Why identity Governance Must Evolve for the AI Era

Two years ago, identity governance meant one thing: managing employees, contractors, and partners.

Then something changed.

In boardrooms today, the question is no longer “Who has access?”, it’s “What has access?”.

Applications, APIs, service accounts, autonomous systems, AI agents are all making decisions on behalf of the business. The perimeter didn’t just expand, it completely dissolved. This has no placed identity at the center of how organizations manage risk, enable business operations, and support innovation. As AI adoption accelerates, identity governance must evolve alongside it.

Why Is Identity Risk Expanding Beyond Individual Accounts?

Identity risk is no longer isolated to a single account or incident.

According to the 2026 Trends in Identity Report, 25.6% of identity victims were managing two or more identity incidents simultaneously. That statistic highlights an important shift: identity risk is becoming increasingly interconnected and multi-layered.

Attackers are no longer focused solely on compromising user credentials. They are targeting a broader identity ecosystem.

The report also found that unauthorized device access increased 78% year over year and now accounts for 27.2% of identity compromises. This reinforces the need to govern trusted access across devices, applications, and systems, not just individual users.

Perhaps most telling, among victims who experienced unauthorized device access followed by misuse, 87% experienced account takeover. What starts as an access issue can quickly become a broader identity compromise.

This is why identity governance has evolved beyond authentication and access requests. Identity is now a critical control point for security, risk management, resilience, and business operations.

In our work with enterprise organizations, we’re seeing identity become increasingly central to conversations around operational risk, regulatory compliance, digital transformation, and AI adoption. The scope of governance continues to expand, and organizations need to adapt accordingly.

Where Are Identity Leaders Discussing the Future of AI Governance?

As identity leaders gather in Las Vegas this June, many of these challenges will be front and centered.

One event I’m particularly looking forward to is The Identity Social, hosted by Arcova, formerly MorganFranklin Cyber Team and our partners ( Aembit , Britive, C1 , HYPR Opnova ) during Identiverse.

The conversation around identity has expanded significantly in recent years. Discussions that once focused primarily on access management now include topics such as AI governance, non-human identities, identity fabrics, passwordless authentication, privileged access modernization, and securing agentic AI systems.

These are not future concerns. They are challenges organizations are actively working through today.

The event is designed to bring together identity and security leaders, practitioners, and technology partners for meaningful conversations about where identity is headed next and how organizations can prepare.

If you’re attending Identiverse, I encourage you to register and join us.

Tuesday, June 16, 2026 at the House of Blues – Mandalay Bay.

How Is AI Changing the Scale and Speed of Identity Management?

Much of the discussion around AI and identity focuses on the number of new identities being created.

While that is certainly important, I believe the bigger challenge is speed.

Historically, identity programs were designed around human-driven processes. Access to requests, approvals, certifications, governance reviews, and remediation activities were built around workflows that assumed people would be making decisions.

AI is changing those assumptions.

Organizations are deploying AI assistants, intelligent automation, and emerging agentic systems that operate at a pace far beyond traditional human processes. At the same time, threat actors are using AI to accelerate reconnaissance, phishing campaigns, and credential attacks.

Both business activity and threat activity are accelerating.

The result is that identity teams are being asked to govern increasingly dynamic environments while maintaining security, compliance, and operational efficiency.

This is not simply a technology challenge. It is a governance and operating model challenge.

Many organizations are discovering that approaches designed for slower, more predictable environments struggle to keep pace with the scale and speed of modern identity ecosystems.

Visibility is becoming more difficult. Ownership becomes less clear. Governance often lags deployment.

The question is no longer whether organizations can govern identities, but whether they can govern them effectively without creating friction that slows the business down.

The organizations making the most progress are focusing on three areas:

• Visibility
• Accountability
• Scalability

Before identities can be governed, they must be discovered. Before access can be managed, ownership must be established. Before governance can scale, processes must be able to operate at the speed of the business.

Looking ahead, I believe governance alone will not be enough.

Future identity programs will need to become more intelligent and adaptive.

Rather than relying exclusively on static policies and periodic reviews, identity systems will increasingly leverage contextual risk signals, automation, and real-time insights to make better decisions. Identity should not operate in isolation from security operations, threat intelligence, or broader business context.

Human identities will remain foundational to every IAM program. The challenge is extending the same level of governance, visibility, and control across an increasingly diverse identity ecosystem.

The organizations that succeed in the AI era will be those that view identity not simply as an access management function, but as a strategic layer that enables security, resilience, and innovation at scale.

Identity governance has always been important.

The difference now is that the pace of change demands a more scalable, adaptive approach. And that evolution is already underway.