When people think about identity and access, they picture employees logging in. But most of the accounts inside a bank don't belong to a person at all. They belong to software. Those are non-human identities, and they now make up the large majority of identities a financial institution has to manage.
What counts as one
A non-human identity is any credential a system uses to authenticate and act, without a person at the keyboard. The common kinds are service accounts that let one application talk to another, API keys and tokens that connect services, machine certificates that identify servers and devices, and now the credentials behind AI agents. Each one can sign in, reach data, and take actions, the same way a human account can.
Why there are suddenly so many
The count has been climbing for years. Modern software is built from many small services that each need their own credentials, automation has replaced manual steps, and cloud platforms spin up identities by the thousands. The 2026 Cloud Security Alliance survey of financial firms points to estimates that non-human identities outnumber human ones by roughly 96 to 1 in financial services, and notes the exact figure varies by source. AI agents push the number higher still, because each agent needs an identity to do anything.
Why it's a problem
Every one of these identities is a way in. They often have broad standing permissions, they rarely get rotated the way employee passwords do, and most aren't watched closely. That's a bad combination. The same survey cites research that 82 percent of organizations had at least one identity-driven cyberattack in the past year, with financial services running higher. When a service account or an agent credential is stolen or misused, it can reach data and move through systems without tripping the alarms built for human logins.
How to get a handle on it
The fixes are not exotic, but they take discipline:
- Inventory them. You can't govern identities you haven't counted. Most firms find more than they expected.
- Scope them down. Give each one only the access it needs, instead of broad standing permissions.
- Rotate and expire credentials. Keys and tokens shouldn't live forever.
- Monitor and log. Track what each identity does, and tie it back to a human or system owner who is accountable for it.
- Treat agent identity as first-class. As AI agents arrive, give them the same scoped, logged, owned identities you'd want for any other actor in the environment.
Non-human identity is one piece of a larger shift: banks are deploying AI agents faster than they can govern them. For the full read on what the 2026 CSA survey found and how to close the gap, see Financial Firms Are Deploying AI Agents Faster Than They Can Govern Them. For how this plays out in practice, see Private AI for Banking & Finance.
See governed agents in action
Book a short demo and watch AI agents act under scoped identity and full audit logging, with no data leaving your network.
Request a Demo