Topic starter
13/09/2026 7:02 pm
TL;DR: Compromised credentials drive 80% of enterprise breaches and non-human identities now outnumber employees by 80 to 1, according to Oleria Security’s analysis of identity security maturity in the AI era. Static RBAC, quarterly reviews, and legacy IAM assumptions break down as AI agents inherit broad privileges and act with non-deterministic behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “Identity security maturity in the AI era”.
By the numbers:
- Non-human identities now outnumber human employees by an average of 80 to 1.
Key questions
Q: Why do static access reviews fail for AI agent identities?
A: Static access reviews fail because they assume access remains stable long enough to be observed and certified.
A: Delegated non-human identities often carry broad, long-lived privileges across multiple systems, so compromise or misuse can spread faster and farther than a normal user session.
Q: How do security teams know whether AI access is actually working safely?
A: Look for three signals: complete discovery of the AI estate, clear mapping of source data to each system, and logs that prove what was accessed and why.
Practitioner guidance
- Map every delegated identity path Inventory workforce accounts, vendor identities, service accounts, API tokens, and AI integrations across cloud and SaaS so you can see where authority is inherited and where it is created directly.
- Replace standing privilege with JIT access Convert high-risk administrator access and autonomous service accounts to ephemeral access so broad privilege is not available by default during normal operations.
- Separate human approval from machine execution Define which AI agent actions may run autonomously and which must stop for explicit human authorization, especially for privilege escalation and sensitive data operations.
Bottom line: Identity security maturity now depends on whether organisations can govern delegated machine execution as tightly as human access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/09/2026 7:02 pm
Identity security maturity now depends on whether organisations can govern delegated machine execution, not just human access. The article shows that the real perimeter has shifted from network edges to identity decisions, especially where AI agents inherit privileges from users or services. That makes identity the operational control plane for modern enterprises. Practitioners should judge maturity by how well they constrain execution, not by how complete their user directory looks.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do autonomous AI identities change accountability in access governance?
A: Accountability becomes harder when the actor makes decisions independently and leaves a trail that looks like delegated behaviour rather than a human request. Teams need named owners, durable logs, and rollback authority so that responsibility does not disappear into the system's runtime autonomy.
👉 Read our full editorial: Identity security maturity in the AI era demands new controls