Topic starter
14/08/2026 6:34 pm
TL;DR: Machine and service identities now outnumber human users 109:1, and organisations anticipate 85% growth in AI agent adoption over the next year, according to Zero Networks, while IBM reports fewer than a third extend granular access controls and zero trust to NHI. Standing access, weak visibility, and lateral-movement risk are becoming the default failure mode for identity programmes.
Editorial analysis by NHI Mgmt Group, based on content published by Zero Networks: “Machine Identity Security: How to Protect Service Accounts and AI Agents”.
By the numbers:
- Machine and service identities now outnumber human users 109:1.
- organizations anticipate 85% growth in AI agent adoption over the next year.
Key questions
Q: What breaks when a machine identity has more access than it needs?
A: Overprivileged machine identities turn a single credential compromise into lateral movement, data access, and configuration change.
Q: Why do machine identities create larger lateral movement risk than teams expect?
A: Machine identities often have wider, longer-lived access than human users and are embedded in application dependencies.
Q: How do security teams know if NHI controls are actually working?
A: Look for complete inventory coverage, clear ownership, enforced rotation, and evidence that unused credentials are removed on time.
Practitioner guidance
- Map every machine identity to reachable assets Build and maintain an inventory of service accounts, AI agents, tokens, and other NHIs, then record the specific systems each one can reach.
- Down-scope access to observed business need Use a learning period to identify the connections each identity actually uses, then remove entitlements that exceed that behaviour.
- Apply identity-based restrictions to AI agents Treat each agent as a governed identity with function-scoped access, not ambient trust.
Bottom line: The article frames standing privilege and poor visibility as the main reason service accounts and AI agents become lateral movement paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:41 pm
Standing privilege is the central machine identity failure mode. This article shows that service accounts and AI agents are not failing because they exist, but because they are allowed to keep broad access after the moment of need has passed. When background identities are treated as permanent infrastructure rather than governed subjects, the organisation creates a reusable lateral movement path. The practitioner takeaway is that standing privilege, not identity volume alone, is the control gap that matters most.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: How can organisations prevent AI agents from becoming overprivileged?
A: Start with least privilege, then enforce it through narrow scopes, environment-specific approval, and regular access review. Separate human and agent access paths, prohibit shared credentials, and require every agent to have an owner. Overprivilege usually grows when teams treat agents like applications instead of identities.
👉 Read our full editorial: Machine identity security gaps are widening as AI agents scale