Topic starter
19/12/2025 11:31 am
TL;DR: Identity is now the top ROI security investment, yet 63% of organisations still sit in the earliest maturity stages and struggle with manual provisioning, fragmented tools, and static controls, according to SailPoint’s 2025 Horizons of Identity Security report, based on 375 identity leaders with McKinsey. That divide shows why identity programmes now need AI agent governance, machine identity security, and policy automation to stay relevant.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “The great divide: Insights from the 2025 Horizons of Identity Security report”.
By the numbers:
- 375 global identity leaders informed the 2025 Horizons of Identity Security report.
Key questions
Q: How should IAM teams respond when identity maturity is lagging behind business automation?
A: Start by identifying where manual provisioning and fragmented tools are creating delays or inconsistent policy enforcement.
Q: Why do low maturity identity programmes struggle to deliver consistent security and business value?
A: Low maturity programmes often lack a clear operating model, broad identity coverage, and a strong way to explain value to executives.
Q: What breaks when identity governance is managed manually in hybrid environments?
A: Manual identity governance tends to break at scale because reviews lag behind change, entitlements drift across systems, and removals are missed during joiner, mover, and leaver events.
Practitioner guidance
- Map your current maturity horizon Assess whether your programme is still dependent on manual provisioning, fragmented tools and static controls, then identify the next operational step rather than trying to jump stages.
- Centralise identity state before scaling automation Eliminate duplicated identity records and inconsistent policy sources so certification, onboarding and enforcement draw from one governed view of access.
- Extend governance to machine and AI identities Bring service accounts, tokens and AI-enabled actors into the same governance model as human access so automation does not create unmanaged entitlement paths.
Bottom line: Identity security has crossed from being a control layer into a business performance lever, but many programmes have not changed how they operate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago by Abdelrahman
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 5:44 pm
The real divide is operational, not conceptual: identity security has moved into the ROI centre of the security stack, but most programmes still run on control models designed for slower, simpler environments. That mismatch is why maturity stalls even when investment continues. Practitioners should read the gap as an operating-model problem, not a tooling problem.
A question worth separating out:
Q: Should organisations prioritize securing machine identities before expanding agentic AI use?
A: Yes. If agent identities, tokens, and service accounts are not tightly governed, expanding agentic AI increases the blast radius of every mistake or compromise. Security teams should establish inventory, least privilege, lifecycle control, and revocation paths before scaling deployment.
👉 Read our full editorial: Identity security’s great divide is now an ROI problem