How Many Non-Human Identities Per Human? The 2026 Data

Ask "how many non-human identities exist per human employee in 2026" and you will get different, well-sourced answers — 82:1 and 144:1 among them. That spread is not a case of one source being wrong — each figure comes from a different method and a different population, and understanding the difference matters more than picking a single number to repeat. This post lays out what each figure actually measures, where it comes from, and why averaging them into one headline number would misrepresent both.

Why the numbers disagree — on purpose

Non-human identity (NHI) counts — service accounts, API keys, OAuth tokens, workload identities, and now AI agent identities — are notoriously hard to measure consistently, because different studies scope the denominator and the environment differently. A ratio estimated by survey respondents across many kinds of organization will differ structurally from a ratio counted over the identities a security vendor observes in its own customers' environments. Neither number is more "correct" than the other; they are answers to different questions. For background on what counts as a non-human identity in the first place, see machine identity vs workload identity vs agent identity.

The two headline figures

Read individually, each is a defensible data point. CyberArk's 82:1 comes from what security decision makers report across a broad set of organizations, and it is the figure KPMG's Cybersecurity considerations 2026 cites when it says non-human identities now outnumber human users. Entro Labs' 144:1 is a count over the identities Entro sees in its own customers' environments — organizations already investing in NHI security — so it describes a narrower population, and a different ratio there is expected, not contradictory. CyberArk's original press release now redirects to its acquirer, Palo Alto Networks, so the link above is the archived copy.

What NOT to do with these numbers

Do not average 82 and 144 into a single "the ratio is roughly 110:1" figure. That number would not describe any real population — it would be a mathematical artifact of combining incompatible denominators, and it would strip out the one piece of information that makes the data useful: who was counted, and how. If you need a single number for a specific conversation, cite the one whose scope matches your audience — a broad cross-industry argument fits CyberArk's survey figure; an argument about organizations that already inventory their machine identities with a dedicated tool fits Entro's count — and say explicitly which population it describes rather than presenting it as a universal constant.

A growth figure from the same data

The same Entro Labs report counts non-human identities up 44% year over year from 2024 to 2025, and the ratio itself up 56% — so in that population, identities are growing faster than the people they serve, the dynamic that pushes a ratio upward over time regardless of which population you measure.

Why AI agents specifically are accelerating the ratio

Service accounts, API keys, and workload identities have been growing faster than human headcount for years, largely driven by cloud infrastructure and microservices. AI agents add a new, faster-growing category on top of that existing trend: unlike a service account provisioned once per deployed service, an organization adopting agentic AI can spin up new agent identities per workflow, per task type, or even per session, depending on architecture.

This is the structural reason the ratio keeps climbing rather than stabilizing: every category of non-human identity that existed before agentic AI (service accounts, API keys, workload identities) continues to grow with infrastructure, and agent identities are now compounding on top of that base rather than replacing it. The lifecycle challenge this creates — provisioning, rotating, and decommissioning identities at a pace that outstrips what manual processes can track — is covered in non-human identity credential lifecycle management.

What's actually behind the count

"Non-human identity" is a category, not a single kind of credential, and the composition matters as much as the total. A typical enterprise's non-human identity population is a mix of legacy service accounts, API keys issued to integrations, workload identities tied to specific deployed services, and now AI agent identities layered on top. Each of those categories has a different typical lifespan, a different owner (or lack of one), and a different rotation discipline, which is part of why aggregate ratios vary so much between organizations — a company with a large legacy service-account estate and a company that is agent-native from day one will land at very different ratios even at similar headcount. Distinguishing between these categories, rather than treating "non-human identity" as one undifferentiated bucket, is covered in machine identity vs workload identity vs agent identity.

Provisioning and deprovisioning at the pace the numbers imply

An 82:1 ratio is manageable if every one of those identities is provisioned deliberately, owned by someone, and deprovisioned promptly when it's no longer needed. It becomes a liability specifically when the provisioning pace outstrips the deprovisioning discipline — new agent identities get created faster than old ones get retired, and the population grows monotonically rather than turning over. Two operational disciplines determine which outcome an organization gets: automated, timely offboarding when an agent or integration is retired, covered in secure agent offboarding and deprovisioning, and regular credential rotation so that even long-lived identities don't accumulate indefinite standing access, covered in key rotation for agent credentials. Neither discipline is exotic, but both require automation at a scale manual, ticket-driven identity management was never built to sustain — which is precisely why the 44% year-over-year growth figure cited above is the number worth worrying about more than any single ratio: growth rate, not a snapshot ratio, is what determines whether your identity governance keeps pace or falls further behind every quarter.

What the ratio means operationally, regardless of which figure you cite

Whichever specific ratio applies to your environment, the operational implications converge on the same set of questions: can you enumerate every non-human identity currently active, do you know which system or agent each one belongs to, can you rotate or revoke credentials at the pace new identities are created, and do you have an owner assigned to each one rather than orphaned credentials nobody is accountable for. These questions matter more than the precise ratio, because an organization that cannot answer them is exposed regardless of whether its actual ratio is 82:1 or 144:1. Building an accurate, current inventory is the prerequisite step — see building an AI agent inventory — and zero-trust principles applied specifically to agent identities are covered in zero trust for AI agents and in the broader identity and access for AI guide.

Common questions

What is the correct ratio of non-human identities to humans in 2026? There isn't a single correct figure. CyberArk's 2025 Identity Security Landscape survey reports 82:1, the figure KPMG's Cybersecurity considerations 2026 cites, and Entro Labs' H1 2025 report counts 144:1 across its customers' environments. Each measures a different population; cite the one whose scope matches the environment you're describing.

Why do these sources disagree so much? They aren't measuring the same thing. One is a survey of security decision makers at organizations of 500 or more employees; the other is a count over the identities one vendor observes in its customers' environments. The spread reflects differences in method and population, not measurement error.

Should I average these figures to get a single number? No. Averaging 82:1 and 144:1 produces a number that describes no actual population and discards the information that makes the data useful — which population each figure describes.

Are AI agents the main driver of non-human identity growth? They are an accelerating factor on top of an existing trend. Service accounts, API keys, and workload identities have grown with cloud infrastructure for years; AI agents add a new category that can be provisioned per workflow or per task.

What should a security team do with these numbers rather than just cite them? Use them to justify investment in identity enumeration, ownership assignment, and automated lifecycle management rather than as a talking point on their own. The operational risk is the same regardless of which specific ratio applies to your organization: unowned, unrotated, unrevoked non-human credentials growing faster than your team's manual capacity to track them.