The Revocation Test

The security questionnaire your portfolio company passed last quarter assessed its people carefully and its machines only barely. It counted employees and contractors. A growing share of the standing access to source code, infrastructure, and production data now belongs to service accounts, API keys, OAuth grants, and agent credentials that got a fraction of the same scrutiny.

Two of Gartner's six cybersecurity trends for 2026 concern AI agents. One addresses agent oversight. Another calls for identity and access management to adapt to "machine actors," explicitly naming credential automation and policy-driven authorization.

A population shift sits under that trend and predates it. KuppingerCole's 2025 Leadership Compass on non-human identity management argues that machine identities now outnumber human users and need governance models distinct from the joiner-mover-leaver tooling built for people. A 2026 Cloud Security Alliance paper puts numbers on the gap: roughly 45 non-human identities per human on average, rising as high as 144 to 1 in cloud-native environments. IBM's 2025 Cost of a Data Breach report, conducted by Ponemon, found that among organizations reporting a breach of an AI model or application, 97% said they lacked proper access controls on it.

Here is what that does to a hold period. A company under pressure to ship AI features creates non-human identities every sprint: a deploy account for the new pipeline, an integration token for a partner API, an agent credential for last month's automated workflow. Each one carries standing privilege.

The access-governance story management tells the board is usually strongest around people: joiners, movers, leavers, single sign-on, and periodic user recertification. Its coverage of service accounts, OAuth grants, workload identities, and agent credentials is far less complete. The machine population grows in that gap, uninventoried and unowned, until something forces it into view.

One path is a breach that runs for months because a leaked key had broad access and nobody was watching it; IBM put the average breach lifecycle at 241 days in 2025, and every extra month of dwell time compounds the loss. The other path is a technical diligence walkthrough at exit, where the company is asked to account for identities it never tracked. The breach surfaces as an incident cost; the diligence gap surfaces as a re-priced deal or a remediation holdback. Both land on enterprise value, and neither appears in the quality-of-earnings file.

The mechanism explains why teams with clean audits are exposed anyway.

Many service accounts start as an emergency fix at 11pm. A deploy pipeline keeps failing on a permissions error, the on-call engineer widens the account's role until the build goes green, and the ticket closes. The broad grant never gets scoped back, because scoping it back risks breaking the pipeline again and nobody is measured on the cleanup. Multiply that across integrations, scheduled jobs, and the agents that fan out to internal APIs to finish a task. The OAuth tokens wired into third-party SaaS rarely expire, and the keys sit in a secrets manager that rotates the storage without touching the underlying grant.

Then the engineer who created the account leaves. Human offboarding runs cleanly: the SSO account is disabled, the laptop is wiped, the access review checks its box. The service account keeps running with its standing admin role and no living owner, invisible to any access review centered on workforce identities, because it never entered the joiner-mover-leaver process to begin with.

In a technical walkthrough I run a test the data room rarely prepares a company for: pick a single non-human identity at random and ask the team to name its owner, state its privilege scope, and revoke it while we watch. The pause before anyone answers is the finding. It separates a company that governs its machine identities, which produces the owner in seconds and the revocation in minutes, from one that keeps a policy saying it should and then explains why the credential cannot be turned off without risking production.

For any non-human identity with access to production, the company answers four questions on the spot:

The test produces two outputs. The first is inventory confidence: whether the company can show that its count of production identities is materially complete, and how it validated that. The second is the governed-identity ratio: the share of discovered identities with a named owner, an appropriate privilege scope, and a tested revocation path. A high ratio means little when inventory confidence is low, because the identities most likely to hurt you are the ones nobody counted. A first pass often returns a lower figure than prior access reviews would suggest, because those reviews concentrated on human identities.

Inventory before you buy. The market will sell you a machine-identity governance platform. Commission the inventory first: service accounts, API keys, OAuth grants, and agent credentials, each tagged with an owner and a privilege scope. The count is the diligence. Buy tooling against a number you already understand rather than as a substitute for understanding it.

Fold non-human identities into the recertification cadence people already sit in, and have the CTO report the governed-identity ratio as a standing KPI, the way uptime or gross retention gets reported. What earns a line on a board slide earns an owner.

Add the Revocation Test to technical diligence on every add-on. A failed test is something to price rather than a reason to walk. Price the remediation into the deal, establish a holdback, or make it a closing condition. Stop letting the gap pass unpriced because the security questionnaire came back green.

97%. Among organizations that reported a breach of an AI model or application, the share that said they lacked proper access controls, according to IBM's 2025 Cost of a Data Breach report. Companies are deploying AI authority faster than they are building the controls to constrain and revoke it.

Portco Brief translates one technology signal a week into an enterprise-value decision for operating partners and portfolio CEOs, CFOs, COOs, CTOs, and Technology Leaders. Forward it to the operator who keeps saying the audit came back clean.

Subscribe at portcobrief.com.