Agentic AI and NHI scale faster than identity governance can track

TL;DR: Omada’s 2026 State of Identity Governance report, based on research with 577 identity, IAM, and cybersecurity leaders, finds that non-human identities often outnumber human identities by 50:1 or more while 85% of organisations are already using or piloting agentic AI. The governance problem is not adoption itself, but the gap between executive confidence and leading indicators such as privileged coverage, orphaned accounts, and revocation timing.

NHIMG editorial — based on content published by Omada Identity: State of Identity Governance 2026 report

By the numbers:

• Non-human identities now outnumber human identities in most organisations, often by factors of 50:1 or more.

Questions worth separating out

Q: How should teams measure whether identity governance is actually reducing risk?

A: Track exposure, not just activity.

Q: Why do non-human identities create governance problems at scale?

A: Because volume changes the governance unit.

Q: What do organisations get wrong about agentic AI identity controls?

A: They often assume policy language equals enforcement.

Practitioner guidance

• Rebuild executive reporting around exposure indicators Replace vanity metrics with leading indicators such as privileged access coverage, orphaned account counts, and time to revoke access.
• Map ownership for every non-human identity Require a named business or technical owner for each service account, API key, token, certificate, and AI agent identity.
• Validate AI agent controls against real runtime behaviour Check whether unique identities, credential rotation, and access boundaries exist only in policy or are enforced in production workflows.

What's in the full report

Omada Identity's full report covers the operational detail this post intentionally leaves for the source:

• Primary research methodology and respondent breakdown across 577 identity, access management, and cybersecurity leaders
• Benchmark detail on how executives and practitioners differ in their assessment of AI agent controls and identity hygiene
• Survey findings on Zero Trust adoption, interoperability challenges, and the visibility gaps affecting identity reporting
• Expanded commentary on how identity governance is shifting from periodic administration to continuous control

👉 Read Omada Identity's State of Identity Governance 2026 report →

Agentic AI and NHI scale faster than identity governance can track?

Explore further

View Full Forum →  |  NHI Foundation Course →