Research
Share Knowledge
Brainstorm Ideas
Achieve More
Research
Share Knowledge
Brainstorm Ideas
The Executive Brief
By the numbers
|
Statistic |
Source |
|
45:1 (144:1 cloud-native) non-human-to-human identity ratio |
CSA, “The Non-Human Identity Governance Vacuum,” May 2026 |
|
51% report no clear ownership of AI identities |
CSA, “The Non-Human Identity Governance Vacuum,” May 2026 |
|
92% are not confident that legacy IAM can manage AI/NHI risk |
CSA + Oasis Security, “State of Non-Human Identity and AI Security,” Jan 2026 (n=383) |
|
27% → 40% of large enterprises scaling AI agents (YoY) |
McKinsey & Company, “The State of AI,” 2026 |
|
700+ organizations exposed in one supply-chain breach |
Permiso Security / CSA, Salesloft–Drift analysis, Sept 2025 |
|
195 million records exfiltrated using commercial AI agents |
Gambit Security, Feb 2026 (widely reported April 2026) |
|
$4.99M average cost of a data breach, +12% YoY |
IBM, “Cost of a Data Breach Report,” 2026 (21st ed.) |
Non-human identities — including agentic AI systems — now outnumber human employees by an average of 45 to 1, a ratio that rises to 144 to 1 in cloud-native environments. Yet 51% of organizations report no clear ownership of these identities: no one is accountable for provisioning, reviewing, or revoking their access.
AI agents are autonomous, ephemeral actors that often hold standing credentials across CRM, cloud infrastructure, and payment systems simultaneously — a footprint no human employee holds at once. Traditional IAM, built for static applications and human users, was never designed to govern that. Explosive growth paired with near-zero governance is the current state of most enterprise AI deployments — and it's why IAM for AI agents is now a board-level imperative, not an IT backlog item.
1. The Problem: A New Class of Identity
In plain terms: Current security systems assume either a human is watching, or the credential never changes its behavior. AI agents break both assumptions at once.
AI agents don't fit either category identity management was built around. A service account is static — provisioned once, used the same way every time, rarely re-evaluated. A human user authenticates, acts within a session, and logs off. An AI agent does neither. It's provisioned dynamically, often for a single task, and retired shortly after — sometimes within minutes. While active, it can hold standing credentials across CRM, cloud infrastructure, and payment systems simultaneously, deciding in real time, without a human reviewing each step, which of those credentials to use and when.
That autonomy is the entire point of deploying agents. It's also exactly what breaks the assumptions underneath most enterprise IAM. Human-centric access control assumes a person is present to make a judgment call before a sensitive action executes. Static service-account models assume a credential's scope won't need to shift, moment to moment. Agentic systems violate both assumptions by design.
The result is a governance blind spot, not a technology gap. Most organizations already own identity tooling. What they don't have is a model built for an identity that is autonomous, ephemeral, and present across a dozen systems at once — a footprint no single employee, however senior, has ever held.
The Three Identity Classes, Compared --
|
Dimension |
Human user |
Service account |
AI agent |
|
Provisioning |
Manual, at hire or role change |
Manual, rarely revisited |
Dynamic, often per task |
|
Credential lifetime |
Session-based, re-authenticated |
Long-lived and static |
Minutes to hours, ephemeral |
|
Decision autonomy |
Human judgment at point of action |
None — fixed, scripted behavior |
Autonomous, no per-action review |
|
System footprint |
One system at a time, typically |
Usually, a single integration |
Multiple systems simultaneously |
|
Review frequency |
Periodic access reviews |
Rarely reviewed |
Often never reviewed |
2. Why Now: Adoption Is Outpacing Governance
The urgency isn't that agentic AI is coming — it's already here, scaling faster than the controls meant to govern it. Among large enterprises, the share reporting scaling of AI agents across one or more business functions rose from 27% to 40% in the past year alone. Adoption at that pace would be manageable if governance kept up. It hasn't: a January 2026 survey of 383 IT and security professionals found 92% are not confident their existing IAM systems can manage the risks introduced by AI and non-human identities.
That combination — adoption accelerating, confidence collapsing — is the entire argument for acting now rather than waiting for a mature standard to emerge. Standards bodies are moving (see Section 4), but frameworks take years to become common practice, and agent deployment isn't waiting for them.
It's a gap between available guidance and organizational priority — agent identity is still being treated as an implementation detail rather than the governance decision it actually is.
This gap is no longer purely operational. The EU AI Act's phased obligations, the emergence of standards such as ISO/IEC 42001 for AI management systems, and sector-specific guidance from regulators on AI-driven operations are converging to make agent identity governance a compliance question as much as a security one. Boards that treat this purely as a technical backlog item risk discovering the regulatory dimension only after an incident forces it onto the agenda.
3. Real-world evidence: two failure modes
Two recent incidents show what this gap looks like in practice — different mechanisms, same underlying failure: no governance layer positioned to see, scope, or stop the action before the damage compounded.
INCIDENT 1 — SALESLOFT / DRIFT (2025)
Over-broad trust in a third-party integration
What happened: Attackers compromised Salesloft's GitHub environment (March–June 2025), pivoted into Drift's AWS environment, and stole per-user OAuth and refresh tokens for the Drift–Salesforce integration. Between August 8–18, 2025, those tokens were used to access Salesforce, Google Workspace, and Slack data across more than 700 organizations.
Root cause: A trusted integration held broadly-scoped, long-lived tokens per user, with no mechanism to detect or contain misuse once those tokens were stolen.
Governance control that was missing: Just-in-time, narrowly-scoped credentials — the tokens should not have remained valid, unmonitored, and broadly permissioned indefinitely.
Lesson for the board: Every third-party integration you trust is a delegated identity with its own blast radius. If it's compromised, your exposure is bound only by how narrowly you scope its access.
INCIDENT 2 — MEXICAN GOVERNMENT AGENCIES (DEC 2025–FEB 2026)
Unaudited velocity, no kill switch
What happened: A single attacker used commercial AI coding agents — which executed the large majority of remote commands autonomously — to breach nine Mexican government agencies over roughly seven weeks, exfiltrating personal records for 195 million citizens. Initial access came through conventional means; the AI agents then accelerated reconnaissance, exploitation, and data analysis at a speed no human team could match.
Root cause: The agentic sessions involved had no command-level audit trail visible to defenders in real time, and no mechanism existed to detect or halt an unusually fast, high-volume sequence of autonomous actions.
Governance control that was missing: Runtime monitoring and a kill-switch capability for agentic sessions — the ability to detect anomalous velocity and command volume and cut access before damage compounds.
Lesson for the board: The risk of agentic AI isn't only which systems an agent can reach — it's the speed at which it can act inside them. Governance must include real-time behavioral monitoring, not just access provisioning.
Different failure modes — one an over-scoped credential handed to a trusted vendor, one an attacker weaponizing agentic speed against inadequate monitoring — but the same underlying gap. Against that backdrop, the 2026 figures on breach economics warrant attention: the global average cost of a data breach has reached $4.99M, a record, up 12% year over year.
4. The path forward: principles, not protocols
The fix doesn't require inventing something new. It requires applying a small number of well-established principles — already codified by recognized standards bodies — to a category of identity that has so far been treated as exempt from them.
These aren't ITPN's invention. They're the direction NIST's AI Risk Management Framework and Zero Trust Architecture guidance, the Cloud Security Alliance's Agentic Trust Framework, and OWASP's Top 10 for Agentic Applications are all converging on independently — three bodies, three vantage points, the same governance model.
Zero standing privilege would have narrowed the blast radius in both incidents above — bounding what a stolen token or a hijacked agent session could reach — even though it could not have prevented the initial compromise in either case. That's a more defensible claim than “prevented,” and, frankly, a more useful one for a board deciding what to fund. For technical teams, cryptographic workload identity standards exist and are maturing; for boards, the assurance that frameworks are converging on the same governance model is sufficient.
5. The ask: differentiated by role
Accountability for this problem is naturally split across several roles — so is the action each should take.
- Board / Audit Committee — Require agent-identity governance to appear as a standing item in the quarterly risk report, alongside cyber-risk and third-party risk. Ask management directly: do we have a complete inventory of non-human identities, and who owns each one?
- CISO / CIO — Assign clear, named ownership of AI/agent identity governance, and commission a full inventory of non-human identities currently operating in the environment. You cannot govern what you haven't counted.
- CFO — Fund a governance program now. Industry deployments of just-in-time credentialing and lifecycle automation typically run a small fraction of a single incident's cost — weighed against the $4.99M average breach cost, this is a budget line, not a bet.
- CEO / COO — Make agent identity governance a named, singular accountability — assigned to one function, not diffused across everyone and therefore no one. That diffusion is exactly what the 51% ownership-gap statistic describes.
- CAIO / CTO — Gate every new agent deployment on identity controls being in place at launch, not retrofitted afterward. It's measurably cheaper to build this in from the start than to bolt it on after an incident forces the question.
One closing note across every role above: governance maturity in this space is as much a hiring and capability question as it is a technical one. The organizations moving fastest on agentic AI identity governance are treating it as a skills investment to build into the security team's hiring plan — not only a tooling purchase.
6. Conclusion
The math is straightforward: the cost of governing AI agent identity today is a fraction of the cost of not doing so, as the incidents above illustrate at very different scales. Non-human identities will keep outnumbering human ones by a wider margin every year, regardless of how ready any given organization is.
Whether that growth becomes an asset or a liability is a decision, not a forecast — and it belongs on this year's agenda. Expect the agent-identity tooling market to consolidate over the next 12–24 months as this becomes a standard line item in security budgets; organizations that establish ownership and lifecycle discipline now will integrate that consolidation on their own terms rather than scrambling to catch up.
About ITPN
ITPN is a technology consulting and talent procurement firm working at the intersection of enterprise security, infrastructure, and AI adoption. This whitepaper reflects ITPN's ongoing analysis of the governance and workforce implications of agentic AI for enterprise clients.
Sources
1. Cloud Security Alliance, “The Non-Human Identity Governance Vacuum,” CSA Labs, May 2026.
2. Cloud Security Alliance, “The Non-Human Identity Governance Vacuum,” CSA Labs, May 2026 (ownership-gap finding).
3. Cloud Security Alliance & Oasis Security, “The State of Non-Human Identity and AI Security,” January 2026 (n=383 IT/security professionals).
4. McKinsey & Company, “The State of AI,” 2026.
5. Permiso Security, “Anatomy of the Salesloft Breach,” September 2025; Cloud Security Alliance, “The Salesloft Drift OAuth Supply-Chain Attack,” September 2025.
6. Gambit Security, “The AI-Assisted Breach of Mexico's Government Infrastructure,” February 2026, as reported by SC Media, TechRadar, and Yahoo News, April 2026.
7. IBM, “Cost of a Data Breach Report,” 2026 (21st edition).
8. European Union, AI Act; ISO/IEC 42001:2023.
9. NIST AI Risk Management Framework; NIST SP 800-207, Zero Trust Architecture.
10. Cloud Security Alliance, Agentic Trust Framework.
11. OWASP, Top 10 for Agentic Applications.
Disclaimer
This whitepaper is provided for general informational purposes and reflects publicly reported information as of its publication date. It does not constitute legal, financial, or security-compliance advice. Organizations should consult qualified professionals before making decisions based on the frameworks or figures cited here.