A Fortune 500 manufacturer discovered this spring that it could not produce a complete list of the AI agents operating inside its own environment. Business units had spun up more than 400 agents through Copilot Studio, internal automation platforms, and vendor tools over eighteen months, each with its own service account, API key, and delegated permissions. Security had visibility into perhaps a third of them. This is not a hypothetical edge case. It is the default state of the modern enterprise, and it describes the defining cybersecurity problem of 2026: identity governance has not kept pace with the machines now doing the enterprise's work.
The numbers make the scale of the gap concrete. Non-human identities already outnumber human ones by roughly 50 to 1 in the average enterprise environment, and some analysts expect that ratio to reach 80 to 1 within two years. Gartner projects that a third of enterprise applications will incorporate agentic AI by 2028, up from under 1% just two years ago. Yet a 2026 Cloud Security Alliance analysis found that more than 16% of organizations do not track the creation of AI-related identities at all, and 78% have no formal policy governing when an AI identity gets created or retired. Ninety-two percent of security leaders surveyed said they are not confident their existing identity and access management tools can manage the risk these agents introduce. The infrastructure to grant an agent access has scaled far faster than the infrastructure to govern it.
Why Legacy IAM Breaks Down Here
Identity and access management was built for a world of relatively static actors: a human with a login, a service account with a fixed set of permissions, an API key tied to one integration. Agentic identities do not behave that way. They are dynamic, often ephemeral, and increasingly autonomous — reasoning through a task, delegating a sub-task to another agent, and requesting new permissions mid-workflow without a human in the loop. A SailPoint survey found that 80% of IT professionals have already observed an AI agent act unexpectedly or take an unauthorized action. When the actor requesting access can generate its own justification for why it needs broader permissions, the standard IAM model of provisioning based on a known role stops applying. This is not a tooling gap that a new dashboard fixes. It is a category mismatch between what legacy IAM was designed to govern and what agentic systems actually are.
The Cost of Treating Agents Like Service Accounts
Most organizations that have noticed the problem have responded by bolting agent credentials onto existing service-account frameworks — the fastest path to production, and the wrong one. Service accounts are provisioned once and audited occasionally. Agentic identities need continuous authorization: permissions that are evaluated against the specific task at hand, not granted broadly and left standing. An agent that legitimately needs read access to a customer database for a support workflow should not retain that access by default when it is repurposed for a marketing task next quarter. Without continuous evaluation, the enterprise accumulates exactly the kind of standing, over-permissioned access that turns a single compromised agent into a lateral-movement problem across every system it ever touched.
Where This Intersects With the Ransomware Playbook
This identity gap does not exist in isolation from the threat landscape CISOs are already managing. Ransomware remains the top-ranked risk in enterprise security surveys for 2026, and the operational lesson from this year's incidents is sobering: 69% of organizations believed they were well prepared for a ransomware attack before experiencing one, and that confidence dropped by more than 20 percentage points afterward. Only 41% of mid-market companies' existing defenses — including MFA, email security, and endpoint detection — actually blocked the attack they eventually suffered. The connective tissue between these two problems is access. AI-accelerated ransomware has compressed the window between initial access and full deployment from weeks to hours, and an attacker who compromises even one poorly governed agent identity inherits whatever standing access that agent was quietly holding. Data exfiltration prevention, not just endpoint containment, is now the defining capability separating organizations that recover quickly from those that don't — and exfiltration paths increasingly run through machine identities nobody was watching.
What Leaders Should Do in the Next Two Quarters
The fix is not a single product purchase. It starts with an inventory: before the next budget cycle, security leaders need a definitive count of every AI agent operating in the environment, who owns it, what it can access, and when it was last reviewed. Most organizations cannot produce this today, and that alone is a finding worth escalating to the board. Second, treat agent provisioning and decommissioning as a formal lifecycle with an owner, the same way onboarding and offboarding work for employees — not an ad hoc decision made by whichever team stood the agent up. Third, move toward continuous, task-scoped authorization for agentic access rather than static role-based grants; this is a governance change more than a technology one, and it should be led by identity and risk teams, not left to whichever platform vendor sold the automation tool. Fourth, extend incident response runbooks to explicitly cover agent compromise scenarios — most current playbooks were written for human credential theft and do not address an autonomous actor escalating its own permissions mid-incident.
Measuring Progress the Board Will Understand
None of this requires waiting for a mature market of agentic-identity-native tools, though that market is emerging quickly. It requires treating the agent inventory gap with the same urgency as any other material control weakness, because that is what it is. The organizations that get ahead of this will be able to answer three questions on demand: how many agents exist, what each one can touch, and how quickly a compromised agent's access can be revoked. Boards should expect those answers within two quarters, not as a security project update but as a standing item, because the ratio of machine identities to human ones is only going to widen from here — and the cost of governing it after the fact is always higher than the cost of governing it now.