NOBODY OFFBOARDS THE ROBOT

You did the work. Over three issues we walked through building an automated access review — out of spreadsheet hell, into a real pipeline, with remediation, ticketing and reporting on the back end. It runs quarterly. It produces evidence your auditor accepts.

It covers your employees.

That was a defensible scope in 2023. It is not one now. According to ManageEngine’s 2026 Identity Security Outlook, organizations are reporting machine-to-human identity ratios of 100:1, with some cloud-native environments reaching 500:1. If that ratio holds anywhere near your environment, the review you spent a quarter automating governs roughly one percent of the things that can authenticate against your systems.

And then, sometime in the last eighteen months, your company started shipping agents.

THE RATIO NOBODY MEASURES

Non-human identity security is not a new discipline so much as an old one that never got counted. Service accounts, API keys, OAuth tokens, CI/CD runners, webhooks, database users, certificates, and now agents — each one is a principal that can authenticate, hold permissions, and act. Almost none of them appear in the identity governance process you built for humans.

Read those together and a specific shape emerges. The problem is not simply that there are many non-human identities. It is that they are overwhelmingly overprivileged and that a very small subset of them holds effectively unlimited access. Entro Security’s finding that 0.01% of machine identities control 80% of cloud resources describes a population where a single compromised credential is rarely a contained event.

This is why attackers stopped bothering to phish your CFO. A hardcoded key in a repository does not have MFA, does not get suspicious, and does not report anything to anyone.

“

A human identity has an owner, a manager, a start date and a termination date. A service account has a creator — who left in 2024.

The practical starting point is unglamorous: you cannot govern this population until you can count it. Before any of the rest of this matters, someone needs to produce the number — how many non-human identities exist, in which systems, holding what. Most teams discover the number is between ten and a hundred times what they guessed.

THE NUMBER ONE RISK IS THE ONE YOU ALREADY SOLVED FOR PEOPLE

OWASP published a Non-Human Identities Top 10, built from real breaches. The entry at number one is not an exotic cryptographic failure. It is NHI1: Improper Offboarding — identities that are never deactivated when the project is cancelled, the integration is replaced, or the developer who created them leaves.

That should be a familiar problem, because it is precisely the problem your human access review exists to catch. You already built the muscle. You just never pointed it at the larger population.

The trend data says this is getting worse rather than better. Veza’s research found dormant accounts nearly doubled year over year, while orphaned identities grew 40%. Roughly 71% of non-human identities are not rotated within recommended timeframes.

THEN YOU SHIPPED AGENTS

Every problem above predates AI. Agents did not create them — they industrialized them, by adding a class of identity that provisions itself, acquires credentials as it works, and takes actions no ticket describes in advance.

In January 2026 the Cloud Security Alliance surveyed 418 IT and security professionals for research commissioned by Token Security. The results are the clearest picture we have of how far agent deployment has outrun agent governance.

Put the first and third numbers side by side. Eighty-two percent of organizations have agents they cannot see, and only twenty-one percent have any process for shutting one down. Token Security calls the result retirement debt: agents that linger long past their intended use, holding permissions and credentials nobody is tracking.

That is OWASP NHI1 — improper offboarding — reappearing at machine scale, in a population that grows without a procurement request.

The gap between the 68% who feel confident and the 82% running unknown agents is the whole story. This is not a population anyone is deliberately ignoring. It is one that most teams genuinely believe they have covered, because the dashboards they built for humans report green.

“

82% of organizations have unknown AI agents running in their IT infrastructure.

If you take one action from this section, make it the inventory: enumerate every agent running against your production systems, and for each one, name the credential it holds and the human who owns it. The agents that cannot be attributed to an owner are your findings list.

WHEN THE CREDENTIALS DO THE WALKING

On July 16, 2026, Hugging Face disclosed that an intrusion into its production infrastructure had been driven end to end by an autonomous AI agent rather than a human operator. It is worth reading the primary disclosure rather than the coverage — it is unusually candid.

The entry point was a code-execution flaw: a malicious dataset abused a remote-code dataset loader and a template injection in a dataset configuration, giving the attacker execution on a processing worker. Ordinary enough. What happened next is the part that belongs in this article.

From that worker, the actor escalated to node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a single weekend. Forensics recovered more than 17,000 recorded events from the attacker’s action log — thousands of small automated decisions executed at machine speed across a swarm of short-lived sandboxes.

To Hugging Face’s credit, the disclosure is specific about limits: they found no evidence of tampering with public, user-facing models, datasets or Spaces, and verified their software supply chain — container images and published packages — as clean. What was accessed was a limited set of internal datasets and several credentials used by their services.

We have made this argument about famous breaches before: the spectacular intrusion is almost always enabled by an unglamorous control nobody turned on. Credential scope and rotation are exactly that kind of control, and they are the ones that decide whether a foothold stays a foothold.

YOUR AUDITOR IS ALREADY ASKING

There is no new framework to buy here, which is the same conclusion we reached about the AI questions assessors are asking. SOC 2 CC6 governs logical access. It has never said human access. ISO 27001 Annex A controls on access rights and privileged access do not carve out service accounts. Nothing needs to change in the criteria for this to be in scope — and assessors have started testing it.

The enforcement data has caught up too. IBM’s 2025 Cost of a Data Breach Report, researched by the Ponemon Institute across 600 organizations, found that 13% reported breaches of AI models or applications — and 97% of those lacked proper AI access controls. In the same study, 63% had no AI governance policy at all, and high levels of shadow AI added roughly $670,000 to the average breach cost.

Ninety-seven percent is not a distribution. It is a single finding wearing a percentage sign: when AI systems get breached, access control is essentially always the thing that was missing.

That last point is the one worth designing around now. Giving every agent its own scoped, attributable identity is more work up front than handing it an existing service account, and it is the difference between an incident you can reconstruct and one you cannot.

EXTEND THE REVIEW YOU ALREADY BUILT

The good news is that this is not a new program. If you followed the access review series, you already own the pipeline, the ticketing integration and the reporting. What follows is a scope change and a set of triggers.

None of that requires a platform purchase. It requires deciding that a credential is an identity, and that identities get governed regardless of whether a person is holding them.

The uncomfortable version of this article is short. Your organization has spent years maturing how it grants, reviews and revokes access for the smallest identity population it has, while the largest one grew a hundredfold with no owner, no expiry and no review. Then you added a class of identity that acts on its own initiative at machine speed. The controls are not wrong. The scope is.

The Illumenati // Boutique GRC for the AI-First Era // illumen.io