Agentic AI is the first computing paradigm in decades where the "user" is often not a person at all. A marketing chatbot, an invoice-processing agent, a code-review LLM — every autonomous workflow runs under some form of non-human identity (NHI): an API key, a service account, an OAuth token, a workload identity. In production, these credentials are the new perimeter. The problem is that almost nobody designed that perimeter on purpose.
At ai-jarvis.eu we run the smaller version of this ourselves: transcription jobs, article-drafting pipelines and TTS generation, each under a dedicated service account. None of those identities has ever "logged in" the way a human does — and every audit of our own keys turns up stale credentials nobody remembers creating. If that's true for a small EU publication, the exposure at enterprise scale is a different universe entirely.
Why agentic AI broke identity and access management
Mainstream IAM was designed for predictable human behaviour: a person joins, gets a role, changes teams, loses access on their last day. Agents don't follow that lifecycle. An agent can acquire permissions dynamically, spawn sub-agents, call tools through the Model Context Protocol (MCP) and act at a speed no quarterly access review can match.
This is why the webinar conversation has shifted from static role-based access to Continuous Adaptive Trust and Just-In-Time (JIT) ephemeral credentialing: an agent gets exactly the token it needs for exactly one task, for exactly as long as that task runs. Intent-aware access management — deciding what an agent may do based on what it is trying to accomplish — sounds like marketing until you watch a compromised token move laterally through a cloud tenant. Then it sounds like engineering.
The numbers behind the identity gap
The security community has been collecting hard data on this for about a year, and the picture is consistently bad:
- 45:1 — average ratio of non-human to human identities in enterprises, rising to between 80:1 and 144:1 in cloud-native environments.
- 92% of security leaders report that legacy IAM tools cannot manage AI agent identities, and 78% of organisations have no policy for creating or revoking agent credentials.
- 1.27 million AI-related credential leaks were recorded in a single year — up 81%.
- 40% of live MCP servers tested in recent research operated with zero authentication.
- Gartner projects 33% of enterprise software applications will incorporate agentic AI by 2028, up from under 1% in 2024.
Read those first two lines again: 45 machine identities per human, and almost nobody has a policy for creating or deleting them. That is not an access-control problem anymore. That is an identity sprawl problem with the same shape as the forgotten-admin-account crises of the 2010s — only moving at agent speed.
The market just noticed: €290 million and counting
The vendors are already capitalising on the gap. In May 2026, the Cloud Security Alliance published The Non-Human Identity Governance Vacuum, formalising research on the unmanaged attack surface created by AI agent identities. The M&A and funding wave followed quickly: Quest Software acquired Anetac in June, and Obsidian Security raised $85M in a Series D in August, reportedly pushing its valuation toward $1.1 billion. Across the sector, over $340 million (roughly €290 million) has flowed into NHI security platforms in the past twelve months.
Two things are driving this. First, the credential leak numbers: an 81% year-on-year surge makes for a compelling board slide. Second, live exploits of unauthenticated MCP servers and autonomous AI-to-AI access chains moved the threat from theoretical to demonstrable. When NIST published operational guidance on agent identity authorisation in August 2026, the topic officially left the "emerging buzzword" category.
Europe: the legal baseline just changed
For EU-based companies, this is not only a technical story. The AI Act moved from paper to enforcement on 2 August 2026, when the European Commission's AI Office gained full authority to evaluate GPAI models, demand technical documentation and impose fines. The voluntary era is over: supervision is now active.
Article 50 transparency rules also took effect this month. EU users must be informed when they interact with a chatbot, and AI-generated text and deepfakes require watermarking and machine-readable tagging. Meanwhile, the EU's Digital Omnibus on AI package formally deferred high-risk system compliance to 2 December 2027, because the CEN-CENELEC technical standards are not ready.
What does this mean in practice? If your agent talks to EU customers, it must identify itself as AI. If it produces text or media, the output must be tagged. And if it touches personal data — which almost every enterprise agent does — GDPR data residency applies to the logs recording what the agent's identity did. The AI Office now has the legal teeth to ask for technical documentation of an agent's behaviour; your identity logs are likely part of that answer.
What to do now: a short checklist
The webinar is a useful starting point, but the homework is concrete. Based on what our production pipelines and the current threat data show, I would prioritise:
- Inventory every non-human identity — API keys, service accounts, OAuth tokens, workload identities. You cannot govern what you have not counted.
- Classify by blast radius and move the most privileged identities to just-in-time credentials. An agent that can read a database should not hold a key that can drop it.
- Lock down MCP and agent-to-agent traffic — authenticate every server, and treat agent-to-agent calls as north-south traffic, not internal noise.
- Map your AI Act timeline — Article 50 transparency applies now; high-risk conformity assessments apply from December 2027. Document as you build, not before the audit.
- Treat agent logs as GDPR records — what an agent's identity did, to whose data, and in which data residency.
This is not a "set and forget" fix. It is a new operational category, and Europe is further along in regulating it than most security teams are in engineering it. The good news: the AI Act timeline we track in our magazine gives you a predictable schedule — even if the agents themselves refuse to stick to it.
Where should a company start with non-human identity security?
With an inventory. Count every API key, service account, OAuth token and workload identity, then classify them by the data they can reach. Most organisations discover a long tail of forgotten production keys on day one — that list becomes the roadmap for moving the most privileged identities to just-in-time credentials.
Are open-source tools enough to secure agent identities?
OIDC, SPIFFE/SPIRE and OAuth handle static workload identity reasonably well, and every serious commercial product builds on them. What is still immature is the runtime layer: intent-aware authorisation and continuous adaptive trust for agents that spawn sub-agents. That is where the new NHI platforms earn their valuation.
Does the AI Act treat an autonomous payment agent as high-risk?
If the agent makes decisions about creditworthiness or payment transactions, it falls under Annex III high-risk use cases in principle. The Digital Omnibus deferred full conformity assessment for these systems to 2 December 2027 due to missing CEN-CENELEC standards — but Article 50 transparency obligations and AI Office supervision of the underlying models already apply.
