On May 19th, 2026, Orchid Security released the results of our Identity Gap: Snapshot 2026. Among the findings, “identity dark matter” (the unseen, unmanaged elements of identity) now overshadows the visible elements 57% vs. 43%.  And it couldn’t have occurred at a worse time, with enterprises embracing Agent AI with both arms (and unfortunately, as Orchid co-founder Robert Wiseman explains, more than one eye closed). 

AI agents are shortcut-seekers by design.  When given a task, they are trained to find the most efficient way to complete it, with the speed of machines and the creativity of humans.  Denied access to a necessary system?  Use a hard-coded credential stored in plaintext within the application.  Need information they aren’t entitled to read?  “Borrow” a credential with higher privilege.  Constantly being challenged across many different systems?  Grab a broadly accepted token.  Truly, Agent AI’s creativity is remarkable.  It just cuts both ways.

Just because an AI Agent can find a way to access an application, a system, a database, doesn’t mean that they should do so.  But where coding would restrict a traditional nonhuman actor and conscience should give a human pause, in most cases, AI Agents have no such constraints or compunctions.

That’s why well-managed identity and access management is a critical foundation to keeping Agent AI activity within authorized bounds.  Look no further than the cloud outages reported at the start of the year to understand this importance.

Of course, IAM shortcuts, gaps, and exceptions have built up over the years.  Even decades.  So it’s not reasonable to expect everything to be cleaned up at once.  That’s why the findings from this year’s Identity Gap Snapshot- the exposures most common across North American and European enterprises- are so important and timely.

Those are just a few highlights from the full Identity Gap Snapshot.  We encourage you to read the full report.

If you are uncertain about how to address these (and similar) issues within your organization, or even how prevalent each one might be in your environment, our security researcher team has also published an Identity Security Readiness Checklist.  If your organization is preparing for (or already participating in) the Agent AI transformation, the time to act is now.