In the modern threat landscape, identity forms the foundation of a successful security program. Today’s identity solutions don’t just protect identities of all kinds. They operate as the nerve center of the organization: coordinating access, enabling automation, and informing real-time threat management decisions across digital environments. Best of all, identity solutions aren’t just about security anymore. They are powering digital transformation, driving intelligent automation, efficiency, agility, and scalability. Identity is no longer a cost center: it’s a business enabler.
SailPoint’s fourth annual Horizons of Identity Security report reinforces this shift, finding that organizations see identity as having a much higher perceived ROI than any other security domain. This marks a major change in mindset. Today’s organizations don’t just want a prevention mechanism. They want a response enabler. They don’t want static policies. They want a dynamic, responsive access program. The Horizons report examines how identity’s evolving role is impacting today’s organizations, highlighting the growing importance of a unified approach that both enhances security and prioritizes business enablement.
The challenges shaping the modern identity market
The attack landscape is evolving rapidly, and the emergence and proliferation of machine and AI agent identities has expanded the threat surface. Experts estimate that machine identities currently outnumber human identities by as many as 45 to 1. As AI agents emerge as the fastest-growing identity type, the challenge to secure these non-human identities intensifies. However, the Horizons report found that fewer than 4 in every 10 organizations currently govern AI agent identities, underscoring the urgent need for modernization.
The report found that 63% of organizations remain at the lowest levels of identity maturity (“Horizons” 1 and 2). Further, for every three organizations that improved their maturity and advanced to the next horizon, two slid backwards into a less mature posture. Stagnant identity programs can’t keep pace with new threats: Organizations that are not actively advancing their identity programs are losing ground relative to their peers. Horizons 4 and 5 now include higher capability requirements, including managing agents, embedding identity data models, and real-time access management. Given this, 4% of firms that would have stayed in the same horizon have found themselves moving backwards.
The good news: Most enterprises have significant room for growth, and a clear path toward stronger security. Many of the organizations that improved their maturity pointed to a desire to increase automation and build more advanced capability, emphasizing that a mature identity program has benefits that go beyond security.
Embracing identity for business enablement
Rather than thinking of identity strictly in security terms, it is important to reframe identity as a business-essential element of the company’s strategic infrastructure. The Horizons report found that organizations positioning identity and access management (IAM) as a strategic enabler and driver of margin impact are 40% more likely to maximize investment value. That means businesses are consistently finding that a strong identity program isn’t just a security asset, but an essential driver of efficiency and business enablement. As organizations invest in maturing their identity programs, they are seeing a reliable (and growing) return on that investment.
Driving this transformation is the convergence of data, security, and identity. This trifecta is redefining how organizations drive both protection and performance — linking real-time data intelligence with adaptive security controls, all orchestrated through a unified identity foundation. When these three forces operate in sync, security becomes dynamic, responsive, and deeply aligned with business outcomes. The result is an enterprise that can move faster and smarter — reducing risk while accelerating innovation and growth.
Executing this vision requires a thoughtful approach to deployment. Implementations can be complex: only 14% of organizations say their most recent deployment was completely successful, and nearly half (48%) ran over budget. Success often comes down to three best practices: keeping identity data clean, using a tiered governance framework that scales with the organization, and building reusable templates to avoid reinventing the wheel. Organizations that follow these are 1.5 times more likely to achieve complete success and come in under budget, turning what can be a challenging process into a strategic advantage.
As organizations strengthen both their deployment and governance practices, the benefits compound as identity programs become more advanced. Highly mature organizations (Horizon 3 or higher) are four to eight times more likely to have capabilities like real-time data synchronization and automated lifecycle workflows. They are also four times as likely to have AI-enabled threat detection capabilities and privileged account monitoring, highlighting the ways in which a mature identity program can be leveraged not just as a control, but a detection mechanism as well. Even security applications can have a positive impact on the business’s bottom line, helping avoid increasingly costly breaches and potential regulatory penalties.
Mature organizations are also more likely to have cloud data governance capabilities, such as unified policy enforcement and real-time data access monitoring. However, advanced, context-aware access capabilities like attribute-based access control (ABAC) and time-bound permissions remain less common, indicating growth opportunities even within mature identity programs. Just 25% of organizations say they position IAM as a strategic business enabler, while 57% use it strictly as a security control or compliance tool. That means a substantial share of organizations have the potential to significantly enhance business operations through a streamlined approach to identity.
Building a better future atop a strong identity foundation
An identity program is never “done.” To succeed, it must continuously adapt, evolve, and advance. The future of identity isn’t static. It’s dynamic. Those dynamic capabilities will be even more important over the next 3-5 years, as machine and AI agent identity are expected to grow at a faster rate than all other identity types. Organizations can’t rely on slow manual processes—they need automated identity solutions that operate at the speed and scale of the modern enterprise.
While most organizations recognize the important role identity plays across their digital environments, too many identity programs fall short of their potential. The Horizons report highlights how organizations are building a strong, unified identity foundation that spans both security and operations, turning identity investments into measurable business outcomes.
To read the full Horizons of Identity 2025-2026 report, visit sailpoint.com/horizons.
