Every October, security awareness campaigns quite rightly return to people. We remind employees to be suspicious of unexpected requests, protect their credentials, question unusual MFA prompts and think carefully before giving an application access to company data.
I still believe that work is essential, but the definition of who, or what, needs to be secured has moved well beyond the employee directory, writes Brendan Maccarron, business unit team lead: Palo Alto Networks at Westcon-Comstor Sub-Saharan Africa.
One number from Palo Alto Networks’ 2026 Identity Security Landscape stopped me when I first saw it. Machine identities now outnumber human identities in the enterprise by 109 to one. The same research, based on responses from 2 930 cybersecurity leaders, found that nine in ten organisations had experienced a successful identity-related breach in the previous 12 months.
That creates an awkward question for Cybersecurity Awareness Month. We can train a person to recognise a suspicious email, but a service account, API key, workload or AI agent is a very different proposition, and these identities increasingly sit inside the same business processes with access to the same sensitive systems.
The workforce is bigger than the org chart
For years, identity security largely meant making sure the person logging in was who they claimed to be and had access to the right things. Yes, that is still important, although organisations now rely on vast numbers of non-human identities created by cloud services, applications and automation.
AI agents add another dimension because they can act, not just connect. They can retrieve data, call applications and complete work on a user’s behalf. In my conversations with customers and partners across Sub-Saharan Africa, I see organisations at very different stages of this journey. Some are already putting agents into production, while others are still deciding where AI belongs in the business. What they have in common is that automation can create access far more quickly than traditional governance processes were designed to manage.
Palo Alto Networks’ research found that 99% of surveyed organisations had adopted AI agents and that 40% of those agents had access to organisational data. Once agents begin touching company information and taking actions across business systems, machine identity stops being a future security problem.
A legitimate login can still be an attack
The 2026 Unit 42 Global Incident Response Report found that identity weaknesses played a material role in nearly 90% of investigations and that identity-based techniques accounted for 65% of initial access.
An attacker using stolen credentials, a hijacked session or an exposed machine identity may not look obviously malicious at first because the activity can arrive through access the organisation itself has already authorised. Security teams therefore need enough context to understand what an identity normally does, what it should be allowed to do, and whether its current access still makes sense.
In my view, this is where some security awareness programmes are still working with an old mental model. Enormous effort goes into teaching people how to avoid becoming the way in, while considerably less attention may be paid to the permissions that already exist behind the login.
AI agents create an ownership problem
Human identities usually have an owner and some form of lifecycle. Somebody joins the business, changes role and eventually leaves, and there should be a process that changes their access along the way.
An AI agent may be created for a project, connected to several systems, given credentials, and then modified repeatedly as its role changes. Palo Alto Networks’ 2026 research found that only 37% of organisations could revoke an AI agent’s credentials and only 30% had immutable audit logging for agent activity. That points to a fairly basic governance problem because controlling an identity becomes extremely difficult when nobody can say with confidence who owns it, what it can reach or how quickly its access can be removed.
AI adoption is also happening outside formal projects. Verizon’s 2026 Data Breach Investigations Report found that employee use of unapproved shadow AI had tripled to 45%, another indication of how easily adoption can outpace the processes meant to govern it.
Awareness has to reach the people designing access
None of this means organisations should pull back from employee education. People still need to recognise phishing, protect credentials and challenge unusual requests. The change I would make is to stop treating Cybersecurity Awareness Month mainly as a communications exercise aimed at end users.
The people designing workflows, integrating applications, commissioning cloud services, and approving AI projects make security decisions every day, even when those decisions do not carry a security label. They determine what gets connected, which identities are created, what information an agent can reach and whether that access remains in place after the original need has passed.
For me, that is where the awareness conversation needs to go next. Organisations should still ask whether employees know how to spot a suspicious request, but the conversation now has to include how many identities operate across the business, who owns them and whether they have more authority than they need.
When machines outnumber people 109 to one, understanding who, or what, is working inside the organisation has become part of basic cybersecurity awareness.