How many machine identities are there per human in 2026?

Palo Alto Networks' 2026 Identity Security Landscape found machine identities outnumber human identities 109:1, a ratio that includes 79 AI agent identities per human. CyberArk's 2025 edition of the same survey put the ratio at 82:1.

How many organizations use AI agents?

In Palo Alto Networks' 2026 survey, 99% of organizations reported using autonomous AI agents, and respondents expect AI agents to grow by 85% over the next 12 months. SailPoint's 2025 survey found 82% of organizations already used AI agents, but only 44% had policies to secure them.

Do organizations have security controls for AI agents?

CyberArk's 2025 survey found 68% of organizations lack identity security controls for AI. SailPoint's 2025 survey found 80% of companies say their AI agents have taken unintended actions, and 23% reported agents being tricked into revealing access credentials.

How many secrets were leaked on GitHub in 2025?

GitGuardian detected 28.65 million new hardcoded secrets in public GitHub commits in 2025, a 34% increase over 2024. Leaked AI service secrets reached 1,275,105, up 81%, and more than 64% of secrets confirmed valid in 2022 were still valid in January 2026.

Are service accounts and machine identities treated as privileged?

Mostly not. CyberArk's 2025 survey found 88% of organizations still define a privileged user as human-only, even though 42% of machine identities have access to sensitive data. Palo Alto Networks found only 39% of privileged access is managed through just-in-time or zero standing privileges.

Statistics · 22 sourced figures · last checked 2026-11-05

Non-human identity statistics 2026

Name: Non-human identity statistics 2026
Creator: Start with Identity
License: https://creativecommons.org/licenses/by/4.0/
Keywords: Non-human identity, Scale and machine-to-human ratio, AI agents and agentic identity, Secrets sprawl, Governance gaps and breaches

As of November 2026: Palo Alto Networks' 2026 survey of 2,930 security leaders found machine identities outnumber humans 109:1, including 79 AI agent identities per human, and 99% of organizations already use autonomous AI agents. Controls lag behind: CyberArk found 68% of organizations lack identity security controls for AI, and SailPoint found 80% of companies have seen AI agents take unintended actions. Credentials keep leaking, with GitGuardian counting 28.65 million new hardcoded secrets in public GitHub commits in 2025.

Scale and machine-to-human ratio

109:1
Machine identities, including AI agents, outnumber human identities by 109:1 in the organizations Palo Alto Networks surveyed for its 2026 Identity Security Landscape.
Source: Palo Alto Networks, 2026 Identity Security Landscape (Chapter One), published May 2026
Method: Survey of 2,930 cybersecurity decision-makers in 20 countries, conducted by Vanson Bourne for Palo Alto Networks in March and April 2026. Last checked 2026-11-05.
How to cite
Palo Alto Networks, "2026 Identity Security Landscape (Chapter One)," May 2026, https://www.paloaltonetworks.com/idira/identity-security-landscape-report. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-machine-to-human-ratio-2026 (checked 2026-11-05).
79
The 109:1 machine-to-human ratio in Palo Alto Networks' 2026 survey includes 79 AI agent identities for every human identity.
Source: Palo Alto Networks, 2026 Identity Security Landscape (Chapter One), published May 2026
Method: Survey of 2,930 cybersecurity decision-makers in 20 countries, conducted by Vanson Bourne for Palo Alto Networks in March and April 2026. Last checked 2026-11-05.
How to cite
Palo Alto Networks, "2026 Identity Security Landscape (Chapter One)," May 2026, https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/identity-security-landscape-report.pdf. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-ai-agent-identities-per-human (checked 2026-11-05).
85%
Organizations in Palo Alto Networks' 2026 survey expect the number of AI agents to grow by 85% over the next 12 months, against 56% growth in human identities.
Source: Palo Alto Networks, 2026 Identity Security Landscape (Chapter One), published May 2026
Method: Survey of 2,930 cybersecurity decision-makers in 20 countries, conducted by Vanson Bourne for Palo Alto Networks in March and April 2026. Last checked 2026-11-05.
How to cite
Palo Alto Networks, "2026 Identity Security Landscape (Chapter One)," May 2026, https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/identity-security-landscape-report.pdf. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-ai-agent-growth-forecast (checked 2026-11-05).
77%
Organizations in Palo Alto Networks' 2026 survey expect machine identities to grow by 77% over the next 12 months.
Source: Palo Alto Networks, 2026 Identity Security Landscape (Chapter One), published May 2026
Method: Survey of 2,930 cybersecurity decision-makers in 20 countries, conducted by Vanson Bourne for Palo Alto Networks in March and April 2026. Last checked 2026-11-05.
How to cite
Palo Alto Networks, "2026 Identity Security Landscape (Chapter One)," May 2026, https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/identity-security-landscape-report.pdf. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-machine-identity-growth-forecast (checked 2026-11-05).
82:1
CyberArk's 2025 survey put the ratio of machine identities to human identities at 82:1, nearly double the ratio it first reported in 2022.
Source: CyberArk, CyberArk 2025 Identity Security Landscape, published April 23, 2025
Method: Survey of 2,600 cybersecurity decision-makers in 20 countries, conducted by Vanson Bourne for CyberArk in January and February 2025. Last checked 2026-11-05.
How to cite
CyberArk, "CyberArk 2025 Identity Security Landscape," April 23, 2025, https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/ebooks/2025-identity-security-landscape.pdf. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-machine-to-human-ratio-2025 (checked 2026-11-05).

AI agents and agentic identity

99%
99% of organizations in Palo Alto Networks' 2026 Identity Security Landscape survey report using autonomous AI agents.
Source: Palo Alto Networks, 2026 Identity Security Landscape (Chapter One), published May 2026
Method: Survey of 2,930 cybersecurity decision-makers in 20 countries, conducted by Vanson Bourne for Palo Alto Networks in March and April 2026. Last checked 2026-11-05.
How to cite
Palo Alto Networks, "2026 Identity Security Landscape (Chapter One)," May 2026, https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/identity-security-landscape-report.pdf. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-orgs-using-ai-agents-2026 (checked 2026-11-05).
40%
On average, 40% of AI agents already have access to organizational data, according to respondents in Palo Alto Networks' 2026 survey.
Source: Palo Alto Networks, 2026 Identity Security Landscape (Chapter One), published May 2026
Method: Survey of 2,930 cybersecurity decision-makers in 20 countries, conducted by Vanson Bourne for Palo Alto Networks in March and April 2026. Last checked 2026-11-05.
How to cite
Palo Alto Networks, "2026 Identity Security Landscape (Chapter One)," May 2026, https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/identity-security-landscape-report.pdf. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-ai-agents-with-data-access (checked 2026-11-05).
90%
90% of respondents in Palo Alto Networks' 2026 survey agree that AI agents should operate under least privilege, with bounded access and tighter controls.
Source: Palo Alto Networks, 2026 Identity Security Landscape (Chapter One), published May 2026
Method: Survey of 2,930 cybersecurity decision-makers in 20 countries, conducted by Vanson Bourne for Palo Alto Networks in March and April 2026. Last checked 2026-11-05.
How to cite
Palo Alto Networks, "2026 Identity Security Landscape (Chapter One)," May 2026, https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/identity-security-landscape-report.pdf. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-ai-agents-least-privilege-agree (checked 2026-11-05).
68%
68% of organizations in CyberArk's 2025 Identity Security Landscape survey lack identity security controls for AI, while 72% of their employees regularly use AI tools at work.
Source: CyberArk, CyberArk 2025 Identity Security Landscape, published April 23, 2025
Method: Survey of 2,600 cybersecurity decision-makers in 20 countries, conducted by Vanson Bourne for CyberArk in January and February 2025. Last checked 2026-11-05.
How to cite
CyberArk, "CyberArk 2025 Identity Security Landscape," April 23, 2025, https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/ebooks/2025-identity-security-landscape.pdf. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-no-identity-controls-for-ai (checked 2026-11-05).
82%
82% of organizations in SailPoint's 2025 survey already use AI agents, but only 44% have policies in place to secure them.
Source: SailPoint, AI agents: The new attack surface, published May 28, 2025
Method: Survey of 353 enterprise IT professionals with security responsibilities across five continents, conducted by Dimensional Research for SailPoint. Last checked 2026-11-05.
How to cite
SailPoint, "AI agents: The new attack surface," May 28, 2025, https://www.sailpoint.com/press-releases/sailpoint-ai-agent-adoption-report. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-orgs-using-ai-agents-2025 (checked 2026-11-05).
80%
80% of companies in SailPoint's 2025 survey say their AI agents have taken unintended actions, such as accessing unauthorized systems or sharing sensitive data.
Source: SailPoint, AI agents: The new attack surface, published May 28, 2025
Method: Survey of 353 enterprise IT professionals with security responsibilities across five continents, conducted by Dimensional Research for SailPoint. Last checked 2026-11-05.
How to cite
SailPoint, "AI agents: The new attack surface," May 28, 2025, https://www.sailpoint.com/press-releases/sailpoint-ai-agent-adoption-report. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-ai-agents-unintended-actions (checked 2026-11-05).
23%
23% of respondents in SailPoint's 2025 survey reported that their AI agents had been tricked into revealing access credentials.
Source: SailPoint, AI agents: The new attack surface, published May 28, 2025
Method: Survey of 353 enterprise IT professionals with security responsibilities across five continents, conducted by Dimensional Research for SailPoint. Last checked 2026-11-05.
How to cite
SailPoint, "AI agents: The new attack surface," May 28, 2025, https://www.sailpoint.com/press-releases/sailpoint-ai-agent-adoption-report. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-ai-agents-tricked-credentials (checked 2026-11-05).

Secrets sprawl

28.65 million
GitGuardian detected 28.65 million new hardcoded secrets in public GitHub commits in 2025, a 34% increase over 2024 and the largest single-year jump it has recorded.
Source: GitGuardian, The State of Secrets Sprawl 2026, published March 17, 2026
Method: GitGuardian scan of public GitHub commits made in 2025, about 1.94 billion commits. Last checked 2026-11-05.
How to cite
GitGuardian, "The State of Secrets Sprawl 2026," March 17, 2026, https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-public-github-secrets-2025 (checked 2026-11-05).
1,275,105
GitGuardian found 1,275,105 leaked AI service secrets on public GitHub in 2025, up 81% year over year.
Source: GitGuardian, The State of Secrets Sprawl 2026, published March 17, 2026
Method: GitGuardian scan of public GitHub commits made in 2025, about 1.94 billion commits. Last checked 2026-11-05.
How to cite
GitGuardian, "The State of Secrets Sprawl 2026," March 17, 2026, https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-ai-service-secrets-leaked (checked 2026-11-05).
24,008
GitGuardian identified 24,008 unique secrets exposed in MCP-related configuration files on public GitHub, of which 2,117 were valid credentials.
Source: GitGuardian, The State of Secrets Sprawl 2026, published March 17, 2026
Method: GitGuardian scan of MCP-related configuration files in public GitHub repositories for its 2026 report. Last checked 2026-11-05.
How to cite
GitGuardian, "The State of Secrets Sprawl 2026," March 17, 2026, https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-mcp-config-secrets (checked 2026-11-05).
3.2%
Claude Code-assisted commits on public GitHub showed a 3.2% secret-leak rate in GitGuardian's 2025 data, against a 1.5% baseline across all public commits.
Source: GitGuardian, The State of Secrets Sprawl 2026, published March 17, 2026
Method: GitGuardian comparison of secret-leak rates in Claude Code-assisted commits and all public GitHub commits made in 2025. Last checked 2026-11-05.
How to cite
GitGuardian, "The State of Secrets Sprawl 2026," March 17, 2026, https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-claude-code-commit-leak-rate (checked 2026-11-05).
64%
More than 64% of secrets GitGuardian confirmed as valid in 2022 were still valid when it retested them in January 2026, down from nearly 70% a year earlier.
Source: GitGuardian, The State of Secrets Sprawl 2026, published March 17, 2026
Method: GitGuardian retest in January 2026 of leaked credentials it had confirmed valid in 2022. Last checked 2026-11-05.
How to cite
GitGuardian, "The State of Secrets Sprawl 2026," March 17, 2026, https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-secrets-still-valid (checked 2026-11-05).
33,185
GitGuardian's analysis of 6,943 machines compromised in the Shai-Hulud 2 supply-chain attack found 33,185 unique secrets, and 59% of the machines were CI/CD runners.
Source: GitGuardian, The State of Secrets Sprawl 2026, published March 17, 2026
Method: GitGuardian analysis of the Shai-Hulud 2 exfiltration dataset covering 6,943 compromised machines and 294,842 secret occurrences. Last checked 2026-11-05.
How to cite
GitGuardian, "The State of Secrets Sprawl 2026," March 17, 2026, https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-shai-hulud-unique-secrets (checked 2026-11-05).

Governance gaps and breaches

9 out of 10
9 out of 10 organizations in Palo Alto Networks' 2026 survey faced a successful identity-related breach in the last 12 months.
Source: Palo Alto Networks, 2026 Identity Security Landscape (Chapter One), published May 2026
Method: Survey of 2,930 cybersecurity decision-makers in 20 countries, conducted by Vanson Bourne for Palo Alto Networks in March and April 2026. Last checked 2026-11-05.
How to cite
Palo Alto Networks, "2026 Identity Security Landscape (Chapter One)," May 2026, https://www.paloaltonetworks.com/idira/identity-security-landscape-report. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-identity-breach-rate (checked 2026-11-05).
39%
On average, only 39% of privileged access is managed through a just-in-time or zero standing privileges model, according to Palo Alto Networks' 2026 survey.
Source: Palo Alto Networks, 2026 Identity Security Landscape (Chapter One), published May 2026
Method: Survey of 2,930 cybersecurity decision-makers in 20 countries, conducted by Vanson Bourne for Palo Alto Networks in March and April 2026. Last checked 2026-11-05.
How to cite
Palo Alto Networks, "2026 Identity Security Landscape (Chapter One)," May 2026, https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/identity-security-landscape-report.pdf. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-privileged-access-jit (checked 2026-11-05).
42%
42% of machine identities have access to sensitive data, compared with 37% of human users, according to CyberArk's 2025 survey.
Source: CyberArk, CyberArk 2025 Identity Security Landscape, published April 23, 2025
Method: Survey of 2,600 cybersecurity decision-makers in 20 countries, conducted by Vanson Bourne for CyberArk in January and February 2025. Last checked 2026-11-05.
How to cite
CyberArk, "CyberArk 2025 Identity Security Landscape," April 23, 2025, https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/ebooks/2025-identity-security-landscape.pdf. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-machine-identities-sensitive-access (checked 2026-11-05).
88%
88% of organizations in CyberArk's 2025 survey still define a privileged user as human-only, up from 61% in 2024.
Source: CyberArk, CyberArk 2025 Identity Security Landscape, published April 23, 2025
Method: Survey of 2,600 cybersecurity decision-makers in 20 countries, conducted by Vanson Bourne for CyberArk in January and February 2025. Last checked 2026-11-05.
How to cite
CyberArk, "CyberArk 2025 Identity Security Landscape," April 23, 2025, https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/ebooks/2025-identity-security-landscape.pdf. Compiled in Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/#non-human-identity-privileged-defined-human-only (checked 2026-11-05).

From SWI's own datasets

Computed from Start with Identity's own primary-sourced datasets each time the site is built, so these figures move when the data does. Follow each link for the records behind the number.

25%
of 123 identity-led breaches in our database involved a non-human identity (31 incidents).
SWI Identity Breach Database
14
began with exposed secrets or abused OAuth tokens.
SWI Identity Breach Database
49%
of 99 identity-security equity rounds we tracked since January 2025 explicitly targeted AI agents or non-human identities (49 rounds, $3.31B priced).
SWI identity funding dataset

What qualifies as a statistic

Every figure on this page is primary (linked to the publisher's own report, press release or official page, never a stats roundup), dated (the publisher's release date is shown) and has a stated method (survey sample, telemetry or official count). We read each number on its source page on the date shown as last checked, and drop anything we cannot verify.

Vendor surveys are labeled with the vendor's name: treat them as one company's view of its own customers or respondents, not a census. Spot an error or a newer edition? Tell us.

How to cite this page

Cite the original publisher for each number (every card has a "How to cite" line), and link this page as the compilation. Our compilation is CC BY 4.0; download it as CSV or JSON.

Start with Identity, "Non-human identity statistics 2026," https://startwithidentity.com/statistics/non-human-identity/ (last checked 2026-11-05). Cite each figure to its original publisher.

Related on Start with Identity

More identity statistics

Passkeys MFA Credential attacks Identity breaches Customer identity (CIAM)Digital identity Identity market

Non-human identity statistics: questions

How many machine identities are there per human in 2026?: Palo Alto Networks' 2026 Identity Security Landscape found machine identities outnumber human identities 109:1, a ratio that includes 79 AI agent identities per human. CyberArk's 2025 edition of the same survey put the ratio at 82:1.
How many organizations use AI agents?: In Palo Alto Networks' 2026 survey, 99% of organizations reported using autonomous AI agents, and respondents expect AI agents to grow by 85% over the next 12 months. SailPoint's 2025 survey found 82% of organizations already used AI agents, but only 44% had policies to secure them.
Do organizations have security controls for AI agents?: CyberArk's 2025 survey found 68% of organizations lack identity security controls for AI. SailPoint's 2025 survey found 80% of companies say their AI agents have taken unintended actions, and 23% reported agents being tricked into revealing access credentials.
How many secrets were leaked on GitHub in 2025?: GitGuardian detected 28.65 million new hardcoded secrets in public GitHub commits in 2025, a 34% increase over 2024. Leaked AI service secrets reached 1,275,105, up 81%, and more than 64% of secrets confirmed valid in 2022 were still valid in January 2026.
Are service accounts and machine identities treated as privileged?: Mostly not. CyberArk's 2025 survey found 88% of organizations still define a privileged user as human-only, even though 42% of machine identities have access to sensitive data. Palo Alto Networks found only 39% of privileged access is managed through just-in-time or zero standing privileges.