, and in the access logs of companies that went looking and didn’t like what they found.

The Numbers Nobody Budgeted For

Non-human identities — service accounts, API keys, OAuth tokens, bots, and now autonomous AI agents — already vastly outnumber the humans they were built to serve. Identity security researchers now put non-human identities at as high as 144 to 1 against human identities within third-party software environments, a ratio that climbs further in cloud-native environments and keeps rising as organizations connect more agents to more systems.

The scale becomes concrete in individual audits. One Fortune 500 financial institution went looking for its identity footprint expecting to find roughly 50,000 human users. It found more than 4.2 million non-human identities — service accounts, API keys, OAuth tokens, certificates, and bots — an inventory nobody had fully mapped before. That is not an isolated horror story; it is what happens whenever a large organization actually audits itself instead of assuming its identity systems have kept pace with its AI rollout.

This matters because AI agent sprawl and identity sprawl are the same underlying problem viewed from two angles: too many autonomous actors, not enough visibility into what each one is allowed to do.

Why Legacy IAM Wasn’t Built for This

Traditional identity and access management assumes a human at the keyboard: someone who logs in, does a bounded set of tasks, and logs out. AI agents break nearly every one of those assumptions. They run continuously, chain actions across multiple systems without a human approving each step, and are frequently given credentials by developers who just want the integration to work — often by handing an agent a human’s own login token because no agent-specific alternative exists.

The resulting numbers are stark. A January 2026 survey from the Cloud Security Alliance and Oasis Security found that 79% of IT professionals feel ill-equipped to prevent attacks that originate through non-human identities, and 92% said they lack confidence that their existing IAM tooling can effectively manage AI-agent risk. Credentials issued to agents are routinely over-scoped relative to what the agent actually needs, and unlike a human employee who gets offboarded, a forgotten agent credential can sit active indefinitely — an unmonitored, un-rotated door into production systems.

This is the practical, unglamorous side of the governance conversation this publication has tracked before: action-layer governance is about controlling what an agent can do; identity governance is about controlling what an agent is and what it’s allowed to authenticate as in the first place. You need both, but you can’t have the first without the second.

The Money Is Already Moving

Investors are pricing this risk in. Obsidian Security, a platform focused on securing non-human identities and AI agents across enterprise SaaS environments, closed an $85 million Series D in August 2026, pushing its valuation past $1.1 billion. The round was led by Crescent Cove Advisors with participation from Greylock Partners and Menlo Ventures. Obsidian reports that more than 100 of its customers now spend over $100,000 a year on the platform, with more than a dozen spending over $1 million annually — a signal that this isn’t a theoretical budget line for early adopters; it’s already a board-level line item at large enterprises running agents built on models from Anthropic, OpenAI, and Microsoft.

That kind of capital doesn’t chase hypothetical problems. It chases the gap between how fast enterprises are deploying agent fleets and how slowly identity infrastructure is catching up.

Standards Are Racing to Catch Up

The good news is that the standards world has stopped debating whether agent identity is a real category and started building for it.

NIST’s Concept Paper

In February 2026, NIST’s National Cybersecurity Center of Excellence published a concept paper titled “Accelerating the Adoption of Software and AI Agent Identity and Authorization,” proposing that AI agents be treated as identifiable, individually authorized entities within enterprise identity systems rather than anonymous processes running under borrowed human credentials. The project lists Model Context Protocol, OAuth 2.0/2.1, OpenID Connect, SPIFFE/SPIRE, and SCIM as candidate building blocks — existing, proven identity standards being extended to cover agents rather than reinvented from scratch.

IETF and the WIMSE Work

In parallel, the IETF’s Workload Identity in Multi-System Environments (WIMSE) working group has been developing draft specifications applying workload-identity concepts specifically to AI agents, aiming to compose SPIFFE/SPIRE-style workload identity with OAuth 2.0 into a framework that gives every agent a verifiable, independent identity rather than a shared or borrowed one.

What the Platforms Are Shipping

The major identity vendors aren’t waiting for the standards to finalize before shipping product. Microsoft’s Entra Agent ID reached general availability in 2026, extending Microsoft’s Zero Trust stack — Conditional Access, Identity Protection, Privileged Identity Management — to non-human identities, giving organizations an agent registry where AI agents show up in the same interface as human users, with the same visibility into what they can access.

Okta has taken a different but complementary approach with Cross App Access (XAA), an open protocol that routes the connections AI agents make into enterprise applications through a company’s central identity controls rather than app-by-app credentials. More than 25 software makers have signed on, including Asana, Atlassian, Cloudflare, Datadog, Slack, and Zoom, meaning an agent’s identity and permissions can follow it as it moves between tools instead of resetting at every integration boundary.

A Practical Framework for Getting Ahead of It

You don’t need to wait for the standards to fully converge to start closing the gap. Four moves matter most, in roughly this order:

1. Inventory before you govern

You cannot secure what you haven’t counted. Run an actual audit of every service account, API key, and agent credential in use — not the list your CMDB thinks exists, but what a live scan of your identity provider and cloud environments actually turns up. Expect the real number to be uncomfortably larger than the assumed one.

2. Stop sharing human credentials with agents

Every agent should authenticate with its own scoped, attributable identity — never a developer’s personal token or a shared service account. This is the single highest-leverage fix, because it’s what makes every other control (rotation, least privilege, audit logging) actually enforceable.

3. Default to least privilege and short-lived credentials

Agents should be issued the minimum access needed for their specific task, with credentials that expire quickly rather than persisting indefinitely. Long-lived, over-scoped tokens are exactly what turns a compromised agent into a lateral-movement problem instead of a contained incident.

4. Put agent activity in the same monitoring pipeline as human activity

An agent’s actions should generate the same kind of auditable trail a human employee’s actions do — logged, attributable, and reviewable. This is also where identity governance connects back to the operational reality this publication has covered before: when something goes wrong with an autonomous agent, the first question anyone asks is “which identity did this, and who owned it” — and right now, at most enterprises, that question doesn’t have a fast answer.

The Takeaway

The non-human identity crisis isn’t a future risk to plan for eventually — it’s a current gap that’s already being priced into venture rounds, written into national standards, and shipped as product by every major identity vendor. Enterprises that treat agent identity as an afterthought will keep discovering, audit by audit, that they have vastly more autonomous actors inside their systems than they realized, with vastly less oversight than they assumed. The organizations getting ahead of this aren’t waiting for a perfect standard to land; they’re inventorying what they have now, killing shared credentials, and building the identity layer their agent fleets should have had from day one.

Frequently Asked Questions

What is a “non-human identity” in the context of AI agents?

A non-human identity is any credentialed digital actor that isn’t a human user logging in directly — service accounts, API keys, OAuth tokens, bots, and autonomous AI agents. Each one needs to authenticate and be granted specific permissions, just like a human employee, but most enterprise identity systems were never designed to track them at this scale.

Why do AI agents need their own identities instead of using a developer’s login?

Sharing a human credential with an agent makes it impossible to tell which actions were taken by the person versus the agent, breaks least-privilege access controls, and means the credential often persists long after anyone remembers it’s in use. A dedicated, scoped agent identity keeps actions attributable and access limited to what that specific agent actually needs.

Is this only a risk for large enterprises?

No. The ratio of non-human to human identities tends to be worse, not better, in smaller organizations that adopt AI tools quickly without a dedicated security team to govern them. Any company connecting AI agents to production systems, customer data, or financial tools should treat agent identity as a priority regardless of size.

What standards should businesses be watching?

NIST’s NCCoE project on software and AI agent identity and authorization, the IETF’s WIMSE working group work on agent identity, and vendor implementations like Microsoft Entra Agent ID and Okta’s Cross App Access are the clearest signals of where agent identity governance is heading. None are final, but they largely converge on the same building blocks: OAuth 2.0/2.1, OpenID Connect, and SPIFFE/SPIRE-style workload identity.

What’s the fastest first step a company can take?

Run a real inventory of every service account, API key, and agent credential currently active in your environment. Most organizations are surprised by what they find, and you can’t fix an access problem you haven’t measured.

Sources

• Obsidian Security raises $85M as AI agents create cybersecurity’s next major attack surface - SiliconANGLE - Reporting on Obsidian Security’s Series D funding round and unicorn valuation.
• Obsidian Security Raises $85M Series D - The SaaS News - Details on funding participants and customer spend metrics.
• Agentic AI identity sprawl is outpacing enterprise governance in 2026 - NHIMG - Analysis of the non-human-to-human identity ratio trend.
• Identity Management for AI Agents in 2026: Trends, Risks, and What Comes Next - Iden - Case study data on enterprise non-human identity audits.
• 79% of IT Pros Feel Ill-Equipped to Prevent Attacks Via Non-Human Identities - Cloud Security Alliance - CSA and Oasis Security survey data on IT professional confidence in managing non-human identity risk.
• Software and AI Agent Identity and Authorization - NIST NCCoE - Official NIST project page and concept paper on agent identity standards.
• WIMSE Applicability for AI Agents - IETF Datatracker - IETF draft specification on workload identity for AI agents.
• Microsoft Entra eliminates identity risks posed by AI agents - Techzine Global - Coverage of Microsoft Entra Agent ID general availability and capabilities.
• Okta expands Cross App Access ecosystem to secure AI agent connections - SiliconANGLE - Reporting on Okta’s Cross App Access protocol and partner ecosystem.