By Tushar Badlani and Mohit Bansal — Identity and access management (IAM) for the last decade was largely about people: hire, provision, assign a manager, set a departure date, offboard. In the first half of 2026, however, the fastest‑growing population inside enterprises stopped being human, and the governance assumptions built for people no longer fit these non‑human identities (NHIs).
Scope of the governance vacuum
A January 2026 survey conducted by Oasis Security and the Cloud Security Alliance of 383 security leaders found that 92% are not confident legacy IAM tools can manage AI and non‑human identity risk. The same study reported that 78% of respondents have no formally adopted policies for creating or removing AI identities. That combination has created a governance vacuum precisely as autonomous agents are being deployed at scale.
Scale, lifecycle, and exposure
Estimates of the ratio between non‑human identities and human users differ but point in the same direction. Rubrik Zero Labs estimates roughly a 45:1 NHI‑to‑human ratio across general enterprise environments; CyberArk’s 2025 Identity Security Landscape places the ratio closer to 82:1. Differences reflect workload and provisioning practices—traditional enterprises and cloud‑native, DevOps‑heavy shops mint machine credentials at very different rates.
The worrying detail is that many of these identities were created by people who have moved teams or left the company altogether, leaving thousands of active credentials in place with no clear reason for their existence.
Lifecycle metrics reveal the real exposure. Entro found that 47% of NHIs go unrotated for more than a year, and in AWS environments specifically, 62% showed no activity in 90 days while still retaining full access. These identities are often not actively misused; they are forgotten standing risks with nobody watching them.
Ownership is missing
Ownership is the deeper issue under rotation. Analysis cited by The Hacker News and sourced to One Identity and GigaOm found that 8% of enterprise identities lost their HR system ownership entirely after the creator departed. The World Economic Forum’s 2025 analysis reported that 51% of organizations have no clear ownership of AI identities at all. Without an owner, an identity cannot be scheduled for review, confidently rotated, or safely disabled without first proving that nothing depends on it.
This lack of governance is tangible. Industry data from One Identity and GigaOm indicates two‑thirds of enterprises have experienced a breach through a compromised non‑human identity. Oasis Security and ESG research goes further: among organizations that reported NHI‑related compromises, 66% of those incidents led to successful cyberattacks. An unmanaged non‑human identity frequently becomes an initial access vector rather than a mere hygiene item.
Incidents from early 2026
The gap between "unmanaged identities" and "exploited identities" closed quickly in 2026. Three incidents from the first half of the year illustrate the problem.
-
In June 2026, Microsoft Incident Response published research showing how poisoned Model Context Protocol (MCP) tool descriptions could steer AI agents into leaking enterprise data via ostensibly approved tool calls. Each action appeared routine; the poison lived in natural‑language metadata that agents read to decide when and how to call a tool. MCP picks up description changes dynamically in default configurations without a re‑approval step.
-
Researchers also observed a fake AI agent skill that used GitHub stars and a marketplace merge to build trust; it reportedly reached about 26,000 agents, including some on corporate accounts. Every skill security scanner tested marked the skill as safe. The method relied on a mutable external link: the artifact the scanner evaluated was not the same as the payload that ultimately executed.
-
The WriteOut vulnerability allowed a single click on a shared agent preview link to expose a victim’s session token across tenants, giving access to private chats, documents, agents, and LLM credentials. The bypass worked by having the agent fetch and run a remote script instead of embedding the payload inline, thereby evading input‑side guardrails. The issue was patched server‑side with no evidence of exploitation, but the pattern is instructive: agent identity isolation depends on the strength of the sandbox boundary.
Together these incidents show that the traditional trust model—vet at install and assume safety thereafter—does not work for agentic systems. Tools can change after approval, skills can be redirected after scanning, and identities can persist while the behavior underneath them shifts.
Industry recognition and market trajectory
When analysts and market researchers begin to treat a problem as its own category, it has moved from an emerging concern to a strategic priority. Gartner recognized NHI/agent identity in its Emerging Tech Impact Radar 2026 for IAM for AI Agents. Meticulous Research estimates the global NHI access management market at $11.3 billion in 2025, projecting $38.8 billion by 2036 at a 12.2% compound annual growth rate—indicating where security spending is likely to concentrate over the coming years.
The OWASP Top 10 for Agentic Applications, released in December 2025, offers the first peer‑reviewed framework to map these risks. Its more than 100 contributors include the National Institute of Standards and Technology (NIST), the Alan Turing Institute, the Microsoft AI Red Team, and Amazon Web Services (AWS). Two of its ten risk categories—Identity and Privilege Abuse (ASI03) and Agentic Supply Chain (ASI04)—map directly to the incidents described above.
Mitigations and a path forward
The authors endorse a discovery‑first approach: inventory every non‑human identity, assign an owner before granting permissions, and then manage lifecycle. A deeper technical fix moving through the industry is intent‑bound authorization: replace long‑lived tokens that outlive the tasks that created them with short‑lived, narrowly scoped credentials that are evaluated at the moment an agent calls a tool, not once at setup and never again. This work is early stage, and practitioners acknowledge that reliably discovering every shadow agent and tracing it to an accountable owner is not yet a solved problem.
Extending human IAM tools to cover agents will not be sufficient because the lifecycle assumptions are wrong. AI agents do not submit two‑week notices, request annual access reviews, or flag themselves when their permissions outlive their purpose. Making them visible requires deliberate integration work many organizations have not yet carried out.
Conclusion
The pattern across surveys and incidents in early 2026 leaves four questions outstanding for every non‑human identity: what exists, who owns it, what can it access, and when should it expire? Teams that can answer those questions for every NHI in their environment—not only the ones they remember creating—will be best placed to prevent the governance vacuum from producing the next major breach.
