Machine Identities Now Outnumber Your Employees 144 to 1. Who's Certified to Govern Them?
October 13, 2026
Randy Hall, CEO— AI-assisted and reviewed prior to publication.
Non-human identities, meaning service accounts, API keys, bots, and now autonomous AI agents, outnumber human employees by as much as 144 to 1 in cloud-native environments. Most identity teams were hired and trained to manage people, not machines. That mismatch is now a board-level risk, and the fix starts with who you certify, not what you buy.
How many machine identities does a typical company actually have?
More than most CISOs can state with confidence. Research from Entro Security found that non-human identities grew 44% between H1 2024 and H1 2025, pushing the ratio of machine to human identities to 144 to 1 in cloud and DevOps environments, up from 92 to 1 a year earlier. CyberArk's own global research arrives at a lower but still staggering figure, reporting that machine identities significantly outnumber human identities, creating a pressing need for dedicated security programs.
The exact multiple depends on whose methodology you trust and whether you count AI agents separately from service accounts. What does not depend on methodology is the direction of travel. Every cloud migration, every CI/CD pipeline, every new SaaS integration spins up credentials that never log in through a badge reader and never show up on an org chart. Nobody budgeted headcount to govern them, because two years ago there was comparatively little to govern.
Why did identity suddenly become a board-level budget line?
Because identity, not malware or network intrusion, is now the primary way attackers get in. A Ponemon Institute study commissioned by GuidePoint Security found that identity-based threats make up more than three-quarters of breaches, while IAM itself remains under-prioritized relative to other security spending. That gap between risk and investment is exactly what gets flagged in a post-incident board review, and exactly what a finance committee asks about before the next budget cycle.
The machine identity layer makes the gap worse because it is largely invisible to the controls built for people. CyberArk's regional research backs this up directly: 78% of security leaders reported security incidents or breaches linked to compromised machine identities. A compromised service account or leaked API key does not trigger a failed login alert, does not get flagged by multi-factor authentication, and often carries broader permissions than the humans who provisioned it. Security teams trained to watch for suspicious human behavior are, by design, not watching the identity class that now dominates the environment.
The agent problem: when the credential can act on its own
Agentic AI turns a governance gap into an accountability gap. A Cloud Security Alliance whitepaper on the topic put real numbers behind what practitioners already suspected: the non-human to human identity ratio in some environments has reached 50 to 1, with projections suggesting this ratio may reach 80 to 1 within two years, and that 92% of organizations surveyed are not confident their legacy identity and access management approach can handle AI identity risk. The same research found that only 28% of organizations can trace an agent's actions back to a human sponsor across all their environments.
That last number matters more than it sounds. An AI agent that can read a database, call an API, and write to a ticketing system is not a passive credential sitting in a vault. It is an actor that makes decisions, and when something goes wrong, your auditor, your regulator, or your insurer will ask who was accountable for provisioning and reviewing its access. A related CSA analysis of the broader governance picture found that 16% of organizations do not track the creation of AI-related identities at all, which means for one in six companies, the question "who approved this agent's access" has no answer on file.
What should a CISO actually buy: a platform, a policy, or a trained person?
All three, but in that order of leverage, the trained person comes first. A platform without someone who understands non-human identity lifecycle management will generate alerts nobody reads correctly. A written policy without someone trained to enforce it against hundreds of thousands of credentials is a document, not a control. The organizations CyberArk surveyed that reported fewer machine identity incidents were not simply the ones with more tooling. They were the ones treating machine identity governance as a distinct discipline with dedicated ownership.
That discipline looks different from classic human-centric IAM in a few concrete ways:
- Lifecycle management has to assume credentials are created programmatically, often by other automation, not provisioned through a help desk ticket.
- Least privilege has to be enforced against workloads and agents that can request new scopes at runtime, not just against static job roles.
- Audit trails need to answer "which human sponsored this identity" by design, because the CSA research shows most organizations currently cannot answer that question at all.
This is precisely the skill set Microsoft's SC-300: Identity and Access Administrator curriculum is built around, covering identity lifecycle, conditional access, and privileged access for the hybrid, multi-cloud, workload-heavy environments most enterprises actually run. If your identity team was trained on employee provisioning and password policy five years ago, the gap between that training and today's identity estate is the gap your next audit finds.
Where to start building this into your team's skill set
Start by treating identity governance training the way you would treat any other control with a quantified failure rate attached to it: as a cost of doing business, not a discretionary line item. ISACA's own research, covered in Infosecurity Magazine's reporting on AI training gaps, points to the same conclusion from a different angle: organizations still lack the skills and governance frameworks needed to keep pace with how fast AI is being embedded into operations.
If you're deciding where to put training dollars this quarter, a full curriculum overview of identity, access, and governance coursework is worth reviewing on the Forge University resources page before you commit a budget line to one certification path over another. For teams that want a structured plan rather than a scattered reading list, you can start training against a defined exam blueprint instead of trying to piece together machine identity governance knowledge from vendor whitepapers.
The number that should stick with you is not 144 to 1 or 50 to 1. Every methodology lands somewhere different, and the exact ratio will keep moving as agentic AI adoption accelerates. The number that matters is 28%, the share of organizations that can currently trace an autonomous agent's actions back to an accountable human. That is a training gap before it is a tooling gap, and it is the one your board will ask about first.