{"id":130936,"date":"2026-08-05T23:26:37","date_gmt":"2026-08-05T23:26:37","guid":{"rendered":"https:\/\/www.europesays.com\/ai\/130936\/"},"modified":"2026-08-05T23:26:37","modified_gmt":"2026-08-05T23:26:37","slug":"machine-identities-now-outnumber-humans-can-your-iam-keep-up","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/ai\/130936\/","title":{"rendered":"Machine identities now outnumber humans: Can your IAM keep up?"},"content":{"rendered":"

For years, enterprise identity security was built around people. AI has changed that. Palo Alto Networks\u2019 2026 Identity Security Landscape reveals that machine identities now outnumber human identities by 109 to 1Opens a new window <\/a>, up from 82 to 1 last year.\u00a0\u00a0\u00a0\u00a0<\/p>\n

This growth goes beyond familiar service accounts and API keys. It includes cloud workloads, certificates, automated processes, and AI agents that are rapidly adding new identities across environments.\u00a0 According to the report, 99% of surveyed organizations have adopted AI agents and 40% of those agents already access business data.<\/p>\n

The surge is putting pressure on Identity and Access Management (IAM) models built around human users and predictable access patterns. AI agents can act independently, call services, and access resources with limited human intervention. Their identities are created, modified, and retired far more quickly than conventional governance processes were designed to handle.<\/p>\n

READ MORE:
\n\t\t \tWhat is authentication and why has it become more important in the age of AI cyberattacks?<\/a><\/p>\n

GartnerOpens a new window <\/a> has put these developments on its list of cybersecurity trends for 2026. It highlighted AI agent identity registration, governance, credential automation, and policy-driven authorization as new IAM challenges.\u00a0<\/p>\n

So enterprises today don\u2019t just have to secure employee identities alone. Their IAM programs must now manage a workforce increasingly populated by bots.\u00a0<\/p>\n

AI agents make the old identity model harder to apply<\/p>\n

Traditional IAM frameworks were built around relatively stable identities, defined roles, and predictable access. AI agents challenge all three assumptions.\u00a0<\/p>\n

In a recent podcastOpens a new window <\/a>, Grant Miller, IBM\u2019s distinguished engineer and CTO, discussed how traditional IAM models are inadequate in environments dominated by agentic AI. He noted that these models are designed for human-centric access, rather than for autonomous systems.\u00a0<\/p>\n

\u201cAbsence of granular control over specific agents, over privilege of super agents, and inadequate real-time oversight make static models ineffective\u201d, Miller said. AI agents operate in shifting, non-deterministic ways, he explained, which means access must be fine-grained and context-based, and limited to the specific task an agent is performing.<\/p>\n

Most organizations can\u2019t distinguish between human and AI agent activity. A Cloud Security Alliance (CSA) surveyOpens a new window <\/a> from March 2026 found that 52% use workload identities for agents, 43% use shared service accounts, and 31% allow agents to operate under human identities.<\/p>\n

READ MORE:
\n\t\t \tWhat proactive cybersecurity looks like in the AI era<\/a><\/p>\n

This creates an attribution problem. When multiple agents share the same account, it becomes difficult to identify which agent performed a specific action. If an agent used an employee\u2019s ID, the audit trail points to the person instead.\u00a0<\/p>\n

Authorization becomes equally challenging. Older role-based access control assumes permission can be defined in advance. AI Agents can select tools and change course during a task, meaning the permissions they need can change during execution.<\/p>\n

The governance gap is the bigger problem\u00a0<\/p>\n

The bigger challenge isn\u2019t identifying AI agents. It\u2019s governing what they are allowed to do. An agent can be legitimate, authenticated, and still have more access than a task requires. It may begin with a user request, pull context from governed data, call an API, invoke an external tool, and trigger a workflow. Each step is governed by different controls scattered across prompts, applications, service accounts, and individual integrations.<\/p>\n

That fragmentation demands a fresh approach to providing access. Permission should be tied to the task, the sensitivity of data, and the risk surrounding an action. An agent handling a routine request may need far less access than the same agent performing a high-impact transaction. This makes consistent governance difficult when an agent moves across the enterprise.\u00a0<\/p>\n

This also means governing actions, not just identities. Policies must evaluate the user, the agent, the resource, the tools, and the requested action before granting permission.<\/p>\n

The agent identities should also be temporary. Instead of assigning agents standing credentials, organizations can create thinly scoped identities for specific tasks and retire them when the work ends. This limits the exposure created by credentials that remain active after their original purpose disappears.<\/p>\n

Audit trails also need to evolve. An agent may plan a task, hand part of it to a sub-agent, and use multiple tools before an action reaches a system. Audit trails therefore need to preserve that chain instead of simply recording which identity made the final request. Security information and event management (SIEM) platforms can help capture that activity for auditing and compliance.<\/p>\n

The result is a more dynamic IAM model where access is limited to the task, evaluated in context, and removed as soon as the task is complete.<\/p>\n

Least privilege has to become continuous<\/p>\n

Least privilege has also been a core IAM principle. A one-time permission setting is harder to apply considering the sheer volume of agentic systems and machine identities.<\/p>\n

A human employee may have a handful of persistent accounts. An enterprise can have thousands of workloads, APIs, and automated processes, each requiring credentials and permissions.<\/p>\n

That changes how least privilege is enforced.\u00a0 Organizations can\u2019t get every machine account reviewed manually. They need automated controls to issue short-lived permits, rotate secrets, and block access once workloads change or disappear.<\/p>\n

Workload identities reduce reliance on static credentials. Security teams can eliminate the practice of embedding long-lived keys in applications. Instead, they should establish identities for specific workloads and allow the infrastructure to issue credentials when those workloads run. This approach limits the damage if someone exposes a credential.<\/p>\n

The same principle applies to APIs and service accounts. Permissions should be narrow enough to ensure that one compromised machine identity does not open a path into a wider environment.<\/p>\n

Gartner recommends a targeted, risk-based approach that prioritizes the biggest identity risks while automating controls where possible.<\/p>\n

IAM\u2019s next challenge is accountability<\/p>\n

Security teams need to prove that autonomous systems can move quickly while staying within the organization\u2019s authority, which puts accountability under pressure.\u00a0<\/p>\n

Enterprises need evidence on how agents acted within approved boundaries, that permissions were justified, and that decisions can be reconstructed after the fact. Traditional audit cycles are too slow for systems executing hundreds of actions in minutes.<\/p>\n

Accountability also changes the relationship between IAM and the rest of the security stack. Identity data needs to be linked with application telemetry, API activity, data access, and security monitoring. That broader picture helps distinguish an expected machine action from a potentially compromised one.\u00a0<\/p>\n

Organizations that manage agent IDs effectively will treat identity as an operational control and not a directory function. The advantage comes from knowing which machine actors can act, what authority they have, and when that authority should stop.<\/p>\n

With the rise of autonomous systems, accountability will have to operate at the same speed as the machines themselves.<\/p>\n","protected":false},"excerpt":{"rendered":"For years, enterprise identity security was built around people. AI has changed that. Palo Alto Networks\u2019 2026 Identity…\n","protected":false},"author":2,"featured_media":130937,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[405,7537,49390],"class_list":["post-130936","post","type-post","status-publish","format-standard","has-post-thumbnail","category-agentic-ai","tag-ai-agents","tag-artificial-intelligence-agents","tag-machine-identities"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/130936","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=130936"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/130936\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/130937"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=130936"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=130936"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=130936"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}