Enterprise IT spend hit $4 trillion, but execution capacity lagged

At a glance

What this is: Arxan Technologies argues that 2025’s record IT spend exposed an execution gap, where cloud, AI infrastructure, modernization, and software investments outpaced organisational capacity.

Why it matters: For IAM, NHI, and broader security teams, the lesson is that governance must track delivery capacity and dependencies as closely as spend, or control drift and operational risk will compound.

Context

Enterprise IT spend is not just a budget question when the operating model cannot absorb the pace of change. This article frames 2025 as a year in which organisations funded cloud, AI infrastructure, modernization, and software at record levels, but execution capacity lagged behind the ambition, creating a governance problem across delivery, resilience, and dependency management. The primary keyword is execution capacity, because that is the real constraint the article is arguing about.

For identity and security practitioners, the relevance sits in how fast-changing environments alter access, oversight, and control boundaries. As cloud estates expand, AI outputs enter workflows, and modernization programmes reshape system interdependencies, IAM, PAM, and NHI governance have to adapt to a moving target rather than a stable architecture. That makes capacity planning a control issue, not only an operational one.

Key questions

Q: What breaks when transformation programmes outpace execution capacity?

A: Governance breaks first, because teams lose the ability to validate dependencies, absorb change, and keep controls aligned with the environment. That creates inconsistent approvals, delayed reviews, and control drift across cloud, AI, and modernization programmes. In practice, the issue is not only delivery speed but whether operating discipline can keep up with the scale of change.

Q: Why does parallel cloud, AI, and modernization work create operational risk?

A: Parallel work raises risk because each change can alter the assumptions behind other systems, including access paths, telemetry, service ownership, and workload behaviour. When those dependencies are not visible, a local change can create a broader failure or oversight gap. The more interconnected the environment, the less useful isolated project management becomes.

Q: How can teams tell whether adaptive planning is actually working?

A: It is working when decisions reflect current capacity, dependencies, and risk signals rather than stale programme assumptions. Signs include faster reprioritisation, fewer surprise downstream issues, and better alignment between delivery milestones and governance checkpoints. If teams still discover dependency problems late, planning is descriptive rather than adaptive.

Q: Should security and IAM teams prioritise capacity governance over adding more tools?

A: Yes, when the problem is not a missing product but an organisation that cannot absorb change cleanly. More tooling does not fix overextended teams, unclear dependencies, or control processes that lag the pace of transformation. Capacity governance should come first because it determines whether existing controls can operate effectively at scale.

Technical breakdown

Why execution capacity becomes the limiting control in compound transformation

Execution capacity is the organisation's ability to absorb change without losing governance, quality, or operational stability. In this article's model, the bottleneck is not capital availability but the rate at which teams can validate architecture, dependencies, telemetry, and control changes across parallel programmes. When cloud expansion, AI adoption, and modernization all advance together, the control problem shifts from approving initiatives to continuously reconciling their effects on one another.

Practical implication: Track delivery capacity alongside spend so transformation plans do not outrun control maturity.

How dependency sprawl changes risk in cloud, AI, and modernization programmes

Dependency sprawl emerges when one change influences many downstream systems, teams, and workflows. The article describes a shift from linear cause and effect to a web of interdependencies where a migration, AI-assisted output, or application update can reshape performance, visibility, or workload patterns elsewhere. That matters because the more distributed the environment becomes, the more governance depends on understanding coupled systems rather than isolated projects.

Practical implication: Map cross-programme dependencies before approving major platform, AI, or migration changes.

Why adaptive planning is a governance mechanism, not a project tool

Adaptive planning is the discipline of updating priorities from live operational conditions instead of fixed checkpoints. In this context, it is meant to connect strategic intent to current capacity, risk, and dependency signals so leaders can see how one initiative affects another. For identity and security teams, that same logic applies to access reviews, workload onboarding, and control changes, which must reflect the environment as it exists now, not as it was planned months earlier.

Practical implication: Use adaptive planning to align control decisions with current system state and delivery constraints.

NHI Mgmt Group analysis

Execution capacity is becoming a governance control, not a staffing metric. The article shows that organisations can spend aggressively and still fail to deliver if validation, oversight, and dependency handling do not scale at the same pace. That is a structural governance problem, not a temporary resourcing issue. Practitioners should treat capacity as part of control design.

Compound transformation creates control drift faster than most programmes can detect. When cloud, AI infrastructure, modernization, and software change in parallel, every team inherits more boundary conditions than it can manually track. That increases the chance that IAM, PAM, and NHI controls lag behind the environment they are meant to govern. The right response is to manage transformation as a continuously changing system.

Adaptive planning is the clearest named concept in this article, and it should be read as an assurance model. It is not simply a delivery framework; it is a way to keep commitments, dependencies, and risk decisions aligned with operational reality. For identity and security leaders, that means planning must reflect actual access patterns, service relationships, and control load. The practitioner conclusion is to make governance responsive to change, not retrospective.

Security teams will feel the pressure of this spend pattern through more integrations, not just more tools. As organisations add AI layers, cloud services, and modernised platforms, the attack surface becomes more distributed and the approval burden rises. Identity governance has to account for faster onboarding, more transient access, and more machine-mediated workflows. Practitioners should expect control complexity to increase even when budgets are rising.

The market signal is that transformation programmes are colliding with operational limits. That matters because identity security often becomes the place where those limits first show up: access reviews take longer, entitlements become harder to rationalise, and service-to-service trust expands faster than lifecycle oversight. The practitioner takeaway is to align governance cadence with delivery velocity before the gap turns into control failure.

From our research library:

• Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, and that 15% of day-to-day work decisions will be made autonomously.
• Read next: AI Infrastructure Workload Identity Guide

What this signals

Adaptive planning is now a security-relevant operating model. When delivery speed exceeds governance capacity, identity controls become brittle because they are calibrated to old system states. Security leaders should expect the biggest failures to appear where transformation meets ownership, access, and approval workflows, not only in the technology stack itself.

Execution capacity is the hidden variable in identity programme success. IAM and NHI initiatives often fail not because the design is wrong, but because too many parallel changes overwhelm the people and processes needed to maintain them. Teams that tie control cadence to change velocity will spot drift earlier and avoid compounding operational debt.

For practitioners

• Measure execution capacity alongside transformation spend Track how many major changes teams can validate, absorb, and govern per quarter, not just how much is being funded. Use the metric to slow or stage initiatives when dependency review, control testing, or access governance is already saturated.
• Build dependency maps for parallel change programmes Document which applications, data flows, identities, and services each initiative touches before it starts. Reassess those links whenever a migration, AI workflow, or platform consolidation changes system relationships.
• Align access governance with live operating conditions Tie certification, privilege review, and workload onboarding to current architecture and service ownership rather than annual planning assumptions. That reduces the gap between how systems actually operate and how they are governed.
• Staged modernisation around control readiness Sequence migrations, software rollouts, and AI adoption so identity, logging, and approval workflows can keep pace with the new environment. If the control plane cannot support the change, the programme is moving faster than governance can absorb.

Key takeaways

• The article's core point is that record spend did not remove the constraint on delivery, because organisational capacity remained the limiting factor.
• Dependency complexity rises when cloud, AI, and modernization programmes advance together, and that complexity reaches identity governance quickly.
• Security and IAM leaders should manage transformation as a live operating problem, with planning that adapts to current system conditions.

Key terms

• Execution Capacity: The amount of change an organisation can absorb while still governing it properly. It includes the people, processes, telemetry, and decision-making needed to validate new systems, dependencies, and risks as they are introduced.
• Dependency Sprawl: The condition where an application relies on many packages, subpackages, and transitive dependencies that are difficult to track and secure consistently. In appsec, sprawl increases the number of potential vulnerabilities, maintenance obligations, and third-party trust relationships that governance teams must manage.
• Adaptive Planning: A planning approach that updates priorities from current operational conditions instead of fixed milestones alone. In security and identity programmes, it helps align control decisions with live architecture, capacity, and risk signals.
• Control Drift: Control drift is the gradual weakening or inconsistency of a control over time as systems, workflows, or business rules change. It often appears as different interpretations, missed exceptions, or uneven enforcement across applications, and it usually becomes visible only when monitoring spans the full process.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It is designed for practitioners who need to connect identity control to real-world operating conditions across modern environments.