Securing human logins is the part most organizations have under control. But for every person in your environment, roughly 92 machine identities are working in the background, and most answer to no one.
Forrester estimates that machine identities outnumber human identities by 92 to 1. Most operate without the oversight applied to any employee login.
That imbalance is the machine identity blind spot. It matters now because agentic AI is turning a known weakness into a fast-moving one. Each new agent needs credentials to act, and those credentials tend to persist long after anyone remembers creating them. You need systems that watch the space you cannot see, flag what matters, and govern it before it becomes a liability.
What is a machine identity?
A machine identity is a digital identity assigned to a non-human actor (a service account, application, script, bot, API integration, IoT device, automated workload, or more recently, an AI agent) that needs to authenticate and act within a system. Each one can access data, trigger processes, and move through your systems. And each one is a potential entry point for an attacker.
The difference from a human identity is behavioral. People log in, do their work, and log out. Machines run constantly, authenticate silently, and often hold standing access to sensitive systems. When their credentials leak, the exposure lasts. Recent research found that 70% of leaked secrets remain active two years after exposure.
Why do machine identities outnumber human ones?
Modern architecture multiplies digital identities. A single application can spin up dozens of microservices, each with its own credentials. Cloud platforms provision workloads on demand, and automation connects systems through APIs that authenticate thousands of times a day. Every integration adds identities that never appear on an org chart.
The 92:1 ratio reflects that reality, and it predates the current wave of AI agents. As agents move from pilots into production, the count climbs further.
The agentic AI factor
Static machine identities follow rules. An API key does one job. Agentic AI is different. These systems access data, make decisions, and complete tasks on their own, and they are becoming easier to create and deploy every quarter.
In many organizations, agentic AI operates without proper logging or monitoring. The technology is developing faster than the compliance and governance needed to oversee it.
This changes the math and the risk. An autonomous agent may request access to several systems, chain actions together, and operate without a person watching each step. Multiply that across an enterprise adopting AI broadly, and the machine identity population grows in ways traditional governance never anticipated.
Unisys research in Top IT Insights for 2026 points to AI accelerating cyberattacks on both sides of the fight. Machine identity is where much of that pressure will land first.
“Privileged access management already covers this.” But does it really?
A fair objection: Many organizations already manage service accounts through privileged access management. That’s a real starting point, and it matters. But most of those tools were built to vault credentials and control human administrators, not to discover autonomous agents, map what they can reach, or rotate secrets at machine speed. Retrofitting a people-focused framework onto an agent-driven estate leaves blind spots precisely where growth is fastest.
Four ways to close the gap
Managing machine identities effectively starts with treating them as their own discipline. These four steps build the foundation.
- See everything first. You cannot govern what you cannot find. Build a mechanism to track machine and agent identities before you do anything else. Visibility is the foundation.
- Adopt purpose-built strategies. Approaches designed for machine and agent identity outperform frameworks adapted from human models.
- Deploy tools built for the job. Modern identity and access management and privileged access management platforms now support machine identities natively. Use that capability rather than finding a workaround.
- Measure what matters now. Track your visibility index (identities discovered versus actively managed), secrets sprawl, orphan rate, and how often credentials rotate automatically. Apply the same rigor as you do for human access.
What machine identity risk means for security leaders
The machine identity problem is not waiting for a roadmap. It grows with every workload you deploy and every agent you activate. Treating machine identity as a priority enables you to maintain control while the population is still governable.
The conversation belongs at the board level: lower breach risk, stronger compliance, and control over an attack surface that expands with every AI investment you approve.
How to start managing machine identities
Begin with visibility. Count the identities you have (human and non-human) and compare that with what your team currently manages. The gap between those two numbers is your exposure, and it tells you where to focus.
For practical guidelines, including the metrics that define a strong identity program and the steps to build the business case, read our guide to identity-first security. It covers how to move from a perimeter model to one built for the identities that now define your environment.
