Non-Human Identities: The Accounts That Outnumber Your People

Software signs in to your systems too. A script, a pipeline, an integration or an AI agent proves who it is with an account or a key, and no person sits behind that credential. The security industry calls these non-human identities, and each of the published counts compared in this article puts them well ahead of the number of employees.

What counts as a non-human identity

The term covers any account or credential that software uses to prove who it is. Service accounts, API keys, OAuth tokens and certificates are the familiar examples. Microsoft uses the narrower term workload identity. In its Entra overview, dated 8 May 2026, it puts applications and service principals under that heading, along with managed identities.

These accounts are harder to look after than staff accounts. Microsoft's page on Conditional Access for workload identities notes that they cannot perform multifactor authentication and often have no formal lifecycle process. It adds that their credentials have to be stored somewhere.

How many there are, and why the published ratios differ

Several organisations have published a ratio of machine accounts to people, and their answers differ widely. The table sets each figure beside the way it was produced.

The figures differ for four reasons, and this part is our reading of the sources in the table. The first is definition. Microsoft's 2023 figure counts workload identities, which are entries in a directory. The Palo Alto Networks report counts credentials as well, such as certificates and tokens, and one application can hold several. It also includes AI agents, at 79 agent identities per person. Our own subtraction leaves 30 for everything else.

The second reason is method. The CyberArk and Palo Alto Networks figures are survey answers, so they are estimates given by security decision makers. The Entro figure comes from the vendor's telemetry, which can only report what its product finds in the companies that use it. The third reason is sample, since neither a vendor's customers nor a survey panel is a cross-section of all companies. The fourth is time. The reports run from 2023 to 2026 and were never designed as one series. Every figure was also published by, or together with, a company that sells identity security products.

For planning, the safe statement is that estimates range from about 10 to more than 140 machine identities per employee, depending on what is counted, and that the most recent large survey says 109. What the accounts can do matters more than how many exist. In the CyberArk release of 23 April 2025, 42% of machine identities were said to have privileged or sensitive access, and 88% of respondents said their organisation applies the term privileged user to humans only.

What companies have said about their own breaches

Okta's root cause report of 3 November 2023 says an intruder reached its customer support system through a service account. The username and password of that account had been saved in an employee's personal Google account. Files associated with 134 customers were accessed between 28 September and 17 October 2023.

The same compromise reached Cloudflare. Its account, published on 1 February 2024, says it failed to rotate one service token and three service accounts that leaked during the Okta compromise, because it wrongly believed they were unused. An attacker used them to reach Cloudflare's internal wiki and bug database on 15 November 2023. Cloudflare says no customer data or systems were affected.

Microsoft's guidance of 25 January 2024 on the Midnight Blizzard attack describes a different path. The attacker first compromised a legacy test account by trying common passwords. From there it took over a legacy test OAuth application that had elevated access to Microsoft's corporate environment, and used that application to give new malicious applications a role that allows access to mailboxes.

Google's threat intelligence team reported on 26 August 2025 that an attacker used stolen OAuth tokens for the Salesloft Drift application to take data from Salesforce customer instances between 8 and 18 August 2025. The attacker searched that data for more credentials, including AWS access keys and Snowflake tokens.

The OWASP list of the ten main risks

OWASP, the non-profit behind several widely used security checklists, publishes a Non-Human Identities Top 10 for 2025. Its release notes date the first version to 9 December 2024. The short descriptions below are ours.

1. Improper offboarding: accounts left active after the application or its owner has gone.
2. Secret leakage: keys and tokens exposed in code or in chat tools.
3. Vulnerable third-party NHI: access granted to an outside product that is later compromised.
4. Insecure authentication: weak or outdated ways for software to sign in.
5. Overprivileged NHI: more permissions than the job needs.
6. Insecure cloud deployment configurations: build pipelines that hold static or poorly checked credentials.
7. Long-lived secrets: credentials that expire far in the future or never.
8. Environment isolation: one account used in both test and production.
9. NHI reuse: one account shared by several applications.
10. Human use of NHI: people signing in by hand with an account meant for software.

The incidents above fit this list, in our reading. Cloudflare's credentials, believed unused yet still active, come closest to improper offboarding, and Okta's saved password is secret leakage. Microsoft's test application with access to the corporate environment combines overprivilege with weak environment isolation. The Drift case is a vulnerable third-party identity.

What AI agents add

An AI agent has to authenticate to each system it reads or acts on, either as itself or on behalf of a user, so agents add to the identities a company must manage. In the Palo Alto Networks survey, organisations expected AI agents to increase by 85% over the following 12 months and machine identities by 77%. The expected growth in human identities was 56%. Microsoft's description of agent identities, updated on 15 June 2026, says an agent might exist for minutes or be "created and destroyed thousands of times per day". An application identity, by contrast, is expected to be stable and to have a known owner.

Microsoft's answer is Entra Agent ID. Its documentation dated 1 May 2026 describes the product as generally available, with one item on the same page still marked as preview. The agent identities page says each agent built in Copilot Studio gets an agent identity, with its creator recorded as sponsor. It also says extending Entra's security features to agents requires Microsoft Agent 365.

Two gaps remain. Microsoft's page on Conditional Access for agents states that an agent using an API key bypasses Entra sign-in entirely, so those policies do not apply to it. Keys for agent tooling also leak. GitGuardian's State of Secrets Sprawl 2026, published on 17 March 2026, found 24,008 unique secrets in configuration files on public GitHub for the Model Context Protocol, a standard that agents use to connect to tools. Of those, 2,117 were valid credentials. A separate article covers how an agent's identity decides which data it can reach.

Controls for a Microsoft 365 and Azure company

List every account and give it an owner

Export every app registration and service principal in your tenant, managed identities included, with its credentials, expiry dates, permissions and owners. Microsoft's security guidance for app registrations, dated 1 October 2026, says an administrator should review the owners list once every few months. Add the keys held outside Entra, such as API keys for SaaS products.

Stop issuing passwords to software

The same guidance sets an order of preference. Use a managed identity where the service runs on Azure, because it needs no ongoing credential management. Where the service runs elsewhere, workload identity federation lets Entra trust a token issued by GitHub Actions, Kubernetes, AWS or Google Cloud in place of a stored secret. If neither is possible, use a certificate. On client secrets it says: "Don't use password credentials, also known as secrets".

Block new secrets and cap lifetimes

Entra's application management policies can block the addition of new passwords on applications across the tenant and enforce a maximum lifetime for secrets and certificates. Microsoft's feature table lists these policies in the free edition of Entra Workload ID. The block is described as applying to new passwords, so existing ones still have to be found and replaced. Datadog's State of Cloud Security 2025, based on data collected in September 2025 from its customers' cloud environments, found that 40% of Microsoft Entra ID applications had credentials older than one year.

Retire what is unused, and revoke what leaks

Microsoft's Secure Future Initiative report of 10 July 2026 says 1.4 million unused apps were decommissioned. GitGuardian retested in January 2026 a set of credentials it had confirmed as valid in 2022 and found that more than 64% still worked. Revoke and replace a secret as soon as it turns up in a repository or chat channel.

Decide whether the paid controls are worth it

Four controls need Workload ID Premium, which the feature table describes as a standalone product. They are Conditional Access for workload identities, detection of compromised workload identities, recommendations that flag unused ones, and access reviews for service principals in privileged roles. According to Microsoft's page, the Conditional Access feature covers only single-tenant service principals registered in your tenant and excludes managed identities. The only action a policy can take is to block access.

Where QueryNow fits

QueryNow is a Microsoft partner that builds AI agents and the foundation enterprise AI runs on. On agent projects, each agent is given its own identity in the client's tenant with least-privilege access, as described in our article on agent approvals, identity and audit trails. You can talk to our team about an inventory of the non-human accounts in your own tenant.