82 machine identities for every human: the real perimeter of agentic AI is no longer people

By areacucuta.com (based on a KPMG report) · October 29, 2026.

Non-human identities outnumber human users in organizations by a ratio of 82 to 1, according to the report "Acceso invisible, riesgos visibles" (Invisible access, visible risks) by consulting firm KPMG. Non-human identities (NHIs) are service accounts, API keys, tokens and machine credentials: anything that lets software access data or perform actions without a person doing it manually.

KPMG warns of three typical governance failures: credentials with excessive permissions, "orphaned" identities (active, but with no defined owner) and agents with access to sensitive databases that goes beyond their function. This figure comes from a consulting firm that also sells governance services, and the cited material does not detail the methodology, so it is best taken as an order of magnitude rather than an exact measurement.

Its recipe has three steps. First, a continuous inventory of all non-human identities, with an assigned owner, credential status and traceability. Second, prioritize by risk and apply least privilege, meaning each agent or account accesses only the data and actions its task requires. Third, manage the full lifecycle: revoke unused access, rotate credentials and monitor anomalies in real time.

Alaín Almeida, IT Advisory partner at KPMG Colombia, sums up the problem this way: the risk appears when the speed of adoption outpaces the ability to govern access. KPMG adds that agents should not be managed as an isolated technology project, but as a joint decision across cybersecurity, compliance, risk and business from the design stage.

Our take: the figure is not surprising, but it changes the framing. For decades, corporate security revolved around verifying people; with agents, the perimeter shifts to machines, and a compromised or simply misconfigured agent acts at machine speed, so its errors can multiply far faster than those of an employee with too many permissions.

In general, this fits a pattern we are already seeing in the industry: the bottleneck for agentic AI in the enterprise is not model capability, but control, permissions and context. Many organizations are testing agents, but few manage to scale them, and identity governance is one of the most prosaic and most real reasons why.

Winners and losers: the winners are teams that treat each agent as a "digital employee" with a profile, a manager and minimal permissions, along with identity management vendors. The losers are those who scale agents on top of a chaos of legacy keys. In the short term, this means an uncomfortable transition, with avoidable incidents and unglamorous inventory work. It is also a job opportunity: demand is growing for identity, risk and compliance profiles.

In the long term, the underlying thesis holds. Agents that operate securely and traceably are the foundation for automating the routine part of work and freeing people to focus on what they are passionate about. But that abundance will only arrive if trust is built before scale. Security by design does not slow innovation; it is what makes it sustainable.