Palo Alto Networks' 2026 Identity Security Landscape, a survey of more than 2,900 leaders, finds that machine identities, including AI agents, now outnumber human identities 109 to 1. The same study found 96% of respondents say human identities hold access far beyond what their roles need.1
Source: Palo Alto Networks, 2026 Identity Security Landscape
The curve is about to steepen. Gartner expects that by 2028 an average global Fortune 500 enterprise will have more than 150,000 AI agents in use, up from fewer than 15 in 2025.2 Microsoft reports that 88% of enterprises are already experimenting with agents.3
The takeaway
Every one of those identities needs an owner, a purpose, a credential lifecycle and a least-privilege policy. Governance that covers only the people in HR systems is covering less than 1% of the population.
Related insights
Agentic AI needs an identity strategy before it needs a model strategy
AI agents act on behalf of people and systems. Who they are, what they may touch and how they are audited are identity questions first.
Friction, fraud and the customer at the login screen
Every extra step at sign-in costs conversions. Every missing step invites fraud. The data on where to draw the line.
Twenty-nine minutes: how fast attackers move once they are in
Breakout time keeps shrinking. Identity telemetry is the fastest signal defenders have.