Machine Identities Outnumber Staff 109:1: A CISO Action Plan

Non-human identities now outnumber human users 109 to 1 inside the average enterprise, and most UK security teams have no reliable way to govern them. Service accounts, API keys, certificates and a fast-growing population of AI agents are quietly becoming the largest unmanaged attack surface most CISOs will face in 2026, and the National Cyber Security Centre’s own guidance on identity and access management has not yet caught up with the scale of the problem.

For a decade, identity security meant managing human logins: joiners, movers, leavers, multi-factor authentication, single sign-on. That model is breaking down. Every microservice, CI/CD pipeline, cloud function and AI agent now needs its own credential, and most of those credentials are provisioned once, over-permissioned by default, and never reviewed again. This is not a future risk. It is already the leading cause of the breaches UK boards are reading about in their quarterly risk reports.

What exactly counts as a non-human identity?

A non-human identity (NHI) is any credential that authenticates a system, process or software agent rather than a person: service accounts, API keys, OAuth tokens, TLS certificates, secrets embedded in code, and — the fastest-growing category — autonomous AI agents that call other systems on a human’s behalf. Unlike a human employee, an NHI does not go through onboarding, does not get offboarded when a project ends, and rarely has a named owner accountable for what it can access.

According to Palo Alto Networks’ 2026 Identity Security Landscape report, machine identities now outnumber human identities by 109 to 1 across the organisations it surveyed. KPMG’s 2026 cybersecurity report puts the ratio closer to 80 to 1 but reaches the same conclusion: the gap between how many machine identities exist and how many are actively governed is widening every quarter, driven almost entirely by the rollout of agentic AI.

• Commission an inventory of every service account, API key and AI agent credential active across production systems, not just those known to IT.
• Ask your CISO who owns each category of non-human identity — if the answer is “shared” or “nobody,” treat it as an open finding.
• Require that any new AI agent deployment come with a documented identity, scope of access and expiry date before go-live.

How exposed are UK organisations to machine identity risk right now?

More exposed than most risk registers reflect. KPMG’s 2026 report found that half of organisations have already suffered a breach linked to a compromised machine identity in the past year, and that 68% of IT security incidents now involve a machine identity at some point in the attack chain. Separately, Okta’s 2026 Global CISO Insights found that only 31% of CISOs feel fully aligned with their C-suite and board on what level of AI-related risk is acceptable — a governance gap that sits directly upstream of the identity sprawl problem.

The pattern behind most incidents is consistent: a human identity policy (annual access review, MFA, role-based permissions) is bolted onto a machine identity that was never designed to work within it. Credentials get shared across services to save engineering time. Permissions are set broadly “to avoid breaking things” and never narrowed. Agents built for one task quietly retain access long after that task is finished. None of this requires a sophisticated attacker — it just requires someone to find the one overlooked key.

• Ask for the percentage of service accounts and API keys with credentials older than 12 months and no documented owner.
• Request a breach post-mortem review specifically for machine-identity-related root causes in the last three incidents, near-misses included.
• Benchmark your organisation’s AI risk alignment between the CISO and the board against Okta’s 31% industry figure.

How should UK CISOs build a non-human identity security programme?

Treat non-human identity as its own discipline rather than an extension of human identity and access management (IAM). A credible programme covers four things: full discovery of every machine identity in production and shadow IT; a single system of record that assigns a named human owner to each one; automated, short-lived credentials in place of static long-lived keys wherever the architecture allows it; and continuous monitoring that flags anomalous behaviour from a service account the same way it would flag a compromised employee login.

This maps closely onto zero trust principles — never trust, always verify, least-privilege access by default — which UK CISOs should already be building toward under the Cyber Assessment Framework and NCSC guidance. Non-human identity is best framed internally not as a new initiative competing for budget, but as the next phase of the zero trust architecture programme most CISOs have already started (see our related briefing on zero trust architecture for UK CISOs). It is also inseparable from AI agent governance — the same inventory and ownership discipline needed for machine identities is what CIOs are already being asked to apply to agentic AI sprawl.

• Mandate a 90-day discovery sprint to inventory every non-human identity with production access, using an automated discovery tool rather than a manual spreadsheet audit.
• Set a policy that no AI agent or service account is provisioned with standing, long-lived credentials where short-lived, automatically rotated alternatives exist.
• Fold non-human identity metrics into existing zero trust and Cyber Assessment Framework reporting rather than creating a parallel reporting line.

Who on the board should own non-human identity risk?

Operational ownership sits with the CISO, but the board’s Risk Committee should own oversight, because the exposure is now large enough to be a material enterprise risk rather than a purely technical one. That means non-human identity risk belongs on the same risk register, with the same reporting cadence, as ransomware exposure and third-party supplier risk — not buried inside a broader “cyber hygiene” line item. Boards that already require quarterly evidence of penetration testing and incident response readiness should extend the same rigour to machine identity governance.

Use INFORMD’s executive self-assessment tools to benchmark your organisation’s current identity governance maturity, and the technology strategy review template to structure the board conversation before your next risk committee meeting.

• Add non-human identity exposure as a standing line item on the Risk Committee agenda, reported alongside ransomware and third-party risk.
• Require the CISO to present a remediation timeline for the highest-risk 10% of machine identities within the next two reporting cycles.
• Confirm cyber insurance coverage explicitly addresses breaches originating from compromised machine identities, not only human-credential compromise.

INFORMD provides intelligence briefings, tools and frameworks for senior business leaders across technology, finance, strategy and compliance. Based in Milton Keynes, UK, we help executives stay informed and act with confidence. Explore our full briefing library (/resources/) or access our free assessment tools (/tools-assessments/).

Stay ahead. Subscribe to INFORMD’s weekly executive briefing at informd.co.uk.