Pricing a Ghost Agent: What an Orphaned Identity Costs

Published figures for what an abandoned AI agent costs an organization are averages of somebody else's environment. IBM's 2025 breach research puts a high level of shadow AI at an extra six hundred and seventy thousand dollars on top of a global average breach cost of four and a half million, and vendor research offers larger headline numbers with thinner methodology behind them.

‍

None of those figures is your number, and quoting one to a finance function invites the obvious question of how it applies here. What follows is the method for producing your own, and one property of orphaned agents that makes the arithmetic different from most security exposures.

‍

Part of the Cost Is Certain

‍

Almost every security exposure is contingent. A weak control costs nothing until somebody exploits it, so the expected loss is a probability multiplied by an impact. An abandoned agent breaks that pattern, because it can go on consuming resources with no attacker involved at all.

‍

Consumption Does Not Wait for an Attacker

‍

An agent left running against a scheduled trigger continues calling models, invoking tools and holding licensed seats. Agentic workflows consume dramatically more per session than a simple assistant interaction, and one common inefficiency compounds it, where a stateless agent re-sends the same large context on every invocation and the organization pays for the identical data repeatedly. The consumption is not a risk. It is a bill, and it is knowable exactly from usage telemetry rather than estimated.

‍

The Contingent Half Behaves Normally

‍

The breach pathway follows standard expected-loss arithmetic, being the likelihood that a dormant credential is discovered and used, multiplied by what it reaches. Both halves belong in the same figure, and separating them matters when presenting it, since a finance audience treats a certain cost and a probabilistic one very differently.

‍

What the Published Numbers Are Good For

‍

Industry figures work as calibration and as an argument for doing the exercise. They do not substitute for it.

‍

The IBM research is worth reading closely for one finding in particular. Among organizations reporting an AI-related breach, ninety-seven percent said they lacked proper AI access controls. The finding describes the population of victims rather than about cost, and it tells you the exposure concentrates heavily in environments without access governance rather than spreading evenly. If your agents have owners, scopes and expiry, the averages overstate your position. If they do not, the averages probably understate it.

‍

Estimating How Often It Happens

‍

Frequency comes from three numbers you can measure rather than from a benchmark.

‍

• Population: How many agent identities exist with no current owner, no expiry and recent authentication activity.
• Persistence: How long a credential typically remains valid after its purpose ends, measured from your own records rather than assumed.
• Reachability: What proportion of those credentials are usable from outside your network perimeter.

‍

The third is the one that separates a housekeeping problem from a security one. An orphaned service account reachable only from inside a segmented network carries a different likelihood from an API key that works from anywhere with an internet connection. Programs that have already run the revocation exercise will have most of these numbers already, and controlling agent sprawl supplies the population count.

‍

Severity Comes From Scope, Not From the Agent

‍

Two abandoned agents can look identical in a register and differ by orders of magnitude in exposure. What matters is not the agent but the union of everything its credentials still open.

‍

Scoring severity therefore means enumerating reach rather than assessing the agent. Which data stores it can read, which systems it can write to, whether it holds a token for a third-party platform, and critically whether it could retrieve secrets from a shared vault. The vault question is a multiplier rather than an addition, since an agent that could read a vault carries the exposure of everything in that vault rather than its own.

‍

Delegated Authority Widens the Blast Radius

‍

An agent operating under a person's delegated permissions inherits whatever that person could reach, including access granted after the agent was abandoned. The exposure grows over time without anybody touching the agent, which is a property worth modeling explicitly rather than treating the scope as fixed at creation. Chains where one agent calls another extend the reach further still.

‍

The Cleanup Cost Nobody Budgets

‍

A third cost arrives on discovery rather than on exploitation, and programs consistently omit it. Finding an orphaned agent with broad access triggers work whether or not anything was compromised.

‍

Anything it could have retrieved from a shared secret store needs rotating, which cascades into every system depending on those credentials. Logs covering the period the credential was live need reviewing to establish whether it was used, and that window is frequently measured in months. Where regulated data was in reach, a determination has to be made about whether a notifiable event occurred, which pulls in legal time. None of that requires an attacker, and all of it is budgetable.

‍

Investigation Cost Scales With the Unknown

‍

The forensic burden is driven by how much you cannot rule out. An agent with narrow, well-recorded scope is cheap to rule out. One with broad permissions and no activity logging costs considerably more, because the investigation cannot bound what happened and has to assume the worst reachable case. Recording agent activity is therefore a cost control as much as a detection control, which behavioral monitoring in production already produces, which is part of why an audit trail pays for itself outside of compliance.

‍

Turning the Figure Into a Decision

‍

The point of the exercise is comparison rather than alarm. Set the annual figure against the cost of the controls that would remove it, being automated expiry, ownership records and a retirement workflow.

‍

Those controls are inexpensive relative to almost any credible exposure estimate, which usually makes the decision straightforward once someone has done the arithmetic. Where the estimate lands below the cost of the fix, that is a legitimate finding rather than a failed analysis, and it argues for a narrower intervention on the highest-scope agents rather than a program. Deciding what counts as one agent affects the count and therefore the total, so state the unit alongside the figure.

‍

Report the Certain Cost First

‍

Consumption waste is the part of this that needs no probability, no model and no debate about assumptions. Leading with a measured monthly figure for compute and licensing spent on agents nobody owns tends to secure attention that a risk estimate does not, and the security argument lands more easily once the finance argument has.

‍

Where the Estimate Misleads

‍

Three cautions, because this arithmetic is easy to overstate.

‍

Industry averages carry survivor and reporting bias, since they describe organizations that detected and disclosed an incident. Consumption figures can be inflated by counting agents that are dormant rather than running, so measure actual invocations rather than existence. The severity side also depends on a reach analysis that is itself an estimate, so an exposure figure quoted to the nearest thousand implies precision the method does not have. Report a range, name the assumptions, and revisit when the scope data improves.

‍

Measure Yours Rather Than Quoting Theirs

‍

An abandoned agent is unusual among security exposures because part of its cost arrives with certainty and no attacker required. Consumption is measurable today, the breach pathway follows ordinary expected-loss arithmetic, and the cleanup cost lands on discovery regardless of whether anything was exploited. Severity comes from what the credentials still reach rather than from the agent itself, so two identical-looking entries in a register can differ enormously. Kovrr's AI risk quantification produces that figure against your own asset population, which is the version a finance function will act on.

‍

To see modeled exposure for the agents in your environment that have no owner and no expiry, book a demo mapped to your own estate.