# The Governance Crisis of Nonhuman Identities at Enterprise Scale Identity management for AI and autonomous agents is becoming a top concern for security leaders. - **Source:** [O'Reilly Radar](https://www.oreilly.com/radar) - **Published:** 2026-08-27 - **Topic:** [Data & AI](https://brifing.si/c/data-ai) - **Original article:** - **On Brifing:** https://brifing.si/s/44607069-6c33-48f3-ad4f-034698588239 ## The Rise of Nonhuman Identities Traditional identity and access management was built around human users. But 2026 data shows the fastest-growing population in enterprise environments is no longer human. Research by Oasis Security and the Cloud Security Alliance reveals 92% of security leaders believe legacy IAM tools cannot manage AI and nonhuman identity risks. This creates a governance vacuum as autonomous agents are deployed at scale. ## Identity Ratios and Risks Rubrik Zero Labs estimates the ratio of nonhuman identities (NHI) to humans in enterprise environments at roughly 45:1. CyberArk's 2025 study puts it closer to 82:1. Many of these identities were created by individuals who have since moved teams or left the company entirely. Thousands of active credentials remain, forgotten but still posing risks. ## Lifecycle Data Exposure Entro found 47% of NHIs go unrotated for over a year. In AWS environments specifically, 62% showed no activity in 90 days yet retained full access. These identities aren’t actively misused but are left forgotten, creating standing risks with no oversight—a potentially worse scenario than deliberate misuse. ## Orphaned Identities An analysis cited by The Hacker News shows 8% of enterprise identities lose HR system ownership after creator departure. The World Economic Forum’s 2025 report found 51% of organizations have no clear ownership of AI identities. Unowned identities cannot be reviewed, rotated confidently, or disabled without proving nothing depends on them—an operational nightmare. ## Breaches and Consequences Industry data from One Identity and GigaOm shows two-thirds of enterprises experienced breaches via compromised NHIs. Oasis Security and ESG research found 66% of NHI-related compromises led to successful cyberattacks. Unmanaged NHIs aren’t just hygiene issues—they’re becoming primary attack vectors as the gap between unmanaged and exploited identities closes rapidly. ## Critical 2026 Incidents In June 2026, Microsoft Incident Response demonstrated how poisoned MCP tool descriptions could steer AI agents to leak data through approved calls—without rule violations. Separately, a fake AI skill using GitHub stars and marketplace merges reached ~26,000 agents, including corporate accounts. Every security scanner marked it safe due to mutable external links separating scanned artifacts from executed payloads. ## The Collapse of Traditional Trust Models The legacy trust model—vetting at install and assuming safety—fails for agentic systems. Tools change post-approval; skills redirect post-scanning. What seemed safe at install may not remain so, as identities persist while underlying behaviors shift. This dynamic creates novel vulnerabilities where static security assumptions no longer hold. ## Market Growth and Strategic Priority Gartner recognized NHI/agent identity in its 2026 Emerging Tech Impact Radar. Meticulous Research estimates the global NHI access management market at $11.3B in 2025, projecting $38.8B by 2036 at 12.2% CAGR. This growth trajectory—concentrated in identity, specifically nonhuman—signals where security spending is headed as NHI governance shifts from emerging concern to strategic priority. ## Sources covering this story - https://www.oreilly.com/radar/the-identity-crisis-no-one-planned-for-governing-non-human-agents-at-enterprise-scale/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._