Non-Human Identities: 109 Machine Accounts for Every Employee, and Nobody’s Counting

When a company audits its security, it almost always starts with people: who has access to what, who left and still has an active login, who’s sharing a password. What almost nobody audits is what has actually grown out of control over the last two years: the identities that don’t belong to any person at all. API keys, service accounts, OAuth tokens, and now, AI agents acting on their own inside company systems.

“Machine identities outnumber humans 109 to 1.” — 2026 Identity Security Landscape, Palo Alto Networks (formerly CyberArk)

That isn’t a technical curiosity. It’s the real size of the attack surface, and almost no company knows how many of those 109 identities per employee are still active, what they’re for, or who could revoke them today if they had to.

The number no vendor puts in the demo

The same 2026 Palo Alto Networks report gives three figures worth reading together:

• 109 machine identities for every person in the average enterprise — API keys, service accounts, certificates, AI agents.
• 9 out of 10 organizations suffered a successful identity-related breach in the past 12 months.
• When identity systems are disconnected from each other (the norm: one IAM vendor, another for secrets, another for cloud), every incident takes 12 extra hours to resolve, purely from the friction of pulling data across tools that don’t talk to each other.

None of these three numbers requires a company to be visibly “using AI.” They come from the simple fact that any modern system — a CRM, an ERP, a basic automation script — already needs its own credentials to talk to other systems. What AI agents changed is the speed at which new identities get created: an integration that used to need a person to configure it now deploys itself, with its own key, in minutes.

AI agents aren’t the cause. They’re the accelerator

This is where the problem stops being theoretical. GitGuardian’s State of Secrets Sprawl 2026 report — built from tracking public GitHub commits throughout 2025 — measures something very concrete: how many keys and passwords get accidentally written into code, sitting there for anyone to use.

• 28.65 million new secrets were exposed on public GitHub in 2025 — a 34% increase year over year.
• Within that total, secrets tied to AI services reached 1,275,105, up 81% year over year. The report flags one specific case: 113,000 exposed DeepSeek API keys, found in public repositories.
• The most uncomfortable data point for any team already using an AI coding assistant: commits made with Claude Code help showed a secret-leak rate of 3.2%, versus a 1.5% baseline across all public commits — more than double.
• And the problem doesn’t close itself. Nearly 70% of credentials confirmed valid in 2022 were still valid as of January 2025. Retested in January 2026, more than 64% were still active — years after they leaked.

The business reading is simple: every AI agent you deploy, every new integration, every “quick” script a technical team wires up to an AI provider leaves one more credential behind. And unless someone revokes it by hand, that credential stays alive indefinitely — same permissions, years after everyone has forgotten the project that created it.

This isn’t “agent permissions” or “data governance”. It’s the inventory underneath both

It’s easy to confuse this with two problems we’ve already covered on this blog, and worth separating them because they get fixed differently:

• AI Agent Permissions is a design problem: what a specific agent is allowed to do, within a specific task, at the moment it’s configured.
• AI Agent Data Governance is a usage problem: what data that agent actually touches while running, and whether anyone can cut its access off in real time.
• Non-human identity inventory comes before both: simply knowing how many credentials exist, why they were created, whether they’re still needed, and who would be responsible for shutting them down. Without that inventory, designing permissions or monitoring data use happens on an incomplete list — you protect what you know about and leave out what nobody remembers exists.

Most companies we talk to have the second problem reasonably under control (they monitor what they can see). Almost none have the first one solved — they don’t know how much they can’t see.

What we do at Optima Quantum

Before designing or hardening any AI agent deployment, we do the work almost nobody does first: a real non-human identity inventory — active API keys, service accounts, integration tokens, agent credentials — cross-referenced against who is actually using them today and since when. That produces a list with three columns: what needs to be revoked now, what needs to be rotated, and what needs monitoring because it’s still legitimately in use. Only then does it make sense to talk about agent permissions or data governance — on a complete picture, not just the part you already saw.

It’s the same blind spot IBM and Microsoft’s own November 2026 agent platform tries to close by packaging governance in from day one — see our analysis of what the IBM and Microsoft announcement means for companies that aren’t IBM.

If your company has rolled out AI agents, code assistants, or new integrations in the past year and nobody has run this inventory, you likely have more active credentials than you think — and some, created years ago, are probably still open. You can request a free security audit, see the rest of our cybersecurity services, or contact us to review your specific case.

Related: an AI coding agent with repository and deploy access is itself a non-human identity worth auditing — and the code it writes carries its own risk, since 44% of AI-generated code tasks ship with a real vulnerability. We cover that in AI-generated code security risk.

Frequently asked questions

What exactly is a non-human identity? Any credential a system uses to authenticate to another system without a person typing a password at that moment: API keys, service accounts, certificates, OAuth tokens, and increasingly, an AI agent’s own credentials.

Why 109 machine identities per employee, and not a smaller number? Because every modern system — not just AI — needs its own credentials to talk to other systems: a CRM to email, a payment gateway to accounting, an AI agent to a calendar. Every new integration adds identities; almost none get deactivated once they stop being used.

Does this only affect companies that build their own software? No. It affects any company that has connected an AI agent, a customer-service assistant, or an automation to its internal systems, even without an in-house development team: each of those connections creates at least one new credential.

What happens if it’s never reviewed? Credentials stay active indefinitely. GitGuardian’s data shows more than 64% of leaked credentials are still valid years later — nobody revoked them because nobody knew they existed.

How do you start fixing it? With an inventory: locate every active non-human credential, check which ones are still in use and by whom, and decide for each one whether to revoke, rotate, or monitor it. That’s the first step, before designing agent permissions or data governance policy.