What happens when the machines that act on our behalf begin to outnumber the people they represent? That is the dilemma raised by a new finding from the SANS Institute: AI agents are behind a 76% surge in non-human identities (NHIs), and governance gaps are emerging in response.
What the SANS Institute found
The SANS Institute reports a 76% increase in non-human identities, attributing that surge to AI agents. The organization frames the trend together with a concern about governance gaps that accompany the rapid growth of these machine-driven identities.
Why this matters now
A sudden, large increase in NHIs driven by AI agents touches on multiple operational and policy domains. Identity systems, access controls, audit trails and accountability mechanisms were designed with human actors in mind; a three-quarters rise in machine identities calls into question how those systems will function when so many identities are not human.
Implications and perspectives to consider
- Operational risk: A 76% increase in NHIs implies more credentials, sessions and automated actions that must be tracked and validated. Systems that assume a human presence may face gaps in detection and response.
- Governance and oversight: The SANS Institute highlights "governance gaps" alongside the surge. Those gaps suggest a mismatch between existing rules, roles and verification processes and the realities introduced by AI agents.
- User experience and trust: End users and administrators must navigate environments where distinguishing human from non-human identities becomes more difficult, affecting expectations about consent, responsibility and control.
- Adversarial considerations: The proliferation of NHIs can be exploited by bad actors who leverage AI-driven identities to amplify malicious activity or evade rules, elevating the importance of controls that can address non-human agents.
What to watch next
The SANS Institute's finding — that AI agents are responsible for a 76% rise in NHIs and that governance gaps are emerging — presents a clear question for organizations and policymakers: how to adapt identity, access and oversight frameworks to a world where many actors are autonomous software agents. The magnitude of the increase underscores that incremental adjustments may be insufficient; structural responses will likely be required.
How quickly institutions move to close those governance gaps may determine whether this surge becomes a manageable evolution in automation or a source of systemic fragility.
https://www.infosecurity-magazine.com/news/governance-gaps-agents-76-increase/
