Machine identities outnumber staff by an order of magnitude, and most are unowned.

Security teams have spent a decade building excellent tooling for human identity: single sign-on, multi-factor authentication, joiner and leaver processes. The population those tools govern is now a minority of the identities on the network.

Service accounts, API keys, CI tokens, integration credentials and, increasingly, autonomous agents all authenticate. Most were created during a project, under time pressure, by someone who has since changed role.

The ownership gap

The specific failure is not that these credentials exist. It is that they have no owner record, so no process ever retires them. A joiner and leaver process that does not touch machine identity leaves the estate growing monotonically.

Agents made it sharper

An autonomous agent needs broad permissions to be useful and operates without a human present. That combination is exactly what the classical least privilege model was designed to prevent, and most deployments have solved it by granting the broad permissions and hoping.

What a workable programme looks like

An inventory with a named human owner for every non-human identity. Expiry by default, with renewal requiring the owner to act. Scoped credentials per task rather than per system. And logging that makes an agent's actions attributable after the fact.

None of this is novel. It is the human identity playbook applied to a population that grew while nobody was counting.