Identity Governance at the Crossroads of Complexity and Scale
- By Martin Kuhlmann
- Oct 21, 2025
Modern enterprises are grappling with an increasing number of identities, both human and machine, across an ever-growing number of systems. They must also deal with increased operational demands, including faster onboarding, more scalable models, and tighter security enforcement. Navigating these ever-growing challenges with speed and accuracy requires a new approach to identity governance that is built for the future enterprise.
Exploring the Challenges of Identity Governance
There are multiple intersecting and complex challenges facing today’s enterprises. Chief among them is the explosion of human and machine identities. The former is the result of increasing digital B2B collaboration between organizations, ranging from collaboration platforms with guest accounts to the use of cloud-based business applications across corporate boundaries.
The latter refers to non-human entities that receive a unique identifier. This includes devices, application keys, service accounts, bots and other digital components. It’s essential to effectively manage machine identities for the purpose of authenticating and validating machine-to-machine interactions. The permissions of these identities must be governed in conjunction with human access to them. If these non-human identities (NHIs) aren’t protected and verified, attackers can compromise them and disrupt critical services in an enterprise’s IT ecosystem.
App sprawl is another challenge. Organizations have rapidly adopted new SaaS tools to address specific needs, which can lead to a fragmented tech stack, increased costs and new security vulnerabilities. Additionally, these create new accounts and new access that must be granted and managed. This is growing with the rise of new AI tools, and CIOs are concerned; a report from last year found that 72% of CIOs surveyed said they were concerned about app sprawl. Security threats and the Zero Trust paradigm require tight integration of security solutions such as User and Entity Behavior Analytics (UEBA) with Identity Governance and Access (IGA) to reduce risks.
The rise of shadow IT is also a problem. Not all business applications are being adopted under the purview of IT; many are being adopted by the business independently, which introduces new risks, as IT/security teams have no visibility into them. Additionally, IT-OT convergence means more devices, tools and environments are connected to the network than ever before.
Additionally, there are new compliance regulations. Remaining compliant is about more than merely abiding by laws; compliance is an additional layer of protection for your enterprise and the maintenance of trust. Organizations must adhere to an ever-growing alphabet soup of standards and regulations that require stringent controls regarding IT systems and sensitive data. They include NIS2, GDPR and DORA in the European Union, as well as Sarbanes-Oxley (SOX), the NIST Cybersecurity Framework (NIST CSF) and the California Consumer Privacy Act (CCPA) in the U.S., to name just a few. Failure to comply may result in brand damage, fines and operational disruption.
Meeting Today’s Demands Requires Flexibility and Adaptability
The challenges described above clearly demonstrate that modern companies need, first of all, automation for core “classic” IGA processes such as Joiner/Mover/Leaver, and access requests for systems and business applications.
To address app sprawl, the additional accounts and permissions for applications need to be integrated into the corporate access management and governance concept. Even if authentication and authorization are managed via EntraID, GCP or AWS, for example, a logical application management layer is required. This helps maintain an overview and provides end-users with a business-centric approach for requesting, approving, and reviewing access. The concept of role-based access management can help with structuring permissions, lifting access management on a business layer and fulfilling compliance requirements more easily.
The possibility of fast and low-cost integration of shadow IT apps makes it more likely that business owners see a benefit in making them part of the corporate IGA solution, alleviating administrative burden and meeting governance requirements.
As complexity increases, automation of governance processes is key. This includes the need for automated workflows and AI support for access recertification. It also means that an appropriate reaction to cyber threats is only possible in a scenario where IGA and other components of the “Identity Fabric” are integrated, and event-driven defense actions are possible. A concrete example is anomaly detection, alerting and automatic shutdown of access. Automation on the administrative level includes permanent monitoring of responsibilities and risks related to roles and entitlements. Finally, efficient reporting and analytics capabilities that address audit requirements are key to cost-effective compliance.
The use of AI features adds a new dimension to the possibilities for risk detection, reporting, clean-up, improvement suggestions, role modeling and other tasks. For example, if you need a specific report, the AI takes care of the translation of your question into a technical query or filter set, and you get your answer immediately.
Building Identity Governance for the Present and the Future
The proliferation of human and non-human identities must be addressed immediately and decisively. Identity governance solutions are evolving to address this pressure, with a special focus on flexible modeling, cross-system integrations and advanced role-based access design. Efficiency remains a top priority for organizations today across the board, and for IGA, that means automation is needed in key areas like recertification and reporting. Compliance is non-negotiable for many regulated industries today; the right IGA can and should play a key role in enabling this. Identity governance must balance adaptability and control to meet the pace of digital transformation.