By mid-2026 non-human identities (service accounts, API keys, OAuth tokens and AI-agent credentials) outnumber human identities by roughly an order of magnitude (Cloud Security Alliance: an average of 45 to 1, up to 144 to 1 in cloud-native environments) while most enterprises lack any documented policy to provision or retire them (78% per CSA), making NHI the fastest-growing unmanaged enterprise attack surface, and the binding first control is an inventory with owner and lifecycle, not additional perimeter security.

Anchored on three May 2026 datasets: CSA AI Safety Initiative whitepaper 'The Non-Human Identity Governance Vacuum' (20 May 2026 — 45:1 average / 144:1 cloud-native NHI-to-human ratio, 78% no policy to create/retire AI identities, 51% no clear ownership, 20% formal API-key offboarding); Sophos 'State of Identity Security 2026' (12 May 2026, n=5,000 across 17 countries — 71% suffered an identity breach in the past year, $1.64M mean recovery cost, weak NHI management a factor in 41% of incidents, CISO Ross McKerchar quote); Gartner 'Six Steps to Manage AI Agent Sprawl' press release (28 Apr 2026 — over 150,000 agents per average Fortune 500 firm by 2028 vs <15 in 2025, only 13% believe they have adequate agent governance, six-step sequence starting with governance policy then centralised inventory). VERIFIED 2026-06-05: CSA labs page, Sophos press release, Gartner newsroom press release (Gartner page 403s to crawlers; figures and URL confirmed via WebSearch returning the canonical newsroom URL verbatim). Distinct from CSA's earlier 26 Jan 2026 'State of NHI and AI Security' survey — the 45:1/78%/20%/51% figures are exclusively from the 20 May 2026 whitepaper. 90-day cadence. Triggers: (1) a later large-sample dataset showing the ratio or policy-gap figures compressing materially; (2) a standards or platform shift (e.g. broadly adopted workload-identity attestation) making lifecycle governance a default; (3) breach data showing perimeter controls, not inventory, separate affected from unaffected. Siblings: AM-167 (NHI procurement clause gap), AM-176 (Okta vs specialist NHI vendors), the agent-identity IAM architecture read.