People, machines and AI agents all hold keys to your systems. Most companies can only see one of the three.
Ask a security team how many people can reach their billing system and you will get an answer by lunch. Ask how many software accounts, tokens and AI agents can reach it, and the room goes quiet.
I know that quiet room well. It is an uncomfortable place for a technology leader, because the question is fair and the honest answer is "we would have to go and look."
Counting what nobody counted
Every company already runs on identities that never clock in. A deployment pipeline logs into the cloud. A reporting tool reads the customer database. A script written by someone who left in 2021 still refreshes a token every night. Security people call these non-human identities. Add the AI agents that teams are now wiring into email, code and finance systems, and the population gets large very quickly.
How large depends on who is counting. According to public information, Veza, working from access data, puts it near 17 machine identities for every person. CyberArk has said more than 80. Palo Alto Networks reported 82 a year ago and 109 in its 2026 figures. The gap between 17 and 109 is wide, and I would not be willing to bet my budget on any single number. What every estimate agrees on is the direction, and that machines outnumber us by a wide margin.
Nobody is arguing about whether machine identities outnumber people. The argument is over by how much, and that is a worrying place for the argument to be.
Three doors, one pattern
This year has handed us a few uncomfortable case studies. In February, researchers at Truffle Security reported that 2,863 publicly visible Google API keys had quietly gained access to Gemini. The keys had been created years earlier for something harmless like a map embed. Nobody changed them. Google changed what they could reach.
In April, Vercel disclosed an incident that began with a broad OAuth permission granted to a third-party tool. The permission was reused further along than anyone intended. In July, a Hugging Face report described AI agents running an evaluation that ended up in production through credentials they should not have had.
The three events share no vendor, no attacker and no technique. They share a gap. In each one, an identity held more access than its owner understood, and no single system could show the whole picture.
"Three incidents, three different entry points, one gap. The author’s point is that identity risk rarely arrives as a single dramatic failure. It builds quietly, in access that nobody has reviewed."
Why your current tools miss it
Workforce identity tools were built for employees. They know when someone joins, changes teams or leaves. Cloud consoles know their own accounts. AI agents, in many shops, borrow a shared API key from whoever set them up. Each tool describes its own corner accurately and says nothing about the rest.
The trouble shows up in the details. A service account can look harmless on its own and still sit three hops from your most sensitive data. An agent can inherit a person’s permissions and use them at three in the morning at machine speed. A key shared by a dozen workflows leaves a log that says the key did something, and nothing more.
Take the same agent and ask the question an auditor will ask first: who sent it, and with what authority? With a shared key the honest reply is a shrug. With a governed identity the reply takes minutes.
“Who sent it, and with what authority?” is the question to carry into your next security review. If the honest answer is a shrug, the problem is accountability before it is technology.
What governing all identities means in practice
I do not think this needs a new philosophy. It needs the discipline we already apply to people, extended to everything else that holds a key. Four questions are a fair test of where a company stands.
Who owns this identity today, by name?
What can it actually reach, once every inherited and delegated permission is counted?
When did it last use that access, and was anyone watching?
If it were switched off this afternoon, what would stop working?
If your team cannot answer all four for a human, a service account and an AI agent in the same afternoon, you have found the gap. Closing it will take a few firm habits:
Give every non-human identity a named human owner and review that assignment on a schedule.
Measure effective access, meaning what an identity can really reach, and ignore the access it was supposed to have.
Replace long-lived shared keys with credentials that are scoped and expire.
Treat an AI agent as a worker with a manager. Record who authorized it and what it did.
An auditor will not ask how many identities you have. They will ask who is responsible for each one.
Where this leaves leaders
Boards are starting to ask about AI risk in general terms. The sharper question sits underneath it, and it is about identity. Who and what is acting inside our systems, with whose permission, and could we prove it tomorrow?
"Most boards still frame AI risk as a model problem. This piece asks leaders to look one layer lower, at who and what holds the keys, because that is where an audit will start."
Companies that can answer will move faster on AI, because they will know what they are letting loose. Companies that cannot will spend 2027 explaining a breach that began with an account nobody remembered. I would rather my own organization be in the first group, and that is a good enough reason to start counting now.
Note: The author is building an identity governance platform, Garur, at Loksha Technologies. This article describes a problem in the market and does not promote a product.
Sources
Veza, 2026 access data on machine-to-human identity ratios, as reported by ITWeb Africa (July 2026).
CyberArk research on machine identity growth, as reported by ITWeb Africa (July 2026).
Palo Alto Networks, 2025 and 2026 identity figures, as reported by ITWeb Africa (July 2026).
Truffle Security research on Google API keys and Gemini access (February 2026), via NHI Management Group.
Aembit breach tracker, entries on Vercel (April 2026) and Hugging Face (July 2026).