Non-Human identities already outnumber humans 45 to 1. Here’s how Simeio and IBM recommend closing the gap.
“Exploding all over the place.”
That’s how Bob Kalka, IBM’s Global Security Lead, describes the growth of non-human identities: machine accounts, service accounts, APIs, secrets, and now AI agents. They already outnumber human identities by roughly 45 to 1, and each one is a potential entry point. Identity management was built for humans, and the other 45 are opening a gap most organizations haven’t accounted for. Considering 80% of cyberattacks were already focused on identity before agentic AI entered the picture, you can see where things are headed.
This growing process gap was the subject of a recent webinar co-hosted by Simeio and IBM, “Closing the Identity Gap.” Kalka and Chris Fields, SVP at Simeio, walked through why human and non-human identity split into two disconnected disciplines, why agentic AI is forcing the issue for many organizations, and what it takes to bring them back together under one roof. What follows is a recap of the highlights. The deeper walkthrough, including how IBM Verify and HashiCorp Vault fit together, is in the webinar recording.
The gap is between two teams that were never asked to work together
Human identities have historically sat with the CISO and IT teams. Non-human identities, service accounts, APIs, and now AI agents generally sit with dev teams. Kalka has spent three decades calling on clients and sees the same pattern almost everywhere he goes. He frames it as a physics problem: “multiple tools, oftentimes with disconnected teams,” with separate owners on each side and a monthly meeting where both agree to work together more, then don’t.
Kalka calls the human side of this breakdown the “original sin” of human identity management. That is, disconnected teams and tools often piled on top of a homegrown management system from the late 90’s nobody fully understands anymore since the person who wrote it left years ago. The non-human original sin is just as basic. Developers hard-code secrets directly into application code. Reverse engineer the code and the secret is exposed.
This split in accountability has real consequences. A customer can run a mature IAM program for its workforce while its own dev teams operate a dozen copies of HashiCorp Vault Community Edition with no shared governance between them, a real-world pattern Kalka says he and his team see all the time. Fixing identity for one human while ignoring the other 45 identities only moves the gap into a blind spot nobody’s watching.
Agentic AI turns one governance gap into four
Agentic AI takes one governance gap and multiplies it into four distinct ones. Human IAM assumes something relatively stable: a user gets access, keeps it for a while, then eventually loses it. Agentic AI doesn’t behave this way. Agents are spun up, spawn more agents, then reach into sensitive databases, often without a unique identity attached to any of these actions.
Kalka named the four specific blind spots this leads to:
Accountability: Since there’s nothing forcing every agent to carry a unique identifier, nobody can trace what an individual agent actually did.
Delegation and impersonation: Agents often inherit the identity of the human who triggered them instead of getting their own credential, so the action is logged as human when it wasn’t.
Overprivilege: Agents pick up rights on the way in and nobody strips them on the way back out.
The “last mile” problem: This is what Kalka calls it when nothing checks whether an agent’s access is still valid the moment it touches sensitive data, even if the policy governing that access changed since the process started.
Fields puts it plainly, non-human identity and agentic AI are now “top of mind for just about every corporation,” and the reason is simple: agentic AI is a form of non-human identity that is done wrong far more often than it’s done right.
How do you close the identity gap in practice?
Kalka’s framework for closing the identity gap runs through three steps: inspect, protect, govern. These are applied across a vendor-agnostic identity fabric that works with whatever IAM tools an organization already has in place.
Inspection means finding what’s currently invisible. That includes the hard-coded secrets buried deep in source code, shadow secrets managers dev teams stood up on their own, and shadow directories nobody in IT knows are still live. Fields, who leads Simeio’s global solutions and advisory team, described this as Identity Security Posture Management (ISPM), the layer that finally lets CISO, IT, and dev teams look at the same picture instead of three different ones.
Protection means moving off hard-coded and static secrets toward short-lived, dynamic secrets managed through an auditable engine like HashiCorp Vault, and applying privileged access management consistently rather than to a subset of accounts. Governance closes the loop: every agent gets registered, standing privileges get stripped, and access gets validated at the point of use. That includes the “last mile” Kalka flagged as the biggest blind spot.
Some incidents get through regardless of how disciplined the program is, which is where identity threat detection and response (ITDR) comes in. Kalka pointed to the 292-day average it takes organizations to identify and contain an identity-based breach. He went on to frame behavioral analytics, the same fraud-detection techniques banks have used for years, as the way to compress that timeline down to a matter of seconds by spotting when a login doesn’t match how that user or agent has behaved in the past.
Why does closing the identity gap take more than a platform?
Closing the identity gap takes more than a platform, however capable that platform is. Kalka pointed to IBM Verify’s own internal deployment as a proof point: 30.5 million identities under management, split between 500,000 internal users and 30 million external ones, with passwordless authentication rolled out widely enough that IBM’s CIO is moving to entirely eliminate passwords as an option.
Technology alone doesn’t close a gap that’s organizational as much as it is technical. Fields pointed to a decade-plus relationship between Simeio and IBM, dating back to Simeio’s Pathmaker Group heritage in 2003, paired with the operational discipline to run this across advisory, professional services, and 24/7 managed operations. He positioned Simeio as the largest independent identity provider globally, built to sit between CISO, IT, and dev teams and give all three a shared view.
Fields cited two numbers that frame the scale: roughly a billion AI-generated cloud applications projected to be online by 2028, and 90% of companies already reporting at least one container or service-related incident in the past year. Organizations that treat human and non-human identity as one governed system, instead of being managed by two disparate teams comparing notes once a month (or not), are the ones that can answer one fundamental question when an agent touches something it shouldn’t: who, or what, did this?
Watch the full webinar on demand
Not sure where your gaps are? See how your IAM program measures up
FAQs
What is a non-human identity (NHI)?
A non-human identity is any digital identity assigned to something other than a person. Service accounts, APIs, certificates, secrets, and AI agents all fall into this category. NHIs outnumber human identities by roughly 45 to 1 inside a typical enterprise, and they’re managed with far less consistency than human workforce accounts.
How many machine identities does a typical organization have?
Machine and other non-human identities outnumber human identities by roughly 45 to 1. Identity teams that focus only on workforce accounts are governing only a small fraction of their actual identity footprint.
Why does agentic AI increase identity security risk?
AI agents are spun up, spawn other agents, and access sensitive systems without a unique identity attached to these actions. This creates four gaps: no accountability for an agent’s actions, agents impersonating the human who triggered them, agents inheriting more access than they need, and no validity check at the point of use.
What is an identity fabric?
An identity fabric is a vendor-agnostic layer that connects an organization’s existing identity tools so both human and non-human identities can be inspected, protected, and governed as one system instead of managed in separate silos by separate teams.
How do you secure machine identities and secrets at scale?
Start by inspecting what already exists: hard-coded secrets in code and shadow secrets managers running without oversight. Move static, hard-coded secrets to a centralized, auditable engine with short-lived dynamic secrets, then govern every non-human identity the same way. Register agents, strip standing privileges, and validate access at the point of use.
Key Takeaways
- In an average enterprise, non-human identities outnumber human identities by roughly 45 to 1. Most governance programs were built for the smaller number.
- Agentic AI introduces four specific identity blind spots: broken accountability, delegation and impersonation, overprivilege, and unchecked “last mile” access.
- The root causes of the identity gap are basic and fixable: disconnected teams and tools on the human side, and hard-coded secrets on the non-human side.
- Closing the identity gap takes three coordinated steps: inspect, protect, govern, applied across a vendor-agnostic identity fabric.
- Behavioral detection can compress breach identification from an average of 292 days down to seconds when applied to identity activity.