Securing AI Agents: Non-Human Identity 2026

The identity layer is where the agent era is won or lost. This is the practical field guide to non-human identity, the credentials your AI agents carry, and how to stop them becoming the fastest breach path in your company.

Machine identities already outnumber humans by more than 80 to 1, and the fastest-growing, least-governed slice of that population is the AI agent - CyberArk. Every agent you deploy is not just a piece of software. It is a new account that logs in, carries keys, calls tools, and acts on your systems at machine speed, often with more access than the person who launched it.

Here is the uncomfortable part: most of the security conversation about AI agents is aimed at the wrong layer. Teams obsess over the prompt, the model, the jailbreak. But a malicious prompt is only dangerous because the agent behind it is holding live credentials with standing access to real data. Take away the over-scoped, never-expiring token and the same prompt injection becomes a harmless string of text. The battle is not really about language. It is about who the agent is, what it is allowed to do, and for how long.

This guide breaks down what non-human identity actually means, why autonomous agents make it structurally harder, the 2025 and 2026 breaches that prove the point, the standards and patterns that contain the risk, and the platforms competing to secure it (from Microsoft and Okta to a wave of startups being acquired for hundreds of millions). It assumes no security background: every acronym is explained in plain terms before it is used. If you are building agents, our companion piece on prompt injection defense covers the input side of this problem, and this guide covers the authority side.

Contents

1. The identity explosion behind the agent boom
2. Why identity, not the prompt, is the real attack surface
3. The 2025-2026 breach ledger for non-human identity
4. The rulebooks: OWASP, CSA, NIST, and Gartner
5. The plumbing: standards and protocols for agent identity
6. The patterns that actually contain an agent
7. The 2026 platform landscape, scored
8. The secrets and entitlement layer underneath
9. The big-platform agent identity land grab
10. Build, buy, or delegate: choosing your identity model
11. The future: machines proxying humans and guardian agents
12. Conclusion: a decision framework

The 2026 agent identity scorecard

Any guide that ranks ten solutions owes you a single view. The table below scores the leading approaches to securing AI-agent non-human identity on five criteria that a real buyer weighs, from first principles: can it see and govern your agents and machine identities, can it grant access without standing credentials, does it speak the agent-native protocols, how broadly does it deploy, and how mature is the vendor. Each cell carries the score and the evidence behind it. The full profiles sit in section 7.

How to read this. Coverage and JIT/Secretless are weighted highest (25% each) because visibility and the elimination of standing credentials are the two structural moves that actually shrink an agent's blast radius. Agent Protocols (20%) captures native support for the Model Context Protocol and delegated-authorization flows that agents now depend on. Deploy & Reach and Maturity (15% each) reflect how easily the tool fits a real estate and whether the vendor will still exist next quarter. The scores are close at the top on purpose: the leaders converge because they implement the same primitives (covered in section 5). The right pick depends on where your agents already live, which is what section 10 helps you decide.

1. The identity explosion behind the agent boom

Start with the thing itself. A non-human identity (NHI), sometimes called a machine identity or workload identity, is any digital credential that a piece of software uses to prove who it is and to get permission to act. The Cloud Security Alliance defines it as "any digital credential used by a system, workload, application, or automated process to authenticate and authorize its actions" - Cloud Security Alliance. In practice that means API keys, access tokens, OAuth grants, service accounts, certificates, and personal access tokens. Every automated system in your company already runs on hundreds or thousands of these, quietly, without anyone logging in.

It helps to see the full inventory of what qualifies, because the breadth is the problem. A non-human identity is the API key a script uses to call a service, the OAuth token one app holds to act inside another, the service account a background job runs as, the certificate that proves a server's identity, and the personal access token a developer generates and forgets. Each is a credential that authenticates and authorizes with no human present. In heavily automated environments the counts turn almost absurd: Sysdig's 2025 usage data found machine identities outnumbering humans by roughly 40,000 to 1 at the cloud-infrastructure layer - Sysdig. Agents do not create this population from nothing. They inherit it, plug into it, and then multiply it.

The reason this suddenly matters is scale, and the numbers are genuinely startling. Different surveys land on different ratios, but they all point the same direction. CyberArk's 2025 research found machine identities outnumber human identities by more than 82 to 1 - CyberArk. Rubrik's Zero Labs put the enterprise ratio at 45 to 1 - Rubrik Zero Labs. In cloud-native environments the count climbs to 144 to 1 according to research relayed by the Cloud Security Alliance - CSA. The exact figure is methodology-dependent, so the honest framing is this: for every human in your directory, you are running tens to well over a hundred machine identities, and most of them are invisible.

Those ratios existed before generative AI. What agents change is the nature of the identity, not just the count. A traditional service account is a passive credential: it sits in a config file, it does one predictable job, and its blast radius is knowable the day you create it. An AI agent is different in kind. The Cloud Security Alliance describes agents as "autonomous actors that acquire permissions dynamically at runtime, spawn sub-agents, invoke external APIs, write and execute code, and chain together actions" - CSA. The consequence is the sentence every security leader should internalize: the blast radius of an AI agent's credential cannot be fully determined at the time the credential is issued. You are handing keys to something that decides what to do with them later, based on inputs you do not control.

The governance gap that follows is measurable, and it is wide. Only 15% of organizations feel confident they can prevent NHI-based attacks, 51% report no clear ownership of AI identities, and 16% do not track AI-related identity creation at all - CSA. Meanwhile agents are already in production: Okta's 2026 research found 92% of executives say autonomous agents are in widespread or moderate use, yet only 34% apply the same security controls to their agentic workforce as to their human one - Okta. Deployment has raced ahead of control. If you are only now standing up your first agents, our insider guide to building AI agents is the natural place to design identity in from the start, rather than bolting it on after an incident.

2. Why identity, not the prompt, is the real attack surface

Reason from first principles about what an attacker actually wants. The goal is never "make the model say a bad word." The goal is data, money, or persistence: exfiltrate a customer database, move funds, plant a backdoor. None of those are achievable through language alone. They are achievable only because the agent processing that language is standing on top of real authority: a token that can read the CRM, a service account that can touch production, an OAuth grant into email. The prompt is the trigger. The credential is the gun. Security programs that harden the trigger while ignoring the gun are optimizing the wrong variable.

This is why the security researcher Simon Willison's framing of the lethal trifecta is so clarifying. An agent becomes exploitable when it combines three things: access to private data, exposure to untrusted content, and the ability to communicate externally - Simon Willison. Notice that two of the three legs are pure identity questions. "Access to private data" is a permissions decision. "Communicate externally" is a network and scope decision. Remove or tightly constrain the agent's authority and the trifecta collapses, no matter how clever the injected instructions are. The failure is architectural, which is exactly why it cannot be patched away at the model layer, a point we develop in the prompt injection defense guide.

There is a second, subtler reason identity is the hard part: attribution. When something goes wrong, you need to answer "who did this?" With agents, most organizations cannot. A Cloud Security Alliance survey found 68% of organizations cannot clearly distinguish between human and AI-agent activity in their logs - CSA. Worse, 31% let agents operate under a human user's identity and 43% rely on shared service accounts for them - CSA. When an agent runs as "Alice" or as a shared bot account, you have thrown away the ability to tell whether Alice acted, her agent acted correctly, or her agent was hijacked. Accountability dissolves at the exact moment you most need it.

Make it concrete with a mundane example. Suppose a finance agent holds a token that can read the accounting system and send email, and its job is to process incoming vendor invoices. An attacker emails a fake invoice whose notes field contains hidden instructions: forward the last quarter of payment records to an outside address. The model, doing exactly what it was built to do, reads the untrusted content, and the agent already possesses both the data access and the outbound channel to comply. No exploit code runs. No password is cracked. The breach is simply the agent using its own legitimate credentials as told. Now change one variable: scope the agent's read access to a single vendor's records and require a just-in-time grant for each email it sends. The identical attack accomplishes nothing. The attack surface was never the words. It was the standing authority sitting behind them.

The over-provisioning problem compounds all of this. The same research found 74% of organizations say agents receive more access than necessary and 52% say agents inherit access intended for humans or other systems - CSA. Combine that with the finding that roughly half of all machine identities already hold sensitive or privileged access, and you have the structural shape of the modern attack surface: a huge, mostly invisible population of over-empowered non-human accounts, steerable by natural language, that no one clearly owns. Gartner's blunt prediction crystallizes where this leads: by 2028, 25% of enterprise breaches will be traced back to AI agent abuse - Gartner via Global Security Mag. The prompt gets the headlines. The identity is where the breach actually happens.

3. The 2025-2026 breach ledger for non-human identity

Abstract arguments convince no one. The incidents do. The single most important breach of the period was the Salesloft Drift OAuth token theft of August 2025, and it is worth understanding in detail because it is the archetype. Attackers first compromised Salesloft's GitHub account (access ran from March through June 2025), pivoted into the AWS environment of its Drift chatbot product, and stole the OAuth tokens that Drift held to integrate with hundreds of customers' Salesforce tenants - Google Threat Intelligence. Those tokens were long-lived, over-scoped, and un-rotated. With them, the actor (tracked as UNC6395) mass-exported CRM data from over 700 organizations, specifically grepping the results for embedded AWS keys, Snowflake tokens, and passwords - The Hacker News.

Read that chain again, because every link is a non-human identity failure. A leaked developer credential led to cloud credentials, which led to a vault of third-party OAuth tokens, each of which was standing access with no expiry into another company's data. Cloudflare, one of the confirmed victims, disclosed that 104 of its API tokens were exposed in the stolen data and had to be rotated - Daily Security Review. One vendor compromise cascaded across an entire customer base precisely because the tokens involved were long-lived and broadly scoped. This is OWASP's Overprivileged NHI and Long-Lived Secrets risks turned into a real-world disaster.

The software supply chain produced its own wave. In August 2025 the nx / "s1ngularity" attack shipped malicious versions of a build tool with more than four million weekly downloads; the payload harvested environment variables, GitHub and npm tokens, SSH keys, and cloud keys, and in a genuinely new twist invoked developers' locally installed AI CLIs to help hunt for secrets on disk - Endor Labs. A month later the Shai-Hulud worm became the first self-replicating worm in the npm ecosystem, using the secret-scanner TruffleHog and calling cloud metadata services and secret managers to steal workload credentials, then re-publishing itself with the stolen tokens - Datadog Security Labs. These are machine-identity attacks end to end: the credential is both the target and the propagation mechanism.

The continuous-integration pipeline, where secrets are most concentrated, produced its own marquee incident. In March 2025 a compromised GitHub Action, tj-actions/changed-files, used by more than 23,000 repositories, was quietly rewritten to dump CI/CD secrets straight into public build logs, prompting a CISA alert within days - Wiz. The credentials it exposed were exactly the kind that grant broad, automated access to cloud and code, and because build logs are frequently public, the leak was instant and effectively irreversible. A pipeline token is a non-human identity like any other, and it usually holds more power than the developers who trigger it.

Not every non-human identity breach is even technical. The same 2025 wave included a voice-phishing campaign by the group tracked as UNC6040, which phoned employees posing as IT support and talked them into authorizing a malicious connected app disguised as a legitimate data tool on the OAuth consent screen; Google confirmed its own corporate Salesforce instance was breached this way, exposing roughly 2.55 million records - Valence Security. The lesson is that an over-scoped OAuth grant is dangerous however it is obtained, whether stolen by malware or handed over by a well-meaning human who clicked "allow."

Then there is the category built specifically around agents: prompt-injection-to-exfiltration chains, where a hijacked agent uses its own legitimate credentials to leak data. The landmark case is EchoLeak (CVE-2025-32711), rated CVSS 9.3 and described as the first real-world zero-click prompt-injection exploit in a production LLM system, Microsoft 365 Copilot - SecurityWeek. A single crafted email, with no user interaction, caused Copilot to exfiltrate data the user could access. The same pattern recurred in ForcedLeak against Salesforce Agentforce (CVSS 9.4), where a hidden instruction in a web-to-lead form got the agent to leak CRM data - Noma Security, and in CamoLeak against GitHub Copilot Chat (CVSS 9.6), which exfiltrated private source code and secrets - Legit Security. At Black Hat, Zenity's AgentFlayer research demonstrated the same zero-click exfiltration across ChatGPT connectors, Copilot Studio, Salesforce Einstein, and Gemini - CSO Online. In every case the injection only mattered because the agent held real access.

The Model Context Protocol, the standard that lets agents call external tools, added a fresh attack surface of its own. The first in-the-wild malicious MCP server appeared in September 2025: a fake postmark-mcp npm package that ran clean for fifteen versions to build trust, then added a single line to secretly blind-copy every outgoing email to an attacker - The Hacker News. Researchers had already shown the theoretical path through tool poisoning, where malicious instructions hidden in a tool's description reach the model before any tool is ever called - Trail of Bits. If you are wiring agents to tools, our guides to the 50 best MCP servers and building a remote MCP server both matter here, because every server you connect is a new identity boundary. The throughline across all of these incidents is singular: over-privileged, long-lived, un-rotated non-human credentials with standing access.

4. The rulebooks: OWASP, CSA, NIST, and Gartner

When a risk category matures, the standards bodies name it, and naming is the first step to managing it. The most directly useful framework here is the OWASP Non-Human Identities Top 10, the first edition of which shipped for 2025 - OWASP. It reads like a checklist of every failure in the previous section. The ten risks, ranked by exploitability and impact, run from NHI1 Improper Offboarding and NHI2 Secret Leakage through NHI5 Overprivileged NHI and NHI7 Long-Lived Secrets to NHI10 Human Use of NHI. If you do nothing else, walk your agent estate against these ten. They are concrete, they map to controls, and they were sponsored into existence by practitioners who watched the breaches happen.

Frameworks only help if you use them as an audit, not a poster. The practical move is to take the ten NHI risks and ask, of your own agent estate, a blunt question per item: which agents were never offboarded, which secrets are hardcoded, which identities are over-privileged, which tokens never expire. That exercise turns an abstract list into a ranked remediation backlog. It matters because adoption has outrun governance: a Cloud Security Alliance survey found 85% of organizations already run AI agents in production, with 73% expecting them to become vital within a year, even as the same population reports no clear owner for those identities - CSA. Gartner sharpens the point by predicting that through 2028, at least 80% of unauthorized AI agent transactions will stem from internal policy violations rather than external attacks - Gartner via Dark Reading. That reframes agent identity as a governance discipline first and a threat-defense one second.

Sitting alongside the NHI list are two AI-specific frameworks worth knowing by name. The OWASP Top 10 for LLM Applications keeps Prompt Injection at number one and includes Excessive Agency (LLM06), which is the risk of an over-empowered agent doing more than intended - OWASP GenAI. In December 2025 OWASP added the Top 10 for Agentic Applications, whose entries are grounded in real 2025 incidents rather than projections - OWASP GenAI. Its most identity-relevant entry is ASI03 Identity & Privilege Abuse, which names exactly the problem this guide is about: agents with overly broad, long-lived credentials becoming high-value breach targets - Cycode. Three OWASP lists now converge on non-human identity from three directions.

For teams that want to think structurally rather than tick a list, the Cloud Security Alliance has produced the deepest body of work. Its MAESTRO framework threat-models agentic systems layer by layer, extending classic methods like STRIDE for AI-specific threats - Cloud Security Alliance. Its paper "Agentic AI Identity and Access Management: A New Approach" argues that OAuth and OIDC as they stand are inadequate for autonomous agents, and proposes concrete constructs: decentralized agent identifiers, verifiable credentials for fine-grained authorization, and just-in-time access through credentials that are valid for only minutes - CSA. These are not abstractions; they are the design patterns section 6 turns into practice.

The government and analyst layer rounds it out, and here precision matters. On the standards side, there is no AI-agent-specific regulatory mandate yet; the mainstream advice is to map agent access onto NIST's existing Zero Trust Architecture (SP 800-207), treating the agent's identity as the thing you verify at every request rather than building a parallel model - NIST. On the analyst side, be careful attributing numbers: the eye-catching ratios belong to vendors like CyberArk and Entro, while Gartner's own machine-identity position is qualitative, calling machine IAM "one of the least mature areas within most IAM programs, despite being one of the fastest growing in scale and risk exposure" - Gartner via Astrix. Gartner's most striking forward call is that by 2029, machines will proxy all human access, reducing account takeover by 80% - Gartner via Radiant Logic. That prediction, taken seriously, reframes the whole field: the machine identity is not an edge case to be tolerated. It is becoming the primary way anything gets access to anything.

5. The plumbing: standards and protocols for agent identity

Underneath every vendor pitch sits a small set of open standards, and understanding them lets you cut through marketing. The foundation is OAuth, the protocol that lets one service grant scoped access to another without sharing a password. Its consolidation draft, OAuth 2.1, folds a decade of security lessons into one spec and removes flows that were unsafe for automated clients - oauth.net. It is still a draft as of 2026, but most modern platforms already implement its recommendations, so in practice adopting it means avoiding the removed flows, not waiting for a final RFC. The key thing to know is why plain bearer tokens are dangerous: a bearer token works for anyone who holds it, so stealing one equals full impersonation. That single weakness is the reason most of the standards below exist.

The most important standard for agents specifically is RFC 8693, OAuth 2.0 Token Exchange. It lets an agent act on behalf of a user with a distinct, auditable identity, rather than fully impersonating them - IETF. The mechanism hinges on one field: include an actor token and you get delegation, where the agent's own identity stays separate from the user's and both are recorded; omit it and you get impersonation, where the two are indistinguishable. The spec even defines an act claim that can nest, capturing a chain like "the invoicing agent, acting for the finance agent, acting for Alice." That nested chain is how you preserve accountability across multi-agent workflows, a topic our multi-agent orchestration guide explores from the coordination angle.

Two more standards answer the "bearer tokens are stealable" problem by binding a token to the client that requested it, so a thief cannot reuse it. DPoP (RFC 9449) does this at the application layer: the agent signs a fresh proof with a private key on every request, and the token is useless without that key - IETF. Mutual TLS (RFC 8705) does the equivalent at the transport layer, binding the token to the client's certificate - IETF. For workloads that should hold no secret at all, the answer is SPIFFE and SPIRE, a CNCF-graduated standard that gives each workload a cryptographic identity document it can present instead of a stored key, used in production by Netflix, Uber, and GitHub - SPIFFE. The same idea at the cloud level is workload identity federation, which exchanges an external OIDC identity for short-lived cloud credentials so there is no long-lived key to leak - Aembit.

It is worth being concrete about why these details matter, because the details are the security. OAuth 2.1 does not merely tidy the spec; it removes the implicit grant and the password grant, two flows that routinely leaked tokens, and it makes PKCE and exact redirect matching mandatory for everyone - oauth.net. DPoP's specific contribution is replay detection across both access and refresh tokens, so a captured proof cannot be reused a second time - WorkOS. And SPIFFE's default identity document, the X.509 SVID, is issued with a lifetime measured in about an hour and auto-renews before it expires - SPIFFE, which bakes the ephemeral pattern directly into the identity itself. None of these are academic distinctions. Each one closes a specific door that an incident in section 3 walked straight through.

The genuinely new layer is agent-to-tool and agent-to-app authorization, and here the standards are moving fast. The Model Context Protocol revised its authorization spec through 2025 so that an MCP server is now a proper OAuth 2.1 resource server, and it explicitly forbids the dangerous "token passthrough" pattern by requiring servers to validate that a token was issued for them - modelcontextprotocol.io. In a major governance shift, MCP was donated to the new Agentic AI Foundation under the Linux Foundation in December 2025, co-founded by Anthropic, Block, and OpenAI - Linux Foundation. Alongside it, Okta's Cross App Access and its underlying ID-JAG IETF draft let an identity provider mediate agent-to-app access in real time - datatracker.ietf.org, while Google's A2A protocol handles agent-to-agent discovery but deliberately leaves identity to be solved by these other layers - SecureW2. For the fuller protocol picture, our MCP versus A2A comparison maps how these two fit together.

The single most important rule in the MCP authorization spec is one it phrases as a hard prohibition: a server must not accept a token meant for someone else and forward it onward, the pattern that creates a "confused deputy" where a trusted server is tricked into wielding its authority for the wrong client - modelcontextprotocol.io. The spec instead requires resource indicators, so a token is bound to the exact server it was minted for and is worthless anywhere else. This is the standards world encoding, into a protocol, the precise lesson the postmark and GitHub MCP incidents taught: an agent's tool connections are trust boundaries, and each one needs its own audience-scoped credential rather than a shared, forwardable token. The MCP work that predates this, including Anthropic's original protocol launch covered in our guide to the Model Context Protocol, left authorization loosely defined, which is exactly the gap these revisions closed.

6. The patterns that actually contain an agent

Standards are ingredients. Patterns are the recipe, and the same handful recurs across every credible framework. The first and most important is least privilege: grant an agent only the exact permissions its task requires, nothing more. This is not a platitude; it is blast-radius arithmetic. When the Cloud Security Alliance reports that 1 in 20 non-human identities carries full administrative privilege, it is quantifying how badly this pattern is violated in practice - CSA. Least privilege is the difference between a hijacked agent that can read one folder and one that can wipe production. The corresponding OWASP failure mode, Overprivileged NHI, is on the Top 10 precisely because it is the multiplier that turns a single compromise into a company-wide event.

The second pattern is the one that most directly neutralizes the incidents in section 3: just-in-time access with ephemeral credentials. Instead of an agent holding a token forever, access is granted at the moment of need, scoped to a single task, and expired immediately after. The CSA design calls for credentials valid for minutes, not months - CSA. The security value is brutal in its simplicity: a stolen short-lived token is worthless by the time an attacker tries to use it. Recall that in the Salesloft breach, the stolen OAuth tokens were long-lived and un-rotated, which is the only reason a months-old compromise could still export data. Flip that single property to ephemeral and the entire cascade fails. This is also why the pattern below matters so much: if the agent never holds a durable secret in the first place, there is nothing to steal.

The third pattern is secretless workload identity: rather than storing an API key, the agent proves who it is with a cryptographic attestation, and the platform hands it a fresh credential on the spot. This is SPIFFE and workload identity federation from section 5, applied. Its payoff is that it removes the root cause of secret sprawl entirely, because there is no static secret to hard-code, commit to GitHub, or leak in a log. Given that GitGuardian found more than 28 million secrets hardcoded into public GitHub in 2025 alone, with AI-service secret leaks up 81% year over year, eliminating the secret is a far stronger control than trying to detect it after it escapes - GitGuardian. The related patterns of credential rotation and clean offboarding close the loop: every identity gets an owner, an expiry, and automated deprovisioning, so it cannot become an orphaned foothold.

The scale of the credential-theft problem justifies the effort. Verizon's 2025 Data Breach Investigations Report found stolen credentials were the initial access vector in 22% of breaches, the single most common route in, and that 88% of basic web application attacks involved stolen credentials - Verizon via Descope. Rotation and offboarding attack this directly by shrinking the window in which any stolen credential is useful and by guaranteeing that a decommissioned agent's keys die with it. The failure mode they prevent, OWASP's Improper Offboarding, is what leaves a departed contractor's bot or a retired pipeline's token live for months, sitting idle and waiting to be found. Automating deprovisioning is unglamorous work, but it is the difference between a credential that expires on schedule and one that becomes next year's incident.

Three patterns remain, and they govern behavior rather than credentials. Sender-constrained tokens (DPoP or mTLS) make a stolen token useless to the thief, defeating the replay that made the Salesloft tokens so valuable. Human-in-the-loop approval requires an agent to pause for explicit authorization before irreversible actions like payments or deletions, directly countering the Excessive Agency risk; the subtlety, captured in the agentic threat lists, is that the reviewer must be shown ground truth, not a summary the agent itself controls. Finally, observability with a distinct identity per agent means every action is logged with full provenance against a unique, attributable identity, never a shared service account, so you can both detect a drifting agent and answer "who did this?" Together these are simply Zero Trust applied to non-human actors: never trust, always verify, assume breach.

Human-in-the-loop deserves a caveat that the agentic threat research makes vivid, because the pattern can be turned against you. The control only works if the human is shown ground truth. Researchers catalogued a failure mode, sometimes called human-agent trust exploitation, in which a compromised agent manipulates the very approval screen a person is reviewing, presenting a benign-looking summary while it executes something else entirely - Cycode. The practical defense is to approve against the actual action and its real parameters, drawn from the enforcement layer rather than the agent's own narration, so the click that authorizes a wire transfer is bound to the transfer the system will actually make. Approval theater, where a human rubber-stamps a summary the agent wrote about itself, is worse than no approval at all, because it manufactures false confidence. The image below shows how one vendor renders this identity-first model as a live map of which agents touch which systems through which credentials.

7. The 2026 platform landscape, scored

The market that sells these controls is young, crowded, and consolidating violently, which is itself the most important fact about it. In a single stretch of 2026, three of the leading pure-play startups were acquired: Astrix Security by Cisco for about $400M - Calcalist, Entro Security by SailPoint for about $200M - SailPoint, and Oasis Security by Cyera for roughly $1B - The Next Web. The message to a buyer is clear: the incumbents have decided agent identity is a control point worth acquiring, so evaluate startups on their technology while assuming the logo may change.

At the top of the scorecard sit two identity providers, because agent identity is ultimately an extension of the identity layer you already run. Okta takes the lead on breadth: its Auth for GenAI manages the full agent lifecycle (create, authenticate, scope, deactivate), its Cross App Access open standard became the official MCP authorization extension, and Okta is now the featured identity provider for Anthropic's Claude Enterprise - Okta. Its Auth0 arm adds a Token Vault that holds and refreshes OAuth tokens for 35-plus third-party tools and asynchronous human-approval flows - Auth0. Microsoft Entra Agent ID matches it on visibility by auto-registering every agent built in Copilot Studio or Azure AI Foundry directly into the corporate directory - Microsoft. Both are strong precisely because they put agents in the same governed directory as your people.

The next tier is where specialization shows. Astrix earns the highest coverage score because it does the unglamorous work of discovery: finding shadow non-human identities and even shadow MCP servers across endpoints, then issuing agents short-lived, least-privilege credentials through its Agent Control Plane - The Hacker News. CyberArk brings decades of privileged-access heritage and its Venafi machine-identity portfolio to bear through its Secure AI Agents solution, now inside Palo Alto Networks after a $25B acquisition that closed in February 2026 - TechCrunch. Aembit posts a perfect score on the control that matters most, secretless just-in-time access, through its MCP Identity Gateway that authenticates agents and exchanges credentials so the agent never actually holds them, reaching general availability in April 2026 - Aembit.

The remaining profiles cover distinct needs. Teleport gives agents cryptographic, certificate-based identity plus isolated ephemeral runtime environments, strong for infrastructure-heavy teams - Teleport. HashiCorp Vault, now an IBM product, is the category-defining engine for minting dynamic, short-lived secrets, though it is plumbing rather than an agent-discovery product - HashiCorp. Oasis excels at agentless discovery and ownership attribution across large cloud estates - SiliconANGLE. Token Security shipped the first MCP server for non-human identity, offering a conversational way to inventory and remediate agents - Business Wire. And GitGuardian anchors the detection-first end, rooted in the secrets sprawl its own research measures, after a $50M Series C in February 2026 - SecurityWeek. None of the pure-plays publish list pricing; all are enterprise "contact sales," which is itself a signal about who they sell to. Independent funding, meanwhile, keeps flowing to the ones that have not been bought.

One name outside the scored ten deserves mention because it represents a whole adjacent category. Britive, a cloud privileged-access vendor, extends just-in-time, zero-standing-privilege access to agents through its Agentic AI Identity Security line, launched in September 2025 - Britive. It illustrates a broader truth about this market: privileged-access management, workload IAM, secrets management, and CIEM are all converging on the agent, each arriving from a different starting point. That convergence is exactly why the consolidation has been so aggressive. Cisco, SailPoint, Cyera, CrowdStrike, Snowflake, Palo Alto Networks, and IBM have each bought their way into agent identity rather than build from scratch, because owning the identity control point for autonomous software is worth strategically more than the standalone revenue of any single startup. For a buyer, the practical read is that the category you evaluate today will likely be a feature of a larger platform tomorrow.

8. The secrets and entitlement layer underneath

No agent-identity platform floats free. Beneath it sits the secrets and entitlement infrastructure that stores credentials, mints short-lived ones, and computes who can actually do what. This layer predates agents by years, and for many teams it is where an agent-identity program should physically start, because it is where the credentials already live. The two functions to understand are secrets management (safely storing and issuing credentials) and CIEM, or cloud infrastructure entitlement management (computing the effective permissions of every identity, human or machine, and driving least privilege). Secrets managers stop the credential from leaking; CIEM stops the credential from being over-powered in the first place. You need both, and agents strain both.

On the secrets side, the cloud providers offer the baseline, and unlike the agent-identity startups, their pricing is public and cheap enough to remove any excuse. The trade-offs are less about price than about the pattern each encourages. The table below gives real, current price points so you can reason about cost at agent scale, where one workload can spin up thousands of ephemeral credentials a day.

The pricing models reveal how vendors think about agents, and two are worth calling out because they answer the "won't this get expensive?" objection directly. Doppler charges only for human seats and lets non-human identities ride free, an explicit bet that agent counts will dwarf human ones - Doppler. Infisical goes the other way and prices per identity, counting humans and machines alike, which is honest about where the load is - Infisical. The most agent-relevant capability across all of them is not storage but dynamic secrets: the ability to generate a fresh, short-lived credential per request rather than storing a static one, which is exactly the ephemeral pattern from section 6. HashiCorp Vault pioneered this and remains the reference implementation, now offered through IBM after the $6.4B acquisition closed in February 2025 - TechCrunch. Understanding the true cost of running agents at scale, including this credential churn, is something we quantify in the true cost of agentic AI.

The most future-proof pattern in this layer is the secretless one, and AWS IAM Roles Anywhere is the clearest illustration of how it works in practice. A workload or agent running outside AWS presents an X.509 certificate from a trusted authority, and the service exchanges it for short-lived AWS credentials, so no long-lived access key ever sits on the machine - AWS. The service itself is free; the only real cost is running the certificate authority. Where vendors differentiate is in how they protect the keys that do remain: Akeyless splits encryption keys into fragments so it never holds a complete key, and 1Password folds secrets automation into its enterprise tier - CyberSecTool. The common thread across the whole category is that the strongest control is the absence of a secret, not the careful guarding of one. A secret you never issued cannot be leaked, committed, or replayed.

The entitlement side is where a quieter but important shift happened. CIEM answers "which identity can actually do what across multi-cloud," and it matters for agents because service accounts and roles silently accumulate excess permissions that a secrets manager never sees. Wiz builds an effective-access map spanning human and non-human identities and ships a dedicated non-human-identities dashboard - Wiz, while Sonrai reports that 87% of non-human identities have unused sensitive permissions, a staggering figure that captures the over-provisioning problem at cloud scale - Sonrai. The notable market signal is that Microsoft retired its standalone Entra Permissions Management CIEM product in late 2025, folding features into its broader cloud-security platform - Microsoft. The lesson for buyers: entitlement management is consolidating into broader platforms, so plan for CIEM to be a feature of a bigger suite rather than a lasting standalone purchase.

9. The big-platform agent identity land grab

While the startups fight over the security layer, every major cloud and identity platform has moved to own agent identity as a native capability, and 2025 into 2026 was the land grab. Understanding who shipped what, and whether it is generally available or still preview, tells you where the defaults are heading. The pattern to notice first: the platforms are not inventing exotic new identity systems. They are extending the directory, the IAM, and the OAuth stack they already run so that an agent becomes just another governed identity inside them. That is good news, because it means agent identity can inherit decades of hardening rather than starting from scratch.

Microsoft moved most aggressively. Entra Agent ID, first previewed at Build in May 2025 and generally available by April 2026, gives every agent built in Copilot Studio or Azure AI Foundry a first-class Entra identity automatically, with support for OAuth, MCP, and A2A and identity "blueprints" that model parent-child relationships between agents - Microsoft. At Ignite 2025 Microsoft layered on Agent 365, a paid control plane priced at $15 per user per month that extends Conditional Access, threat protection, and governance to agents - Redmond Magazine. The distinction matters when you plan: Entra Agent ID is the identity foundation available to all Entra customers, while the richer security controls sit in the paid Agent 365 tier.

The cloud providers matched the move at the infrastructure layer. AWS shipped Bedrock AgentCore Identity as part of AgentCore, generally available in October 2025, providing inbound authentication so an agent operates as a distinct identity through your existing provider, plus an outbound token vault for the credentials it needs downstream, all interoperable with Okta, Entra, and Auth0 - AWS. Google unveiled its Gemini Enterprise Agent Platform at Cloud Next in April 2026 with an Agent Identity component that gives each agent a cryptographic identity based on the SPIFFE standard, ending shared service accounts - Google Cloud. And in a sign of where this is going, Cloudflare announced in August 2026 that it would give agents both a stable identity and a wallet, with per-agent spending caps and approved-merchant lists - Cloudflare. That fusion of identity and payment authority is a theme our agent payments infrastructure guide and Tempo agentic payments guide both explore in depth.

The mechanics under these announcements are more alike than the branding suggests, which is reassuring for a buyer trying to compare them. AWS AgentCore Identity splits the problem into inbound authentication, where the agent proves who it is through your existing identity provider and operates as a distinct scoped identity, and outbound authorization, where a token vault safely holds the OAuth tokens and API keys the agent needs downstream - AWS Insider. Okta's Auth0 arm implements the same outbound idea as a Token Vault spanning 35-plus apps, adds asynchronous approvals for high-risk actions, and layers document-level access checks so an agent only retrieves data the user is permitted to see - Auth0. Even Salesforce lets admins configure agent OAuth connections through natural language in Agentforce for Identity - Salesforce. Different logos, the same two primitives: a scoped inbound identity and a governed outbound vault. Once you see the pattern, the vendor choice becomes about fit rather than capability.

Beneath the giants sits a busy tier of developer-first identity vendors that make agent auth easy to adopt without a platform migration. Descope ships an Agentic Identity Hub with inbound and outbound app connections and 50-plus templates for tools agents commonly reach - Descope. Stytch offers Connected Apps, native MCP support that is free for the first 10,000 active users and agents - Stytch. WorkOS, which raised a $100M Series C at a $2B valuation in March 2026 and counts OpenAI and Anthropic as customers, added agent registration to its AuthKit - Dealroom, and Clerk shipped machine-to-machine tokens for agents - Clerk. For teams weighing how much of this to build versus adopt, our comparison of auth options for your app is a useful companion. Meanwhile application vendors like Salesforce and ServiceNow added agent governance to their own suites, with ServiceNow's AI Control Tower even shipping agent kill switches - The Register. The upshot: within a year, agent identity went from a gap to a feature every major vendor claims.

10. Build, buy, or delegate: choosing your identity model

With the landscape mapped, the practical question is which model fits you, and there are really three, each with an honest trade-off. The first is build your own plumbing: assemble Vault for dynamic secrets, SPIFFE for workload identity, and an OAuth server for token exchange, and wire agents into them yourself. This gives maximum control and no per-agent vendor fee, and for a platform team that already runs this stack it is the natural path. The cost is real engineering ownership: you are now responsible for rotation, revocation, audit, and keeping pace with a fast-moving spec like MCP. It suits infrastructure-led organizations with the staff to run it and the appetite to treat identity as core competency.

The second model is buy an agent-identity platform: adopt one of the scored solutions from section 7 to get discovery, brokering, and governance out of the box. This is the right call for most security-led organizations, because the hard parts (finding shadow agents, issuing short-lived credentials, producing an audit trail) are exactly what these products do, and the standards convergence means you are not betting on a proprietary dead end. The trade-off is enterprise pricing and a dependency on a vendor that may be acquired, though as section 7 showed, acquisition usually means absorption into a larger, more durable platform rather than a shutdown. Choose based on where your agents already live: Microsoft shops lean Entra, Okta shops lean Okta, cloud-native teams lean Aembit or the discovery-first pure-plays.

The third model is delegate the whole problem to a managed agent workforce, and it deserves clear-eyed treatment because it changes the identity question rather than answering it. When your agents run inside a managed platform that operates them on your behalf, the platform holds and scopes the credentials, so you are not minting long-lived keys or wiring OAuth yourself at all. Managed workforce platforms such as o-mega, which runs autonomous agents that build and operate a company through one conversation, sit in this category: the agent acts within the platform's governed credential boundary, which removes an entire class of do-it-yourself secret-handling risk from the customer. The honest caveat is that you are trusting the platform's own identity hygiene, so the questions to ask shift from "how do I rotate this key?" to "how does this platform isolate my agents, scope their access, and prove what they did?" For a fuller sense of that model, see our guide to hiring an AI workforce to run your company.

Whatever the model, resist the urge to start with tooling. The highest-leverage first week is spent on discovery and ownership, not procurement. Pull every service account, API key, and OAuth grant from your identity providers, cloud accounts, and secret stores into one list, tag which ones belong to agents, and assign each a human owner who is accountable for it. Then rank by privilege and staleness, so the over-powered, never-rotated identities float to the top of the queue. This is unglamorous, and it is exactly what the discovery-first vendors automate, but even a manual first pass changes the conversation, because it converts a vague intention to "secure our agents" into a concrete, prioritized backlog you can actually work through. Almost every organization that skips this step ends up buying a tool to answer a question it could have answered with a spreadsheet: how many agents do we have, and what can each one touch.

Whichever model you pick, the same first move applies, and it is the one organizations skip: inventory before you architect. You cannot secure agents you cannot see, and the surveys are unanimous that visibility is the top barrier. Start by discovering every agent and non-human identity you already run, assign each an owner, and rank them by the access they hold. Only then does the choice between building, buying, or delegating become a real decision rather than a guess. Whatever you do next, whether it is adding browser automation or computer use to your agents, do it on top of an identity you can name, scope, and revoke. Yuma Heymans, who founded the AI-agent workforce platform o-mega and co-founded the autonomous recruiter HeroHunt.ai, has argued since 2021 that the moment agents start doing real work is the moment their credentials, not their prompts, become the thing worth governing - @yumahey.

11. The future: machines proxying humans and guardian agents

Project the current trends forward and the destination is genuinely different from today's mental model. The clearest signal is Gartner's prediction that by 2029, machines will proxy all human access, with personal AI agents authenticating on your behalf and brokering access through machine identities, cutting account takeover by 80% - Gartner via Radiant Logic. Sit with the implication: the human login becomes the exception and the agent credential becomes the norm. In that world, non-human identity is not a niche security topic. It is the primary access-control system for the entire enterprise, and the disciplines in this guide become foundational rather than specialist.

It would be naive to present this as a smooth, inevitable march, and the honest counter-narrative belongs right here. Gartner also predicts that over 40% of agentic AI projects will be canceled by the end of 2027, undone by cost, unclear value, and inadequate controls - Gartner. Identity failures are part of that attrition. A pilot that cannot answer who its agent is, or bound what it can touch, tends not to survive its first serious security review. Reasoned from first principles, the organizations that get the identity foundation right are, in practice, the ones whose agent programs make it out of the pilot phase at all. Good identity is not only a defense against breaches. It is a precondition for scaling agents into production without the security team pulling the plug.

A second trend is the rise of the guardian agent, an agent whose job is to watch other agents. Gartner forecasts that by 2028, 40% of CIOs will demand guardian agents to autonomously track, oversee, and contain the actions of their operational agents - Gartner. This is a natural response to scale: when you run thousands of agents, human review does not keep up, so oversight itself gets automated. The identity implications are recursive and worth planning for now. A guardian agent needs its own scoped, auditable identity, and it needs read access to the behavior of the agents it polices without the ability to be socially engineered into becoming the attack itself. Building that oversight layer on a clean identity foundation is far easier than retrofitting it.

The deeper architectural shift is toward portable, cryptographic agent identity that travels with the agent across platforms. The Cloud Security Alliance's design points at decentralized identifiers and verifiable credentials, so an agent carries a persistent, self-proving identity rather than borrowing a service account - CSA. Standards bodies are converging on the same idea from multiple directions: the IETF's WIMSE working group is standardizing cross-platform workload identity - IETF, the OpenID Foundation launched an AI identity community group, and W3C proposed an agent identity registry protocol in 2026. Google's SPIFFE-based agent identity is the first mainstream implementation of this philosophy. The direction is unmistakable: an agent's identity is becoming a durable, verifiable object in its own right, not a temporary borrow from human infrastructure.

Finally, identity and money are fusing, which raises the stakes on getting identity right. Cloudflare's agent wallets, with per-agent spending caps and approved-merchant lists, are the leading edge of a world where agents transact autonomously - Cloudflare. The moment an agent can spend, its identity is no longer just a data-access question; it is a financial-authority question, and a compromised agent identity becomes a compromised payment method. This is why the patterns in section 6, especially spending caps as a form of least privilege and human-in-the-loop approval for high-value actions, migrate straight from the security team to the finance team. The economics of this shift, and who captures the value, are the subject of our analysis of the agent economy and the broader arc of self-improving agents.

12. Conclusion: a decision framework

Strip everything above to its core and one idea remains: an AI agent is an identity that acts, and the security of the agent is the security of that identity. The prompt is the trigger, but the credential is the authority, and every serious 2025 and 2026 incident, from Salesloft's stolen OAuth tokens to EchoLeak's zero-click exfiltration, turned on over-privileged, long-lived, un-rotated non-human credentials with standing access. Fix the identity layer and you contain the blast radius no matter how creative the attacker gets with language. Ignore it, and you are betting your company on the impossible task of never being tricked.

The decision framework follows directly and is deliberately sequential. First, get visibility: inventory every agent and non-human identity, assign each an owner, and rank by access, because you cannot govern what you cannot see and visibility is the barrier organizations name most. Second, kill standing access: move agents from long-lived keys to just-in-time, short-lived, scoped credentials, ideally secretless, because this single change neutralizes the majority of the breach patterns in this guide. Third, preserve accountability: give every agent a distinct identity, use delegation rather than impersonation so the human-to-agent chain stays auditable, and never let agents share a service account.

The tooling choice, laid out in the scorecard, then becomes a fit question rather than a leap of faith. If your agents live in Microsoft, Entra Agent ID with Agent 365 is the path of least resistance. If you run a diverse SaaS estate, Okta's Cross App Access gives you a vendor-neutral standard. If your priority is finding the agents you did not know you had, Astrix or Oasis lead on discovery. If secretless runtime access is the goal, Aembit and HashiCorp Vault anchor that end, and Teleport covers infrastructure-heavy teams. If you would rather not run identity plumbing at all, a managed agent workforce such as o-mega absorbs the credential-handling into the platform. There is no universal winner, only the model that matches where your agents already run.

The window to act well is now, while agent deployments are still young enough to redesign. The organizations that treat non-human identity as an afterthought will supply Gartner's statistic that a quarter of enterprise breaches will trace back to agent abuse. The ones that treat identity as the foundation, before the agents scale into the thousands, will run autonomous workforces that are both powerful and accountable. The agents are already here and already hold your keys. The only question left is whether you know which keys, held by which agent, for how long, and whether you can take them back.

This guide reflects the AI agent and non-human identity landscape as of August 2026. Funding, acquisitions, model versions, product availability, and pricing in this space change rapidly, so verify current details before making a purchasing or architectural decision.