One million three hundred fifty thousand identities. Two hundred fifty working days. Five thousand four hundred per day. One every 5.33 seconds.
I ran that division on a Tuesday, after reading a report arguing that a 30,000-employee agent rollout implies 1.3 million non-human identities. The report is careful. It cites real research. It lands on a genuine problem. It also never performs this one calculation. Neither did anyone quoting it.
Because the moment you do, the governance layer the report is defending collapses on its own arithmetic. No access review committee on earth clears 5,400 identities a day. Not at a 5.33-second cadence. Not with zero remediation time. Not at any headcount.
The number is not the scandal. The number is the receipt.
Context: where the multiplier actually comes from
The claim chain is short and traceable. A CSA whitepaper cites Entro Security research establishing that enterprise environments carry 45× to 144× more non-human identities than human ones. Multiply 30,000 seats by that band and you get 1.35 million to 4.32 million. Layer on an Okta survey — 96% of executives confident in their non-human identity governance, 34% applying controls to "digital labor" equivalent to what they apply to humans, 58% reporting an identity-related incident in the past year — and the narrative writes itself: agents are arriving, identities are exploding, buy the tool.
The report's own supporting case undercuts it. A Fortune 500 financial institution is cited at 4.2 million non-human identities against 50,000 human accounts. That is 84:1. The institution disclosed no agent deployment at all. No pilot, no rollout, no seat multiplier. Just a ratio.
I have spent nine years enumerating accounts on public ledgers, where enumeration is free and every account is visible before you decide whether to trust it. That background makes this particular claim easy to test, because the arithmetic is not ambiguous. It is only unexamined.
The attribution break: a stock re-labeled as a flow
The 45× is an environment property. It is a stock. It predates agents by a decade. Service accounts, database logins, API keys, machine certificates, OAuth applications attached to every SaaS integration — that is where 45× lives. None of it is generated by a rollout.
A 30,000-seat agent deployment does not create 1.3 million new identities. It forces the first honest enumeration of an identity asset that has been on the books since the first SaaS contract was signed and has never once appeared in a procurement document. The report writes down discovered debt as new debt. Right direction, wrong mechanism.
The distinction is not academic. It changes the remediation path entirely. If the multiplier is a flow, you slow the rollout. If it is a stock, you revoke idle OAuth grants — a zero-cost action nobody wants to propose because it does not generate a purchase order.
The spread inside the claim should have disqualified it as a planning input. 45× and 144× differ by 3.2×. That is not an estimate. That is a band wide enough to contain a 1.35 million outcome and a 4.32 million outcome, which are not the same budget, not the same architecture, and not the same risk. Any CFO signing against a ±3.2× interval is signing a guess with a decimal point.
Static credentials are not agent identities, and conflating them is expensive
The report's sharpest data point is that 47% of non-human identities have not been rotated in over a year. It then uses that number as evidence of agent risk. It is evidence of something else: legacy static debt.
Service accounts are long-lived static secrets. Agent identities should be the opposite — short-lived, delegable, authorized per action, scoped to a single resource. The correct primitives already exist and are boring: OAuth 2.1 Token Exchange for on-behalf-of flows, SPIFFE-SPIRE SVIDs for workload attestation, Vault-style dynamic secrets with TTLs measured in minutes. None of these were designed for agents. They were designed for exactly this failure mode.
Agents must not inherit the 47%. If you issue a service account to an agent because it is the path of least resistance, you have not solved the identity problem. You have replicated a decade-old failure mode at a scale that has never been stress-tested.
I have seen this pattern before. In 2021, I mapped 450 interconnected wallets executing circular trades across more than 150,000 Bored Ape transactions. The volume was real. The demand was manufactured. The mechanism was not fraud at the transaction level — every trade settled. The fraud was in the metric everyone had agreed to trust. Non-human identity counts are the same kind of metric. Accurate, verifiable, and answering the wrong question.
5.33 seconds: human access review is arithmetically dead
This is the inference the report should have made and did not. Run it plainly.
1,350,000 identities divided by 250 working days equals 5,400 identities per day. An eight-hour day is 28,800 seconds. That is 5.33 seconds per identity, sustained, with no breaks, no context switching, no remediation window, and no re-review of anything that fails.
No access review process in existence operates at that cadence. Traditional IGA quarterly reviews do not. SOX access recertification does not. The entire human-in-the-loop control model terminates at roughly three orders of magnitude below this volume.
Which means every control architecture that depends on a human reading an entitlement list and deciding is not weakened at this scale — it is void. The only structurally viable answer is policy-as-code with attestation-based authorization and short TTLs that expire identities automatically rather than reviewing them manually.
I built a similar instrument once. In 2020, I simulated 10,000 liquidation events against Aave v1's interest rate model in Python and found an edge case in utilization rate calculation that would have produced $2.4 million in unsustainable debt. The finding was not exotic. It came from running the numbers instead of discussing them. Identity governance is in the same position now. The math has been available the whole time. Nobody ran it.
Delegation depth, not identity count, is the actual attack surface
Here the report gestures at the right thing and stops one step short. It notes that agents acquire permissions at runtime and that multi-agent workflows produce second-scale identity lifetimes. Correct. Incomplete.
The engineering difficulty is not quantity. It is lineage. A real workflow looks like this: user delegates to orchestrator, orchestrator delegates to sub-agent, sub-agent calls a tool. Four hops. If each hop does not converge permissions — narrow, not inherit — the effective privilege at the terminal call is the union of four permission sets. Depth four without convergence is not four times the exposure. It is a composite identity nobody designed and nobody owns.
This is precisely the problem the wallet ecosystem already solved, and it is instructive. ERC-4337 session keys, EIP-7702 delegation designators, scoped allowance modules on Safe — the mature pattern is a short-TTL key with a hard spending cap, a target allowlist, and a selector restriction. The delegation is explicit, bounded, and revocable. Agent frameworks that ship unscoped credentials have not learned this lesson, and they are building the same four-hop union of permissions on top of an identity model that was never designed to converge.
Second-scale identities without per-action authorization and lineage records do not reduce risk. They manufacture millions of audit trails with no owner attached. That is not a smaller problem than long-lived credentials. It is a harder one, because at least a static credential has a name on it.
The cost nobody is pricing: identity event volume
Follow the arithmetic forward. If 30,000 seats generate 600,000 agent actions per day, and each action emits at minimum three identity-relevant events — issuance, authorization decision, resource access — that is roughly 1.8 million identity events daily. Several gigabytes per day of pure governance exhaust.
That has three consequences the report never touches. Per-event human review is impossible by construction. SIEM licensing, which bills on events per second or gigabytes ingested, becomes a first-order line item. And forensic retention windows must be redesigned, because the investigation window and the retention budget are now the same number.
Here is where my day job gives me an unfair view. On a public chain, the identity event and the transaction are the same object. Enumeration is free. Every account, every grant, every delegation is visible before you decide anything. Enterprises do not have that. They pay for discovery because discovery is genuinely hard in a system that was never designed to be observed.
But the inversion is real and nobody prices it. On-chain, you get inventory for free and pay for indexing. In the enterprise, you pay for inventory and get indexing nearly free. The total cost is not lower in either model. It is merely relocated — and relocation is invisible to a budget line that has never been itemized.
The pricing-unit war underneath the technical argument
The report is nominally about identity governance. It is actually about what gets invoiced.
A seat is a billable unit. It maps to a headcount, renews predictably, and has near-zero marginal cost. An identity fleet is not billable in that model. If a buyer accepts that every seat carries a multiplier, the denominator of the entire agent commercial model is replaced, and vendor gross margin gets recomputed from scratch.
Run the order of magnitude. At $3 to $15 per identity per year for NHI security and IGA tooling, 1.35 million identities is $4.0 million to $20.3 million annually. At the 4 million ceiling, $12 million to $60 million. That is not a deployment cost. That is a new budget category opened outside the existing contract, and for a 30,000-employee organization it is typically one to three times the entire IAM team budget.
The willingness-to-pay signal is already inside the survey data. 96% confidence against 34% control parity against 58% incident rate is a 62-point gap between what buyers believe and what they do. That gap is the measurement of money already being spent — not on the tool, but on the incidents that occur without it.
The ceiling is set by open source. SPIFFE/SPIRE under CNCF, Vault-style dynamic secrets, the OpenBao ecosystem — all cover a meaningful share of short-lived machine identity needs at zero license cost. Issuance is commoditized. What remains defensible is discovery, ownership graphing, and offboarding automation, which is exactly why the report keeps returning to the phrase "nobody owns it." Only 20% of organizations have a formal deprovisioning process. That is the moat, and it is a moat made of organizational failure rather than technology.
Discount the effect size, keep the direction
The evidence chain is vendor-produced end to end. Entro Security sells NHI security. Its research becomes a CSA whitepaper. Okta sells IAM and is shipping an Agent ID product line. Its survey produces the 96/34/58 numbers. The entity manufacturing the fear data is the entity selling the remedy.
That does not make the problem false. It makes the effect size suspect. My estimate, from the environments I have actually queried, is that 45× is a cloud-native, integration-heavy ceiling. Most non-cloud-native enterprises sit closer to 8× to 20×. The direction holds. The magnitude is inflated by a factor I would not sign a contract against.
And two data points deserve more weight than they received. 16% of organizations do not track non-human identities at all. 51% have no clear ownership assignment. Together that means roughly two-thirds of agent identity inventory sits in a state of no observation or no accountability. When an incident lands in that two-thirds, the attribution chain is already severed. Post-hoc accountability is not difficult in that environment. It is unavailable.
The contrarian read: cutting the count makes you less safe
Identity count is not a risk metric. It is a proxy that happens to be easy to count, which is why it wins arguments and loses audits.
The actual risk function is an integral, not a tally. Risk scales with privilege times reachability, integrated over lifetime. Four million identities with sixty-second TTLs and single-resource scope can present a narrower exposure window than fifty thousand human accounts with standing administrator rights and no second factor. The report never makes this distinction, and its implicit policy recommendation — reduce the identity count — is therefore capable of making buyers measurably worse off.
Because the fastest way to reduce a count is to consolidate scopes and reuse credentials. Both actions raise the privilege attached to each remaining identity. That is negative optimization dressed as hygiene. The 47% figure does not point at count. It points at lifetime. Those are different diseases with different treatments.
There is a crypto-native version of this same error, and I see it constantly in bear-market research. The assumption that transparency produces accountability. It does not. On-chain visibility solves inventory. It says nothing about lineage, intent, or who authorized the fourth hop in a delegation chain. A public ledger will tell you an identity acted. It will not tell you who it was acting for.
And the token layer will price the narrative, not the audit line item. Correlation between agent rollout announcements and identity-governance token performance is exactly the kind of correlation that survives right up until it doesn't. Correlation is not causation. It is not even a good proxy.
Takeaway: three signals to watch next week
First, watch for the first RFP that prices on managed identity count rather than seats. That clause is the moment the multiplier stops being commentary and becomes a contract term.
Second, watch session key TTL distributions on smart accounts. That is the closest thing to a public governance-maturity metric we have, and it is free to query.
Third, watch the observability and indexer cost line, not the GPU line. The multiplier is not paid at inference. It is paid at logging.
Nobody quotes the denominator. That is the silence of an unaudited ledger. Logic is the only audit that never expires.