New survey data on identity threats points to a gap that has less to do with cryptography than with calendars. The 2026 SANS Identity Threats and Defences Survey finds that 76 percent of organisations report growth in non-human identities, including service accounts, API keys, automation bots and workload identities. It also finds that 92 percent are failing to rotate credentials on a 90-day cycle, and that 59 percent rotate fewer than half of their non-human identity credentials quarterly. Fifteen percent of respondents do not know their own rotation rate.
That 59 percent is the number worth sitting with. It describes a majority of enterprises where the majority of machine credentials are effectively permanent. Not because anyone decided permanent access was acceptable, but because rotation is treated as a change to production rather than a change to identity.
The availability argument always wins
Rotating a machine credential is a coordination problem. A service account password is baked into a deployment manifest, a CI pipeline, a scheduled job and a vendor appliance, and possibly into three scripts nobody has opened since the last reorganisation. When rotation breaks an integration, the failure is immediate and visible. When rotation is skipped, the risk is deferred and invisible. Given that trade, teams choose uptime almost every time, and SANS attributes the pattern directly to fear of breaking service accounts. The consequence is a class of identity with privileged access, no expiry pressure and no human habit of review.
Agents make the old compromise untenable
The survey also finds that 74 percent of organisations are deploying AI systems with credentials and access permissions that let them operate autonomously, often against critical infrastructure and data. Unlike conventional non-human identities that execute fixed logic, agents interpret instructions and can take non-deterministic actions. A service account performing an unexpected action is a bug. An agent performing an unexpected action is the design. That difference means a stale, over-permissioned credential is no longer merely a latent risk; it is standing authority that something reasoning can exercise.
Safeguards exist, but coverage is thin
Approvals, sandboxing and audit trails are all available. None is used by more than 40 percent of organisations, according to the research, and human-in-the-loop approval sits at roughly four in ten. That leaves a majority of agent deployments without any single control that would bound the blast radius of a wrong decision. The pattern is familiar from earlier waves of automation: the identity layer is retrofitted after the business value is proven, which is precisely the wrong order.
What a credible rotation programme looks like
The organisations making progress tend to start with ownership rather than tooling. Every machine credential gets a named owner and a business service, so rotation has a person to notify and a rollback path to follow. Credentials are moved into a vault with short lifetimes and issued at runtime, which converts a yearly change event into a continuous background process. Workload identity federation replaces static secrets wherever a platform supports it, removing the secret entirely. Expiry is monitored centrally, so an unrotated credential surfaces as an alert rather than an incident. None of this is novel. What is new is the volume: machine identities now outnumber the humans who are supposed to govern them by an order of magnitude, and calendar-based review of a population that size simply does not happen.