TL;DR: Cyber Security Tribe's 2025 Annual State of the Industry Report compares responses from more than 350 cybersecurity professionals across people, process and technology, using 2024-to-2025 benchmarking to show where priorities are shifting for the rest of 2025 and into 2026. The report is best read as programme calibration, not a vendor scorecard.
At a glance
What this is: This is a benchmarking report that compares 2025 survey responses from more than 350 cybersecurity professionals across people, process and technology.
Why it matters: It matters because identity and security leaders can use the benchmark to test whether their programmes are aligned to current priorities rather than internal assumptions.
Context
Cybersecurity benchmark reports are useful when teams need an external reference point for programme planning, not when they need a product recommendation. This report compares survey responses from 2024 and 2025 across people, process and technology, which makes it relevant to identity, governance, and security leaders who need to calibrate priorities rather than redesign the stack from scratch.
The core governance issue is whether current security investments still match operational reality. For identity programmes, that means checking whether people controls, process maturity, and technology deployment are moving together or drifting apart. The report is positioned as a benchmarking tool for the remainder of 2025 and into 2026, so the value lies in directional comparison, not in absolute scoring.
Key questions
Q: How should teams use cybersecurity benchmark reports in identity governance planning?
A: Use them to compare your programme’s operating assumptions with peer priorities, then check whether the gaps are in people, process, or technology. For identity teams, the most useful benchmark is not a score alone but whether human and non-human access are governed with separate metrics, ownership, and review cycles. That is where hidden risk usually shows up.
Q: What does a people, process and technology model reveal about security maturity?
A: It reveals whether maturity is distributed or concentrated in one layer. Strong identity programmes need accountable people, repeatable process and enforceable technology working together. When one layer advances faster than the others, teams usually end up with policy that is not operationalised, or tooling that is not governed well enough to sustain trust.
Q: Why is year-over-year benchmarking more useful than a single survey snapshot?
A: Because it shows movement rather than sentiment. A single snapshot can reflect a moment in time, but year-over-year comparison shows whether priorities are stabilising, drifting, or changing direction. That is especially useful for identity governance, where slow control decay is often more important than headline incidents.
Q: How do identity leaders know whether benchmark findings are actionable?
A: They are actionable when they point to a specific imbalance you can verify inside your programme, such as weak lifecycle ownership, inconsistent process execution, or overreliance on tools. If the benchmark does not change a decision, it is just background reading. The test is whether it helps you re-rank the next control or governance initiative.
Technical breakdown
How benchmarking data translates into programme calibration
Benchmarking surveys are not control frameworks. They are comparative datasets that show how peer organisations are distributing attention across people, process, and technology, which is useful when deciding whether a programme is over-indexing on tools or underinvesting in operating discipline. In identity security, that distinction matters because teams often confuse activity with maturity. A benchmark can reveal whether access governance, policy enforcement, and operational ownership are moving at the same pace. The practical value is in identifying misalignment before it becomes a resourcing problem.
Practical implication: use the benchmark to compare your control mix, not to justify a vendor-led roadmap.
Why people, process and technology still define security maturity
The three-part structure is old, but still analytically useful because it prevents teams from treating cybersecurity as a pure tooling exercise. People covers responsibility and behaviour, process covers repeatable governance, and technology covers the mechanisms that enforce or support decisions. For identity teams, the same lens applies across human IAM, NHI governance, and autonomous systems: controls fail when ownership, workflow, and enforcement are not aligned. A report built around these dimensions is most valuable when it exposes which layer is lagging, rather than claiming that one layer alone solves the problem.
Practical implication: map benchmark findings to ownership, workflow, and enforcement gaps before changing controls.
Why year-over-year comparison matters more than isolated findings
A single survey snapshot can be misleading because it captures sentiment, not movement. Year-over-year comparison is more useful because it shows whether priorities are stabilising, shifting, or fragmenting across the programme. That matters for identity governance because a team can look mature in one year and then expose drift the next through inconsistent lifecycle execution, weaker policy compliance, or a mismatch between perceived and actual coverage. The report's comparison across 2024 and 2025 is therefore more useful as a signal of directional change than as a headline statistic set.
Practical implication: compare your own programme year over year so benchmark deltas become operational signals.
NHI Mgmt Group analysis
Benchmark reports are most useful when they expose imbalance, not when they reward consensus. A state-of-the-industry survey can tell leaders where the market is focusing, but the real value is whether it reveals skew between people, process, and technology investment. That is especially relevant in identity programmes, where tool spend can outpace governance maturity. Practitioners should treat the report as a calibration instrument for resource allocation, not as a proxy for security effectiveness.
Identity governance still fails when programmes optimise one layer in isolation. Human IAM, NHI governance, and autonomous system access all depend on the same operating discipline: ownership, lifecycle control, and enforceable policy. A benchmark structured around people, process, and technology is useful because it shows whether those layers are being managed as a system or as disconnected workstreams. Practitioners should use that split to test whether their own programme design reflects how access is actually governed.
Year-over-year survey movement is more informative than a static maturity label. A single benchmark can hide drift, but comparing responses across years exposes whether priorities are converging or fragmenting. For identity leaders, that matters because access models, review cadences, and control coverage can slip without a visible incident. The useful question is not whether the industry is improving in the abstract, but whether your programme is moving in step with the operational problem.
People, process and technology remain the right benchmark lens because identity risk is cross-functional. No single control family explains security maturity on its own, and that is particularly true where identity is distributed across humans, NHIs, and agentic systems. The strongest programmes align accountability, workflow, and enforcement rather than over-reading any one survey category. Practitioners should use the benchmark to identify which part of the identity operating model is lagging.
What this signals
Benchmarking only matters when it changes governance decisions. Security leaders should use reports like this to test whether their identity programme is balanced across ownership, workflow, and enforcement, rather than treating survey trends as strategy by themselves. The next question is whether internal control design is moving in step with the peer baseline or just looking busy.
People, process and technology remain the right lens for identity programmes. That lens is broad enough to cover human IAM, NHI governance, and autonomous access models without collapsing them into one control story. Teams that cannot explain where accountability sits in each layer usually have a governance gap, not a tooling gap.
For practitioners
- Benchmark your programme across three layers Compare your current identity and security priorities against the report's people, process and technology structure to see which layer is underfunded or over-optimised.
- Test year-over-year movement, not just current posture Review whether your 2025 priorities differ meaningfully from 2024 across lifecycle governance, access enforcement, and operational ownership.
- Separate maturity from tool adoption Document where controls exist on paper but not in practice, especially in review cadence, exception handling, and accountable ownership.
- Use the benchmark to challenge resource allocation If one layer consistently absorbs attention while another remains weak, reallocate effort toward the control area that is actually limiting governance.
Key takeaways
- The report is a benchmarking tool for cybersecurity priorities, not a product scorecard, so its value comes from comparison rather than endorsement.
- The people, process and technology lens remains useful because it exposes whether security maturity is balanced or concentrated in one control layer.
- Identity leaders should use year-over-year benchmarks to challenge assumptions, re-rank priorities, and identify where governance is drifting.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 provides the primary governance reference for this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | The report is about using benchmarks to guide security priorities and governance decisions. |
| GV.OV-01 — Oversight of Cybersecurity Risk | The article frames benchmarking as a management input for oversight, not a technical control. | |
| GV.PO-01 — Policy | People, process and technology benchmarks help validate whether policy intent matches operational practice. | |
| Recommendation — Use benchmark findings to update risk priorities and align security spending to programme gaps. Tie benchmark results to executive oversight reviews and track whether priorities shift over time. Compare policy intent with benchmark-driven operating priorities and close any mismatch. | ||
Key terms
- Benchmarking: Benchmarking is the structured evaluation of a system against defined test conditions and performance metrics. For biometric AI, it becomes a governance tool when it measures not only accuracy but also fairness, consistency, and behaviour across the populations and environments the system will actually face.
- Programme Calibration: Programme calibration is the process of adjusting security investment, governance focus, and operating assumptions based on external comparison data. For identity teams, it helps determine whether effort is being placed on the control layers that are actually limiting maturity.
- Security Maturity Metrics: Measures used to judge how well a security programme is operating over time, not just whether controls exist. In CSF 2.0, these indicators help teams find weak points, compare progress, and direct resources where they will improve resilience, reporting quality, and governance outcomes.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 7, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org