Topic starter
08/12/2025 3:20 pm
TL;DR: More than 40% of organisations remain in Horizon 1, while roughly one-third have reached the top three most secure horizons, alongside rising machine identity coverage and privileged access governance adoption, according to SailPoint’s three-year Horizons survey. The pattern shows identity security is improving, but most programmes still underuse the controls needed for modern identity sprawl.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “The progress of identity security — a three-year review”.
By the numbers:
- More than 40% of organisations still remain in Horizon 1, according to SailPoint’s three-year Horizons survey.
- About 8% of surveyed organisations made the jump from Horizon 2 to Horizon 3 over the prior year, according to SailPoint’s three-year Horizons survey.
- Only about 1% broke out of Horizon 1, according to SailPoint’s three-year Horizons survey.
Key questions
Q: What does it mean when an identity security programme is still early in maturity?
A: It usually means the organisation still depends on manual processes, fragmented data, and inconsistent ownership to manage access.
Q: Why do machine identities change the way identity risk should be measured?
A: Machine identities expand the attack surface beyond human login events because service accounts, API keys, and certificates can be overprivileged, poorly inventoried, and difficult to review.
Q: How do I tell whether identity governance is scaling or just administration?
A: Look at coverage, not account volume.
Practitioner guidance
- Strengthen identity data foundations Unify identity records across employees, contractors, service accounts, and machine identities so policy decisions use one current source of context rather than fragmented directory views.
- Extend privileged access governance to non-human accounts Treat service accounts, automation identities, and machine identities as governed privilege holders, with ownership, approval, and review paths equivalent to human privileged access.
- Measure maturity across four operating dimensions Assess strategy, technology and tools, operating model, and talent together so a strong tool stack does not mask weak process or ownership discipline.
Bottom line: The article shows that many enterprises are still early in identity security maturity even as a growing minority progress into more advanced horizons.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago 2 times by Abdelrahman
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 6:01 pm
Identity maturity is now a governance problem, not a tooling problem: the article shows that enterprises can buy more identity capability without materially changing how access is governed. Horizons progress only when strategy, operating model, data, and talent move together. The practitioner lesson is that maturity programmes must be judged by governance consistency across identity types, not by feature adoption alone.
A question worth separating out:
Q: How can organisations decide whether to prioritise identity controls or data controls first?
A: Organisations should prioritise both, but begin with the control that closes the highest-risk exposure path. If sensitive data is broadly accessible, strengthen data classification and access restrictions first. If credential sprawl or weak authentication is the bigger issue, tighten identity governance first. In practice, the best outcomes come from sequencing both against the same risk model.
👉 Read our full editorial: Identity security is maturing, but most enterprises remain early