Survey finds 109 machine identities per human, with most retaining standing privileges

A recent industry survey highlights a critical imbalance in identity management, revealing that organizations maintain an average of 109 machine identities for every single human identity. Palo Alto Networks gathered this data from more than 2,900 security leaders for its 2026 Identity Security Landscape report, underscoring the scale of non-human account proliferation.

The report indicates that 61% of privileged access requests are still satisfied through standing privileges instead of being granted on demand. This reliance on permanent access contradicts modern security best practices that advocate for just-in-time permissions. The persistence of these accounts creates a large attack surface that is difficult to monitor and control effectively.

The problem of aging service accounts

Machine identities often outlive the engineers who created them, leading to accounts with unclear ownership and excessive permissions. In many environments, the original creator has left the organization, leaving passwords stored in vaults or plain configuration files. These accounts frequently retain permissions sized for past migrations, which current teams avoid modifying for fear of breaking legacy systems.

Entro Labs analyzed the age distribution of these identities, finding that close to half were more than a year old. Furthermore, 7.5% of the reviewed identities had existed for between five and ten years. This longevity means that credentials remain valid for extended periods, often without regular review or justification for their continued existence in the current infrastructure.

Real-world consequences of standing privilege

The risks associated with standing machine privileges were illustrated by the Salesloft Drift campaign in August 2025. Google Threat Intelligence Group reported that the threat actor known as UNC6395 exploited stolen OAuth and refresh tokens linked to the Drift integration. The attackers used these tokens to exfiltrate data from Salesforce customer instances between August 8 and August 18, affecting more than 700 organizations.

Standard security measures like password rotation do not eliminate the risk of standing privileges. While rotating a service account password is better than hard-coding it, the credential remains valid with full permissions until the next change. If an attacker steals the credential early in a rotation cycle, they may have weeks or months to operate undetected, especially with OAuth integrations that can auto-renew access.

What should you do?

Security leaders should audit their machine identities to identify accounts with unclear ownership or excessive permissions. Organizations should move away from standing privileges by implementing just-in-time access models where possible. Monitoring for unusual activity on service accounts is essential, particularly those with long-term validity or broad access rights.

Background: OAuth

The difference between OAuth and API key lies in identity and scope. An API key acts as a static password identifying a project or client to a system. OAuth is an authorization framework that allows third-party applications to obtain limited access to user accounts without exposing credentials.

Read the full guide: Difference Between OAuth and API Key and How to Choose

What to do and how to stay safe: Palo Alto Networks

• Inventory all machine identities to determine ownership and verify that permissions align with current operational needs.
• Replace standing privileges with on-demand access grants to limit the window of exposure for service accounts.
• Monitor OAuth integrations and refresh tokens for unauthorized usage or unexpected renewal patterns.
• Review configuration files and scripts to ensure credentials are not hard-coded and are properly secured in vaults.

Step-by-step guide: Password Rotation Checklist: When to Change and When to Stop

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many machine identities exist per human identity according to the survey?

Palo Alto Networks found an average of 109 machine identities for every human identity in its 2026 survey.

What percentage of privileged access requests use standing privileges?

The report states that 61% of privileged access requests are met with standing privileges rather than on-demand grants.

How long do many machine identities remain active?

Entro Labs found that nearly half of machine identities are older than one year, with 7.5% lasting five to ten years.