Identity security’s great divide is now an ROI problem

At a glance

What this is: SailPoint’s report argues that identity security has become a top ROI driver, yet most organisations remain stuck in low-maturity operating models that rely on manual control and fragmented tooling.

Why it matters: IAM leaders need to treat maturity gaps as a governance problem across human, NHI and autonomous identity programmes, because the value now comes from operationalising identity at speed, not only from controlling access.

By the numbers:

• 63% of responding organisations remain stuck in the earliest stages of identity maturity.
• 375 global identity leaders informed the 2025 Horizons of Identity Security report.
• High-maturity identity programmes see ROI multiples up to 10 times greater than traditional security investments.

Context

Identity security is no longer just an access-control layer. In SailPoint’s 2025 Horizons of Identity Security report, the central issue is that identity has become a high-ROI control plane while many organisations are still operating it as a manual back-office function.

That gap matters because identity now coordinates permissions, workflows and decisions across human users, non-human identities and AI-enabled automation. When the operating model stays fragmented, maturity lags even as the business expects faster onboarding, cleaner governance and more adaptive control.

The article’s core message is that the problem is not whether identity matters, but whether the programme has evolved far enough to carry the operational load now being placed on it.

Key questions

Q: How should IAM teams respond when identity maturity is lagging behind business automation?

A: Start by identifying where manual provisioning and fragmented tools are creating delays or inconsistent policy enforcement. Then prioritise a governance model that can synchronise identity state, automate repetitive decisions and extend oversight to machine and AI-driven access paths before the gap widens further.

Q: Why do low maturity identity programmes struggle to deliver consistent security and business value?

A: Low maturity programmes often lack a clear operating model, broad identity coverage, and a strong way to explain value to executives. That creates budget pressure and slow adoption. Mature identity security works when governance, technology, and business alignment reinforce each other, so controls can scale across employees, partners, and machine identities.

Q: What breaks when identity governance is managed manually in hybrid environments?

A: Manual identity governance tends to break at scale because reviews lag behind change, entitlements drift across systems, and removals are missed during joiner, mover, and leaver events. That creates excessive privileges and inconsistent compliance evidence. The practical result is more audit effort, slower operations, and higher exposure from access that no longer matches business need.

Q: Should organisations prioritize securing machine identities before expanding agentic AI use?

A: Yes. If agent identities, tokens, and service accounts are not tightly governed, expanding agentic AI increases the blast radius of every mistake or compromise. Security teams should establish inventory, least privilege, lifecycle control, and revocation paths before scaling deployment.

Technical breakdown

Why identity maturity now drives ROI

Identity maturity changes the economics of security because the control plane is doing more work than traditional authentication or provisioning ever did. When identity data is synchronised across systems and policies are enforced centrally, teams reduce manual effort, accelerate access decisions and create cleaner governance signals. The report’s point is not that identity replaces other controls, but that it increasingly determines whether those controls operate at business speed. In practical terms, the value of identity comes from being able to coordinate decisions across environments without rekeying the same policy into every tool.

Practical implication: treat identity architecture as an operating layer, not a ticketing function.

Manual provisioning and fragmented tools limit identity outcomes

Manual provisioning creates delay, inconsistency and exception handling, which is why low-maturity programmes struggle to scale. Fragmented tools make the same identity state exist in several places without a single source of governance, so certification, onboarding and policy enforcement drift apart. Static controls then lock the programme into predefined assumptions that break in cloud, hybrid and AI-heavy environments. The technical problem is less about individual control failure than about state divergence across systems. Once identity state is inconsistent, every downstream governance action becomes slower and less trustworthy.

Practical implication: reduce identity state duplication before adding more governance workflows.

AI agent governance and machine identity security become maturity gates

The report frames AI agent governance and machine identity security as capabilities that appear once organisations move beyond foundational maturity. That sequencing matters because these actors behave differently from human users: access can be transient, delegated, embedded in workflows or created through automation rather than manual request. Traditional reviews and static entitlement models were built for stable human access patterns, not runtime identity behaviour. The governance challenge is therefore not simply more identities, but identities whose issuance, scope and duration change dynamically as systems automate more of the work.

Practical implication: extend identity governance to machine and autonomous actors before automation outpaces oversight.

NHI Mgmt Group analysis

The real divide is operational, not conceptual: identity security has moved into the ROI centre of the security stack, but most programmes still run on control models designed for slower, simpler environments. That mismatch is why maturity stalls even when investment continues. Practitioners should read the gap as an operating-model problem, not a tooling problem.

Identity has become strategic infrastructure, and that changes the governance test: when identity drives workflows, synchronisation and policy decisions across business systems, the measure is no longer whether access exists, but whether the programme can keep state consistent at enterprise speed. The implication is that identity teams now own business flow integrity as much as access control.

AI agent governance is not an add-on use case: it is a sign that identity programmes have crossed a threshold where non-human decision-making must be governed alongside humans and service accounts. This is where lifecycle, authorisation and policy automation stop being efficiency features and become structural requirements. Teams that ignore this shift will keep measuring success with metrics that no longer describe the environment.

Machine identity security exposes the same maturity gap from another angle: organisations that cannot govern service identities, tokens and automated access paths will not be able to govern AI-enabled operations either. The named concept here is identity execution debt: the longer access state is managed manually, the more the programme accumulates unresolved operational risk in every automated workflow. Practitioners should treat that debt as a maturity indicator, not a future possibility.

ROI now belongs to the programmes that can enforce policy continuously: the report shows that identity value compounds when organisations move from static checkpoints to real-time governance. That means the competitive gap will widen between teams that can synchronise decisions across systems and those that still rely on periodic review. The practitioner lesson is straightforward: maturity now determines whether identity is a cost centre or a growth enabler.

What this signals

Identity maturity is now an execution issue: programmes that still depend on manual provisioning and disconnected controls will not keep up with AI-enabled operating models. The next planning cycle should focus on synchronising identity state across systems before adding more review steps or point controls.

Identity execution debt is the accumulated risk created when access state is managed manually for too long. Once automation expands into workflows, service accounts and AI-driven decisions, that debt shows up as inconsistent governance, delayed onboarding and weak policy enforcement.

For practitioners

• Map your current maturity horizon Assess whether your programme is still dependent on manual provisioning, fragmented tools and static controls, then identify the next operational step rather than trying to jump stages.
• Centralise identity state before scaling automation Eliminate duplicated identity records and inconsistent policy sources so certification, onboarding and enforcement draw from one governed view of access.
• Extend governance to machine and AI identities Bring service accounts, tokens and AI-enabled actors into the same governance model as human access so automation does not create unmanaged entitlement paths.
• Measure business outcomes from identity Track synchronisation, onboarding speed, policy consistency and budget outcomes alongside risk reduction so the programme is evaluated as infrastructure, not a checkbox.

Key takeaways

• Identity security has crossed from being a control layer into a business performance lever, but many programmes have not changed how they operate.
• The maturity gap is visible in manual provisioning, fragmented tooling and static controls that cannot keep pace with cloud and AI-driven operations.
• The practical response is to centralise identity state, automate repeatable governance tasks and extend oversight to machine and autonomous actors.

Key terms

• Identity maturity: Identity maturity is the degree to which an organisation has turned identity from a deployment into a managed operating model. In practice, it covers visibility, governance, automation, and continuous improvement across humans and non-human identities, with measurable controls rather than one-time implementation milestones.
• Identity Governance Execution Debt: The accumulation of hidden operational gaps when identity controls depend on manual follow-through, stale data, or scattered evidence. It appears as a working process on paper, but it erodes control reliability, audit readiness, and the ability to prove outcomes at scale.
• Machine Identity Security: Machine identity security is the practice of protecting the digital identities used by software, devices, services, and automated processes. It covers how identities are issued, authenticated, authorized, rotated, monitored, and revoked across systems such as APIs, workloads, certificates, tokens, and service accounts to reduce misuse, impersonation, and unauthorized access.
• AI Agent Governance: AI Agent Governance is the set of policies, controls, and oversight practices used to direct how autonomous software agents behave. It defines allowed actions, approval paths, identity boundaries, logging, monitoring, and accountability so agent decisions remain traceable, constrained, and aligned with business, security, legal, and ethical requirements.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.