The Governance Crisis of Nonhuman Identities at Enterprise Scale
Identity management for AI and autonomous agents is becoming a top concern for security leaders.
1The Rise of Nonhuman Identities
Traditional identity and access management was built around human users. But 2026 data shows the fastest-growing population in enterprise environments is no longer human. Research by Oasis Security and the Cloud Security Alliance reveals 92% of security leaders believe legacy IAM tools cannot manage AI and nonhuman identity risks. This creates a governance vacuum as autonomous agents are deployed at scale.
2Identity Ratios and Risks
Rubrik Zero Labs estimates the ratio of nonhuman identities (NHI) to humans in enterprise environments at roughly 45:1. CyberArk's 2025 study puts it closer to 82:1. Many of these identities were created by individuals who have since moved teams or left the company entirely. Thousands of active credentials remain, forgotten but still posing risks.
3Lifecycle Data Exposure
Entro found 47% of NHIs go unrotated for over a year. In AWS environments specifically, 62% showed no activity in 90 days yet retained full access. These identities aren’t actively misused but are left forgotten, creating standing risks with no oversight—a potentially worse scenario than deliberate misuse.
4Orphaned Identities
An analysis cited by The Hacker News shows 8% of enterprise identities lose HR system ownership after creator departure. The World Economic Forum’s 2025 report found 51% of organizations have no clear ownership of AI identities. Unowned identities cannot be reviewed, rotated confidently, or disabled without proving nothing depends on them—an operational nightmare.
5Breaches and Consequences
Industry data from One Identity and GigaOm shows two-thirds of enterprises experienced breaches via compromised NHIs. Oasis Security and ESG research found 66% of NHI-related compromises led to successful cyberattacks. Unmanaged NHIs aren’t just hygiene issues—they’re becoming primary attack vectors as the gap between unmanaged and exploited identities closes rapidly.
6Critical 2026 Incidents
In June 2026, Microsoft Incident Response demonstrated how poisoned MCP tool descriptions could steer AI agents to leak data through approved calls—without rule violations. Separately, a fake AI skill using GitHub stars and marketplace merges reached ~26,000 agents, including corporate accounts. Every security scanner marked it safe due to mutable external links separating scanned artifacts from executed payloads.
7The Collapse of Traditional Trust Models
The legacy trust model—vetting at install and assuming safety—fails for agentic systems. Tools change post-approval; skills redirect post-scanning. What seemed safe at install may not remain so, as identities persist while underlying behaviors shift. This dynamic creates novel vulnerabilities where static security assumptions no longer hold.
8Market Growth and Strategic Priority
Gartner recognized NHI/agent identity in its 2026 Emerging Tech Impact Radar. Meticulous Research estimates the global NHI access management market at $11.3B in 2025, projecting $38.8B by 2036 at 12.2% CAGR. This growth trajectory—concentrated in identity, specifically nonhuman—signals where security spending is headed as NHI governance shifts from emerging concern to strategic priority.
Original article: O'Reilly Radar — Kurumsal Ölçekte İnsan Dışı Kimliklerin Yönetim Krizi