For a decade, identity and access management meant one thing: governing the humans who log in. Employee joins, gets provisioned, gets a manager, gets a departure date, gets offboarded. That loop is well understood. What changed is that the fastest-growing population inside enterprise environments is no longer human, and the governance playbook written for people does not apply to it.
A January 2026 survey by Oasis Security and the Cloud Security Alliance, covering 383 security leaders, found that 92% aren’t confident legacy IAM tools can manage AI and non-human identity risk. In the same study, 78% reported having no formally adopted policies for creating or removing AI identities. Call it what it is: a governance vacuum, forming at the exact moment autonomous agents are being deployed at enterprise scale.
This isn’t another overview arguing that non-human identity matters. That case has been made. What changed in the first half of 2026 is that the governance vacuum stopped being a risk register entry and started producing real incidents, with specific exploit chains, measurable timelines, and quantified exposure data. The gap between “unmanaged identities” and “exploited identities” closed faster than most organizations expected.
The numbers vary by environment, but the direction is consistent everywhere. Rubrik Zero Labs estimates the non-human identity (NHI) to human ratio at roughly 45:1 across general enterprise environments. CyberArk’s 2025 Identity Security Landscape study puts it closer to 82:1. That gap comes down to exposure: a traditional enterprise and a cloud-native, DevOps-heavy shop mint machine credentials at very different rates.
The ratio alone is not what keeps security leaders up at night. What does is that most of these identities were created by someone who has already moved on to a different team or left the company entirely. Thousands of active credentials persist, and no one remembers why they exist.
Lifecycle data is where the real exposure shows up. Entro found that 47% of NHIs go unrotated for more than a year, and in AWS environments specifically, 62% showed no activity in 90 days but still retained full access. These are not identities anyone is actively misusing. These identities aren’t being actively misused so much as forgotten, left to sit as standing risk with no one watching, which is arguably worse.
Ownership is the deeper problem underneath rotation. A separate analysis cited by The Hacker News and sourced to One Identity and GigaOm found that 8% of enterprise identities have lost their HR system ownership entirely after the creator departed. The World Economic Forum’s 2025 analysis reported that 51% of organizations have no clear ownership of AI identities at all. An identity with no owner can’t be reviewed on a schedule, rotated with confidence, or disabled without someone first proving a negative: that nothing still depends on it.
None of this stays theoretical. Two thirds of enterprises have experienced a breach through a compromised non-human identity, according to industry data from One Identity and GigaOm. The Oasis Security and ESG research goes further: among organizations that reported NHI-related compromises, 66% of those incidents led to successful cyberattacks. An unmanaged non-human identity often ends up being the initial access vector, not just a hygiene item sitting in a spreadsheet.
The gap between “we have a lot of unmanaged identities” and “attackers are exploiting that gap” closed quickly in 2026. Three incidents from the first half of the year illustrate how.
In June 2026, Microsoft Incident Response published research showing how poisoned MCP (Model Context Protocol) tool descriptions could steer AI agents into leaking enterprise data through approved tool calls. The agent never broke a rule. Each individual action looked routine. The poison sat in the natural-language metadata that agents read to decide when and how to call a tool, and MCP picks up description changes dynamically with no re-approval step in default configurations.
We’ve also seen a fake AI agent skill that used GitHub stars and a marketplace merge to build trust, and reported it reached approximately 26,000 agents, including some on corporate accounts. Every skill security scanner they tested it against marked the skill as safe. The trick was a mutable external link: The artifact the scanner evaluated and the payload that actually executed were different things.
What both of these show is that the traditional trust model, where you vet something at install and assume it stays safe, does not work for agentic systems. Tools can change after approval, skills can be redirected after scanning, and what looked safe at install may not stay that way. The identity persists while the behavior underneath it shifts.
A vulnerability named WriteOut meant a single click on a shared agent preview link could expose the victim’s session token across tenants, opening up access to private chats, documents, agents, and LLM credentials. The bypass worked by having the agent fetch and run a remote script instead of embedding the payload inline, sidestepping input-side guardrails entirely. The issue was patched server-side with no evidence of exploitation, but the pattern is instructive: Agent identity isolation is only as strong as the sandbox boundary it runs inside.
When analysts and market researchers start treating a problem as its own category, the signal is clear: it has moved from “emerging concern” to “strategic priority.” Gartner recognized NHI/agent identity in its Emerging Tech Impact Radar 2026 for IAM for AI Agents. Meticulous Research estimates the global NHI access management market at $11.3 billion in 2025, projecting $38.8 billion by 2036 at a 12.2% CAGR.
That trajectory tells you where the industry thinks the next five years of security spending goes. That growth is concentrated in identity, specifically the non-human kind, well ahead of endpoint or SIEM spending.
The OWASP Top 10 for Agentic Applications, released in December 2025, provides the first peer-reviewed framework for mapping these risks. Its 100-plus contributors include NIST, the Alan Turing Institute, the Microsoft AI Red Team, and AWS. Two of its ten risk categories, Identity and Privilege Abuse (ASI03) and Agentic Supply Chain (ASI04), map directly to the incidents described above. The framework is not a compliance standard, but it gives security teams a shared language for the problem.
Our own work reflects that same discovery-first approach: an inventory before a policy, an owner before a permission. The deeper fix both of us are moving toward is intent-bound authorization, replacing long-lived tokens that outlive the task that created them with short-lived, scope-narrowed credentials evaluated at the moment an agent actually calls a tool, not once at setup and never again. It’s early-stage work across the industry. Even the practitioner groups building these controls admit that reliably discovering every shadow agent and tracing it back to an accountable owner isn’t a solved problem yet. Neither of us is an exception to that.
The organizations that close this gap won’t do it by extending human IAM tools to cover agents. The lifecycle assumptions are wrong. AI agents don’t submit two-week notices or flag themselves for annual access reviews. No manager notices when their permissions outlive their purpose. Making them visible requires deliberate integration work that most organizations haven’t done.
The pattern across every incident and every survey from the first half of 2026 is the same question left unanswered: what exists, who owns it, what can it reach, and when should it die? The teams that answer those four questions for every non-human identity in their environment, not just the ones they remember creating, will be the ones that keep the governance vacuum from becoming the next breach headline.