Did you ever notice that right around the time you finally learned how to create and remember a strong password, the people who insisted we needed them quietly stopped caring?
For twenty years, “identity security” centered around you. Your login. The password you reused. The phishing email you clicked at 4:55 on a Friday. Every product, every awareness poster, every mandatory training video assumed the weakest account in the building belonged to a person.
Then came AI, and somebody did the math on the machines. Overnight AI agents sucked up all the IAM air in the room and the industry couldn’t stop fawning over non-human identities.
Next week a few thousand identity professionals fly into Mandalay Bay for Identiverse, one of the industry’s biggest annual identity security gatherings. Judging by the agenda they will spend a remarkable amount of it exploring non-human identities (NHI) and AI agents. SailPoint sent a speaker to Identiverse whose title is “Sr. Director, Global Agentic AI” — a job that didn’t exist two years ago. A few weeks prior, in Berlin at the Europe Identity and Cloud Conference, NHI were no longer a specialized track as they were the prior year. It featured 30 related NHI titled sessions.
The password’s funeral moved from the keynote stage to a breakout room.
And, of course, the focus on NHIs is warranted.
Vendors and consultancies estimate that the non-human accounts on a typical network, such as service accounts, API keys, OAuth grants, cloud roles, bots, and the new swarm of AI agents, outnumber the human by multiple factors. KPMG puts the imbalance at 82 non-human identities for every human in its 2026user, a ratio that captures why the market suddenly sounds less like identity management and more like pest control.
At EIC, speakers put the ratio closer to 25-to-1 or 50-to-1. KPMG says 82-to-1. A useful rule: when the people selling the cure cannot agree within a factor of three on the size of the disease, that is not just a measurement problem. It is a market being born.
The Robot Uprising we love to hate
Follow the money and the pivot looks less like a discovery than a gold rush. Non-human identity has become one of the most fundable phrases in cybersecurity since “zero trust”.
Oasis Security, barely two years out of stealth, raised $120 million in early 2026 to govern machine and AI-agent access, bringing its total funding to $195 million. CrowdStrike agreed to buy SGNL in a deal Reuters valued at $740 million. MarketsandMarkets puts the non-human identity access-management market at $9.45 billion in 2024 and projects it will reach $18.71 billion by 2030.
That is venture-speak for: there is a lot of money in the hole.
Meanwhile, your reused password feel like a rounding error in your own network.
Developers like agents because they never click a bad link. Nobody has to send them a “reset your password” reminder. Meanwhile Amazon, Cloudflare, and Meta are shedding human employees by the thousands and replacing them with agentic AI efficiencies.
Verizon’s 2026 Data Breach Investigations Report found that stolen credentials, the perennial number-one way attackers got in the door, fell to 13% of initial-access cases, down from 22% the year before. For the first time, plain unpatched vulnerabilities (31%) beat the stolen password outright. The human login, the thing two decades of products were built to defend, is fading as the front door.
Human-in-the-loop logic
But here is where we get it wrong.
The credential didn’t get safer. The front door moved.
Credentials did not stop mattering. They just stopped looking like passwords. Across full breach chains, credential abuse still shows up in roughly 39% of breaches. The difference is that the credential may now belong to a chatbot, a SaaS connector, a build process or an API integration nobody has looked at since the employee who created it left the company.
Last August, attackers tracked as UNC6395 didn’t use a traditional phish. They stole OAuth tokens — the standing credentials a sales chatbot named Drift used to talk to Salesforce — and over roughly ten days quietly exported data from more than 700 organizations.
The victim list read like a security-conference speaker lineup: Cloudflare, Zscaler, Palo Alto Networks, Proofpoint, Tanium. Companies that sell identity protection for a living got robbed through the identity of a robot. The virtual bouncer guarding the front door didn’t fall for anything. The NHI had a valid token, broad permissions, and nobody watching it. The attackers then combed the records for more keys to do it again somewhere else.
When comparing non-human identity to human identity it isn’t a Venn diagram with a sliver of overlap. The problem and solution is the entire circle.
When an AI agent acts, it inherits the access of whoever built it — including, as Saviynt’s own report points out, privileges that “often exceed those of their human creators.”
The agent only has power because a human handed it over. When its token gets stolen, it’s your authority being spent and your data walking out the door — the machine is just the getaway car.
The breach data is real, the sprawl is real, and somebody has to babysit ten billion API keys. But notice who’s left holding the short end. Every one of those NHI accounts links to a database, a cloud console, a file full of customer records.
When the Drift token was stolen, Salesloft revoked it, the vendors rotated their secrets, and the machines got clean credentials. The people in those records got nothing to rotate. You can re-key a service account in an afternoon. You can’t re-issue a human being. The machine recovers; you just get added to a list.
That is the missing human-in-the-loop story. The identity industry can rotate the machine’s credential, revoke the OAuth grant, reissue the API key and declare the integration clean. But the customer records, support tickets, emails, phone numbers, secrets and business context taken along the way become permanent raw material for the next scam, the next phish and the next breach.
Non-human identity is not replacing human identity. It is multiplying it, abstracting it and hiding it behind service accounts, OAuth grants, API keys and agents that move faster than people ever could. Every machine credential still begins with a human decision: a developer shipping a workflow, a vendor asking for access, a sales team connecting a chatbot to Salesforce, a security team approving an exception because the business needed it yesterday.
The robots are not rising up on their own. We are deputizing them.
So yes, govern the bots. Inventory the service accounts. Kill standing privilege. Rotate the tokens. Make every agent prove what it is, what it is allowed to do and who is accountable when it does it.
But do not mistake that for moving beyond human identity. The lesson of the NHI boom is not that people stopped mattering. It is that people now matter through a thousand proxies they can barely see.
The password may no longer be the main character. But the human is still the blast radius.
