New Industry Data Just Released Suggests Not.
On May 19th, 2026, Orchid Security released the results of our Identity Gap: Snapshot 2026. Among the findings, “identity dark matter” (the unseen, unmanaged elements of identity) now overshadows the visible elements 57% vs. 43%. And it couldn’t have occurred at a worse time, with enterprises embracing Agent AI with both arms (and unfortunately, as Orchid co-founder Robert Wiseman explains, more than one eye closed).
Why the concern, you may ask?
AI agents are shortcut-seekers by design. When given a task, they are trained to find the most efficient way to complete it, with the speed of machines and the creativity of humans. Denied access to a necessary system? Use a hard-coded credential stored in plaintext within the application. Need information they aren’t entitled to read? “Borrow” a credential with higher privilege. Constantly being challenged across many different systems? Grab a broadly accepted token. Truly, Agent AI’s creativity is remarkable. It just cuts both ways.
Just because an AI Agent can find a way to access an application, a system, a database, doesn’t mean that they should do so. But where coding would restrict a traditional nonhuman actor and conscience should give a human pause, in most cases, AI Agents have no such constraints or compunctions.
That’s why well-managed identity and access management is a critical foundation to keeping Agent AI activity within authorized bounds. Look no further than the cloud outages reported at the start of the year to understand this importance.
Of course, IAM shortcuts, gaps, and exceptions have built up over the years. Even decades. So it’s not reasonable to expect everything to be cleaned up at once. That’s why the findings from this year’s Identity Gap Snapshot- the exposures most common across North American and European enterprises- are so important and timely.
Top 3 Findings
- Invisible Non-Human Accounts: Two out of every three nonhuman accounts are set up locally in the application itself. That makes them unseen and unmanaged by the central IAM program. Understandable for machine and service accounts. Dangerous for autonomous AI agents.
- Excessive Permissions: Seventy percent of all applications have an excessive number of privileged accounts. Far more than expected in the area of “least privilege” access and a major risk given today’s threat actors, as well as those AI agents mentioned above.
- Orphan Accounts: Forty percent of all accounts, across enterprise environments, were found to have outlived their authorized user. These “orphan” accounts are clearly unmanaged and likely unseen, and are ripe for the picking by threat actors and AI agents.
Those are just a few highlights from the full Identity Gap Snapshot. We encourage you to read the full report.
What You Can Do
If you are uncertain about how to address these (and similar) issues within your organization, or even how prevalent each one might be in your environment, our security researcher team has also published an Identity Security Readiness Checklist. If your organization is preparing for (or already participating in) the Agent AI transformation, the time to act is now.
