Topic starter
13/09/2026 7:02 pm
TL;DR: Non-human identities now outnumber employees by 80 to 1 in Oleria Security’s analysis of identity security maturity in the AI era. Identity governance has to cover delegated machine execution with runtime signals, narrower privilege scope, and approval for high-risk actions.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “Identity security maturity in the AI era”.
By the numbers:
- Non-human identities now outnumber human employees by an average of 80 to 1.
Key questions
A: Delegated non-human identities often carry broad, long-lived privileges across multiple systems, so compromise or misuse can spread faster and farther than a normal user session.
Q: How do security teams know whether AI access is actually working safely?
A: Look for three signals: complete discovery of the AI estate, clear mapping of source data to each system, and logs that prove what was accessed and why.
Q: Why do static access reviews fail for AI agent identities?
A: Static access reviews fail because they assume access remains stable long enough to be observed and certified.
Practitioner guidance
- Map every delegated identity path Inventory workforce accounts, vendor identities, service accounts, API tokens, and AI integrations across cloud and SaaS so you can see where authority is inherited and where it is created directly.
- Replace standing privilege with JIT access Convert high-risk administrator access and autonomous service accounts to ephemeral access so broad privilege is not available by default during normal operations.
- Separate human approval from machine execution Define which AI agent actions may run autonomously and which must stop for explicit human authorization, especially for privilege escalation and sensitive data operations.
Bottom line: Identity security maturity now depends on whether organisations can govern delegated machine execution as tightly as human access.
Glossary terms: Non-Human Identity (NHI), Standing Privilege, Human-on-the-loop, Identity Blast Radius
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/09/2026 7:02 pm
Identity security maturity now depends on whether organisations can govern delegated machine execution, not just human access. The article shows that the real perimeter has shifted from network edges to identity decisions, especially where AI agents inherit privileges from users or services. That makes identity the operational control plane for modern enterprises. Practitioners should judge maturity by how well they constrain execution, not by how complete their user directory looks.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do autonomous AI identities change accountability in access governance?
A: Accountability becomes harder when the actor makes decisions independently and leaves a trail that looks like delegated behaviour rather than a human request. Teams need named owners, durable logs, and rollback authority so that responsibility does not disappear into the system's runtime autonomy.
👉 Read our full editorial: AI-era identity security depends on governing machine execution
This post was modified 6 days ago by NHI Mgmt Group