Machine identities now outnumber human ones 109:1 in the average enterprise, with AI agents as the fastest-growing category. Three enterprise authentication trends are examined with sourced data: (1) AI agent identity — 88% of organizations had an agent-related security incident yet only 21.9% treat agents as independent identities; (2) OAuth 2.1 — still an IETF Internet-Draft (draft-ietf-oauth-v2-1-15), not a ratified RFC, though its practices (mandatory PKCE, no implicit grant, exact redirect URI matching) are implementable today under OAuth 2.0; (3) Passkeys — 5 billion in active use globally, 68% of enterprises deploying them, but only 28% have achieved full workforce passwordless despite 82% calling it a goal. Practical advice: give every AI agent its own credential and audit trail, apply OAuth 2.1 security practices now without waiting for ratification, and offer passkeys as one option in a broader auth stack rather than forcing a hard cutover.
