In May 2026, Palo Alto Networks published the 2026 Identity Security Landscape, built on responses from 2,930 security leaders worldwide. The number that opens the report is uncomfortable: organizations manage an average of 109 machine identities for every human identity. Not 109 extra employees — 109 accounts, keys and credentials that belong to no one in particular and that most companies cannot even list.
The same report shows where this is heading. The companies surveyed expect AI agents to grow 85% over the next twelve months, with machine identities rising 77% against 56% for human ones. The gap between "who the company hired" and "what has access to company systems" is going to widen, not close.
One more finding from the same study explains why that matters: 96% of respondents say human identities already operate with access far beyond what their roles require. If a person's badge already opens too many doors, the agent working on their behalf inherits exactly that excess.
The practical reading is short. The AI conversation moved on from "which tool do we buy" to "who exactly is asking, and what is that identity entitled to see". Identity is the perimeter now.
The badge nobody issued
Every company has a process for people: someone is hired, gets a login, joins the right groups, and on the day they leave, HR tells IT and access is revoked. Familiar and auditable.
Now look at what happens when AI arrives. Someone creates an account in an AI tool "just to test it". Connects it to the ticketing system with a key generated in a hurry. Sets up an agent that runs on its own every morning at seven. None of that went through the company directory — none of those identities has an onboarding, a group, an accountable manager or an end date.
OWASP, the same organization behind the most widely used list of web application security risks, published the OWASP Non-Human Identities Top 10 in 2025. Its ranking is worth reading, because it does not start with sophisticated attacks:
- Risk #1 — improper offboarding: the non-human identity stays active long after it stopped being needed.
- Risk #5 — overprivileged identities: permissions left wide open under delivery pressure, carried into production, widening the blast radius when something is compromised.
- Risk #7 — long-lived secrets: keys and credentials that expire far too late, or never.
In boardroom terms: the number one risk of enterprise AI today is not the AI saying something wrong. It is the AI still answering — and still reaching into systems — after the person, project or contract ended.
Access is still the door
Verizon's 2026 Data Breach Investigations Report, published in May 2026, recorded a shift: 31% of breaches now begin with the exploitation of software vulnerabilities, now first among initial access vectors. Credential abuse as the point of entry fell to 13%, according to SecurityWeek's analysis.
It is tempting to read that as "credentials stopped being a problem". That is not what the data says. Attackers changed how they get in; once inside, they still need an identity with enough permission to reach what matters. That is where the two numbers meet: if 96% of organizations admit to more access than they need, any entry becomes broad access. The vulnerability opens the door; the excessive permission hands over the house.
Gartner placed this among the leading cybersecurity trends for 2026. In Top Cybersecurity Trends for 2026, released in February, "identity and access management adapts to AI agents" is one of the six trends of the year, with emphasis on identity registration and governance, credential automation, and policy-driven authorization for actors that are not people.
A personal AI account is an identity the company never issued
One detail in that same Gartner material tends to change the tone of the meeting. In a survey run between May and November 2025, more than 57% of employees say they use personal generative AI accounts for work, and 33% admit entering sensitive information into unapproved tools.
A personal AI account is, technically, an identity — it just isn't a company identity. It is not in the directory, has no role, appears in no audit, is not revoked when the person leaves, and it takes with it the history of everything ever pasted into it. When a company asks "where is the AI risk", the answer is rarely the model. It is the account.
Written policy does not fix this. What fixes it is approved AI being more convenient than the personal alternative — and entering through the same badge as everything else.
What has to be in place
None of this is solved at the AI model — it is solved in the identity layer. Five concrete requirements.
Corporate identity, not a second database. The company already has a source of truth about who is who, and creating a second one makes no sense. The AI environment has to federate with the existing directory — on-premises Active Directory or LDAP, not only cloud providers — and must not allow a federated user to be edited from inside. The operational consequence is the one that matters: disabled in the directory, AI access follows the company's rule.
Role-based access, function by function. When an integration exposes fifty functions and the support team needs two, the right move is to grant exactly those two. The market default is all-or-nothing — and "all" is OWASP risk #5 going into production.
Credentials with a name attached. One shared login registered by IT and used by everyone erases authorship. Each person storing their own credential encrypted keeps the action attributable: it does not become "the system did it".
Approval proportional to risk. Sensitive operations stop and ask a person for explicit confirmation, inside the flow itself. Unchecked autonomy is what stalls AI projects at the executive level; a configurable brake is what unblocks them.
A trail you can actually query. A record organized by area — connectors, approvals, documents, permissions — so an investigation is not a dig through a generic log. That is the difference between "we believe nobody accessed it" and "we know who accessed it, when, and under whose authorization".
That is how Skyller was designed: federation with the company directory, permission resolved by role before the action, and a trail separated by area.
The agent has no badge of its own. It uses the badge of whoever asked.
This is what separates a governed environment from a loose agent. An agent should not be given administrator access to get the job done: it operates within the permissions of the identity that triggered it. If that person cannot see the legal folder, neither can the agent they are using — and there is no side path, because permission is resolved before the action, not after.
The same holds for what the team builds. Agents, spaces and flows can be reused by other areas, but their reach is defined by people, groups, roles and permissions. A procurement agent published to that team is company capability; it does not become a back door into finance.
The generic personal AI account offers none of this: it does not know who the person is inside the company, does not know the groups, does not expire on the day they leave, and returns a trail to no one.
Six questions to take to your AI vendor
They separate vendors who treated identity as a foundation from those who treated it as a checkbox on a compliance form.
- Does the platform connect to our on-premises directory, or only to cloud identity providers? Plenty of mid-sized companies run a local Active Directory and do not license cloud identity.
- When we disable someone in the directory, how long until they lose AI access — and how do we prove it?
- Does the agent inherit the permissions of whoever triggered it, or does it run on a service credential with broad access? Ask to see it, not to hear about it.
- Can I grant only part of an integration's functions to a specific group, or is it all or nothing?
- Which actions stop and require human approval, and who defines that list? If the answer is "the AI always asks for confirmation", there is no list.
- What record is kept when an agent reads a document or performs an action — and who can consult it without filing a ticket?
