More than 150 identity, security, and technology leaders gathered for Kocho's Microsoft Identity Security Summit, where experts from Microsoft and the UK-based identity security partner worked through the governance risks introduced by AI agents, automated services, and the broader class of non-human identities now embedded in enterprise environments.
The headline figure from the day: non-human identities can outnumber human ones by 144:1 in large organisations. IDC forecasts 1.3 billion AI agents in enterprise use by 2028. Almost half of existing non-human identities have no clearly assigned owner, meaning that when a project ends, an employee leaves, or a service is deprecated, the access those identities held can persist unmonitored.
Microsoft Chief Security Advisor Lesley Kipling's keynote set the operational stakes: the time to infiltrate an enterprise environment can now be measured in seconds. That compression makes continuous detection as important as prevention. Every unowned identity that retains access to sensitive data represents not just a governance lapse but a live exposure.
The summit's sessions on data protection and insider risk connected the two problems. As AI agents, connectors, and automated workflows gain access to enterprise information, they inherit the data permissions of the identities that run them. A poorly governed service account is, in an agentic environment, a potential route to content it was never meant to reach.
"Organisations are now governing access for employees, AI agents, automated services and a growing population of non-human identities. Each needs the same level of visibility, accountability and control. AI adoption is moving quickly, and governance needs to keep pace."
— Steve Jones, CTO, Kocho
The social engineering dimension adds pressure. Deepfakes, voice cloning, and more convincing phishing are making credential theft harder to catch in real time. For environments where a single compromised identity can chain through agent permissions, detection and response capabilities need to be as tightly scoped as access controls.
Kocho operates as an identity-centric Microsoft security and cloud partner, with offices in London, Cardiff, and Cape Town.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
