Article · Posture Management
Confidence is not evidence: non-human identities in a 2026 survey
In one 2026 survey, 82% of respondents said they were very confident they could discover non-human identities (NHIs) with access to production systems. 30% said they validate NHI and AI agent usage in real time.
Both figures are self-reported and answer different questions. They show where to ask for evidence. They do not show how many organisations are failing.
What the survey reported
The survey was commissioned by a vendor in the identity security market and run by a polling firm. It covered 2,001 IT decision-makers in the UK, US, Germany, France, Australia, Singapore and India. Every respondent was using or piloting AI, so the results do not describe organisations that are not.
An NHI is an account or credential used by software rather than by a person, such as a service account, a bot or an AI agent.
The report presents the contrast between the two results as the “AI security confidence paradox”. They come from different questions in the same survey.
How to read the gap
- Both figures are self-reported. They record what respondents said, not what was tested in their environments.
- They answer different questions. One records confidence in discovery. The other records a specific practice: checking usage in real time. A high score on one and a lower score on the other does not make the first answer wrong.
- They are not shown per respondent. The report gives the two figures separately, so we cannot say how many confident organisations also validate.
- Real time is a high bar. An organisation that compares its inventory with its environment every month may not count as validating in real time, yet may still hold good evidence.
A common pattern
A common pattern is that discovery is treated as a finished task. A list is produced and trusted, and it is not compared with the environment again until a review or an audit asks for it.
What helps
Posture management starts from evidence rather than belief. For non-human identities, we suggest writing down four things: what counts as discovered, who owns the inventory, how often it is compared with what the environment shows, and what record each comparison leaves.
Where the answer to any of these is unclear, that is the first gap to close.
Confidence describes what a team believes. Evidence is a dated record that can be checked.
Can you show the date of the last comparison between your list of non-human identities and what your environment shows, and who signed it off?
Source: Delinea, 2026 Identity Security Report: Uncovering the Hidden Risks of the AI Race, March 2026, pages 3, 6 and 7. The survey was commissioned by the publisher and run by Censuswide. Summarised in our own words. We are not affiliated with the publisher.
This article is general information. It is not legal, audit or compliance advice.