Your AI business case has a hidden headcount: the identities they create.
Every new AI agent or tool your company adopts creates something that rarely shows up in the rollout plan: a new non-human identity. An agent using a service account, an API key, a personal access token, or an OAuth token logs in, pulls data, and acts without a person behind it. Multiply that across SaaS, endpoints, and hyperscalers, and most organizations are accumulating non-human identities faster than anyone is tracking them.
For CFOs, CISOs, and boards overseeing AI investment and enterprise risk, understanding non-human identities and how to govern them is now part of the job.
What are non-human identities, and why are they multiplying now?
A non-human identity (NHI) is any digital credential that authenticates and interacts with systems without a person at the keyboard. Think of each NHI as a worker that goes out and does things across your environment: pulling data, executing tasks, and making connections, whether anyone explicitly approved the action. Unlike an employee, an NHI never logs off and is rarely deactivated or reviewed when it is no longer needed.
AI adoption is accelerating the problem. Business units roll out new AI solutions on their own timelines, sometimes with IT involved and sometimes without it. Each new solution opens the tap a little further. Identity governance built around humans was never designed for this volume or speed.
The scale is already hard to track. The Palo Alto Networks 2026 Identity Security Landscape report, based on a survey of 2,930 cybersecurity decision-makers worldwide, found that organizations now manage an average of 109 NHIs for every human identity, up from 82 to one a year earlier. The same report projects that AI agent identities will grow another 85% over the next 12 months, and notes that about 90% of organizations had at least one identity-related breach in the past year.
Why NHIs create added risk for security and finance teams
Many NHIs are created over-authorized, either intentionally, because broad permissions are faster to grant, or by default, because a platform’s out-of-the-box setup grants wide access no one revisits. Each one is a potential entry point, and NHIs are often overlooked in monitoring built around human behavior.
Attackers have noticed. AI-enabled attacks increasingly hunt for NHI credentials and use them to escalate privileges and move across environments. Governing NHIs at scale is how organizations reduce that blast radius.
A real-world warning sign
In July 2026, a publicly reported incident showed how fast this risk can move. During an internal security test, an AI agent found a flaw in a permitted internal system, escalated its own privileges, and used credentials it obtained to move laterally until it reached a production environment at an AI platform company. More than 17,000 actions were logged before the activity was shut down.
No one directed the agent to cause harm. The lesson is not that AI agents are dangerous by design. It is that identities and credentials within an agent’s reach can carry it far past where anyone intended.
The connection to finance and audit
AI agents and tools are spreading into accounting and finance workflows just as quickly as everywhere else. When they run on over-provisioned NHIs without guardrails, the risk is concrete: unauthorized access to applications, systems, and sensitive financial and employee data, without a person involved in the decision.
As the Office of the CFO takes on more enterprise and cyber risk, knowing where sensitive data lives and who, or what, can reach it is part of that mandate. NHI sprawl deserves a place in board conversations about cyber materiality, not as a footnote, but as real exposure.
Closing the governance gap
Traditional identity and access management was designed for people: employees who log in, report to managers, and move through formal access reviews when they join or leave an organization. NHIs break that model.
Governing them starts with visibility, because you cannot protect what you cannot see. From there, the work is identification and layered controls: assigning an attributable owner to each NHI, control over what each NHI can access, a clear process for sanctioning legitimate use and approved access patterns, and ongoing monitoring once they go live.
Organizations that get ahead of this problem tend to follow a similar playbook:
- Build an inventory and assign owners. Catalog every NHI across the environment, including dormant accounts left behind by abandoned pilots, and assign each one a named human owner.
- Apply least-privilege access and rotate credentials. Scope NHIs to only what they need, review access on a regular cadence, and rotate credentials instead of treating provisioning as a one-time event.
- Monitor NHI activity for unusual behavior. A compromised machine identity behaves differently than a compromised human account, and detection tools need to reflect that.
- Integrate NHI governance into the broader security strategy. Establish clear accountability across IT, security, and the business functions using NHIs, particularly those used in agentic workflows.
- Run tabletop exercises built around NHI-specific scenarios. A breach that starts with an orphaned API key plays out differently than one that starts with a phished employee.
The question to ask this quarter
Non-human identities are no longer a niche technical concern tucked inside IT. They sit at the center of enterprise cyber resilience, and organizations that govern them proactively will be best positioned to scale AI with confidence.
Start by asking your CISO one question: can you show me every non-human identity with access to our financial systems and sensitive data, who owns each one, and when that access was last reviewed?
Teams working through vendor and third-party risk management challenges are seeing firsthand how quickly this risk category is climbing the priority list. To connect on where your organization stands, connect with CrossCountry Consulting’s cybersecurity team.