How Many Non-Human Identities Per Human? The 2026 Data

Ask "how many non-human identities exist per human employee in 2026" and you will get at least three different, well-sourced answers: 45:1, 80:1, and 144:1. That spread is not a case of one source being wrong — each figure measures a different population, and understanding the difference matters more than picking a single number to repeat. This post lays out what each figure actually measures, and why averaging them into one headline number would misrepresent all three.

Why the numbers disagree — on purpose

Non-human identity (NHI) counts — service accounts, API keys, OAuth tokens, workload identities, and now AI agent identities — are notoriously hard to measure consistently, because different studies scope the denominator and the environment differently. A ratio computed across an "average enterprise" surveyed broadly will differ structurally from a ratio computed specifically inside cloud-native infrastructure, which tends to provision non-human identities far more densely than a typical enterprise IT estate as a whole. Neither number is more "correct" than the other; they are answers to different questions. For background on what counts as a non-human identity in the first place, see machine identity vs workload identity vs agent identity.

The three headline figures

Read individually, each is a defensible data point. KPMG's 80:1 reflects a broad enterprise survey. Rubrik Zero Labs and One Identity's roughly 45:1 figure is described as an average across enterprises generally — a lower number consistent with including organizations with less cloud-native, less agent-heavy infrastructure in the average. The 144:1 figure is scoped specifically to cloud-native environments, where the practice of provisioning a distinct machine identity per service, container, and now per agent is most dense — so a higher ratio in that narrower population is expected, not contradictory.

What NOT to do with these numbers

Do not average 45, 80, and 144 into a single "the ratio is roughly 90:1" figure. That number would not describe any real population — it would be a mathematical artifact of combining incompatible denominators, and it would strip out the one piece of information that makes the data useful: that the ratio depends heavily on how cloud-native and how agent-heavy an environment already is. If you need a single number for a specific conversation, cite the one whose scope matches your audience — a broad enterprise argument should use KPMG's or Rubrik/One Identity's figures; a cloud infrastructure or platform engineering argument should use the cloud-native-specific figure — and say explicitly which population it describes rather than presenting it as a universal constant.

A data point that shows the scope effect directly

One figure illustrates the scope-dependence sharply on its own: a single Fortune 500 financial institution's internal audit reportedly found approximately 4.2 million non-human identities against roughly 50,000 human accounts — a ratio over 80:1 within that one organization, and a useful reminder that enterprise-wide averages can obscure just how extreme the ratio gets inside a single large, identity-dense organization. The same body of research also reports non-human identity populations growing roughly 44% year over year from 2024 to 2025 — a growth rate substantially faster than headcount growth at any of these organizations, which is the underlying dynamic driving every one of the ratios above upward over time regardless of which population you measure.

Why AI agents specifically are accelerating the ratio

Service accounts, API keys, and workload identities have been growing faster than human headcount for years, largely driven by cloud infrastructure and microservices. AI agents add a new, faster-growing category on top of that existing trend: unlike a service account provisioned once per deployed service, an organization adopting agentic AI can spin up new agent identities per workflow, per task type, or even per session, depending on architecture. IDC projects up to 1.3 billion AI agents in operation by 2028 — a figure that, if realized, would represent a scale of non-human identity growth that dwarfs every 2026 baseline ratio cited above, since none of those 2026 figures yet fully account for agent-driven identity sprawl at that projected scale.

This is the structural reason the ratio keeps climbing rather than stabilizing: every category of non-human identity that existed before agentic AI (service accounts, API keys, workload identities) continues to grow with infrastructure, and agent identities are now compounding on top of that base rather than replacing it. The lifecycle challenge this creates — provisioning, rotating, and decommissioning identities at a pace that outstrips what manual processes can track — is covered in non-human identity credential lifecycle management.

What's actually behind the count

"Non-human identity" is a category, not a single kind of credential, and the composition matters as much as the total. A typical enterprise's non-human identity population is a mix of legacy service accounts, API keys issued to integrations, workload identities tied to specific deployed services, and now AI agent identities layered on top. Each of those categories has a different typical lifespan, a different owner (or lack of one), and a different rotation discipline, which is part of why aggregate ratios vary so much between organizations — a company with a large legacy service-account estate and a company that is agent-native from day one will land at very different ratios even at similar headcount. Distinguishing between these categories, rather than treating "non-human identity" as one undifferentiated bucket, is covered in machine identity vs workload identity vs agent identity.

Provisioning and deprovisioning at the pace the numbers imply

A 45:1 or 80:1 ratio is manageable if every one of those identities is provisioned deliberately, owned by someone, and deprovisioned promptly when it's no longer needed. It becomes a liability specifically when the provisioning pace outstrips the deprovisioning discipline — new agent identities get created faster than old ones get retired, and the population grows monotonically rather than turning over. Two operational disciplines determine which outcome an organization gets: automated, timely offboarding when an agent or integration is retired, covered in secure agent offboarding and deprovisioning, and regular credential rotation so that even long-lived identities don't accumulate indefinite standing access, covered in key rotation for agent credentials. Neither discipline is exotic, but both require automation at a scale manual, ticket-driven identity management was never built to sustain — which is precisely why the 44% year-over-year growth figure cited above is the number worth worrying about more than any single ratio: growth rate, not a snapshot ratio, is what determines whether your identity governance keeps pace or falls further behind every quarter.

What the ratio means operationally, regardless of which figure you cite

Whichever specific ratio applies to your environment, the operational implications converge on the same set of questions: can you enumerate every non-human identity currently active, do you know which system or agent each one belongs to, can you rotate or revoke credentials at the pace new identities are created, and do you have an owner assigned to each one rather than orphaned credentials nobody is accountable for. These questions matter more than the precise ratio, because an organization that cannot answer them is exposed regardless of whether its actual ratio is 45:1 or 144:1. Building an accurate, current inventory is the prerequisite step — see building an AI agent inventory — and zero-trust principles applied specifically to agent identities are covered in zero trust for AI agents and in the broader identity and access for AI guide.

Common questions

What is the correct ratio of non-human identities to humans in 2026? There isn't a single correct figure — published 2026 research reports 45:1 (Rubrik Zero Labs/One Identity, average enterprise), 80:1 (KPMG, broad enterprise survey), and roughly 144:1 (cloud-native environments specifically). Each measures a different population; cite the one whose scope matches the environment you're describing.

Why do these sources disagree so much? They aren't measuring the same thing. Broad enterprise averages include organizations with less cloud-native infrastructure and pull the ratio down; cloud-native-specific measurements capture environments where machine identity provisioning is densest and the ratio is highest. The spread reflects scope differences, not measurement error.

Should I average these figures to get a single number? No. Averaging 45:1, 80:1, and 144:1 produces a number that describes no actual population and discards the information that makes the data useful — that the ratio depends on how cloud-native and agent-heavy an environment already is.

Are AI agents the main driver of non-human identity growth? They are an accelerating factor on top of an existing trend. Service accounts, API keys, and workload identities have grown with cloud infrastructure for years; AI agents add a new category that can be provisioned per workflow or per task, and IDC's projection of up to 1.3 billion AI agents by 2028 suggests this compounding effect is still early.

What should a security team do with these numbers rather than just cite them? Use them to justify investment in identity enumeration, ownership assignment, and automated lifecycle management rather than as a talking point on their own. The operational risk is the same regardless of which specific ratio applies to your organization: unowned, unrotated, unrevoked non-human credentials growing faster than your team's manual capacity to track them.