ACCORDING to Orchid Security, the Identity Gap Snapshot 2026 released on 19 May 2026 highlights growing concerns as enterprises adopt Agent AI, with identity dark matter now accounting for 57% of identity and visible elements 43%. The findings underline that AI agents can access systems if allowed, making well‑managed identity and access management (IAM) a critical foundation for staying within authorised bounds.
The top three findings include invisible non‑human accounts, with two out of every three nonhuman accounts set up locally in the application itself; excessive permissions, with 70% of applications having an excessive number of privileged accounts; and orphan accounts, with 40% of accounts across enterprise environments outliving their authorised user.
The article warns that these unmanaged identities are ripe for exploitation by threat actors and AI agents alike, and it emphasises the need for stronger IAM controls as organisations navigate the Agent AI transformation. It also points readers to read the full Identity Gap Snapshot and related resources for improving security posture in this evolving landscape.