When the walls come down, all that stops a thief is “who are you?”

Twenty years ago, corporate security looked like a medieval castle — a wall (firewall) around everything. Anyone inside was trusted; anyone outside was the enemy. All the important systems lived on servers at the office, and you had to be sitting in the building to reach them. That logic worked well for a long time.

Then two things knocked the wall down: the cloud (systems and data moved onto the internet, no longer in the building) and remote work (people logging in from home, from a coffee shop, from their phone). Suddenly “inside vs. outside the wall” meant nothing — because every connection now comes from “outside the wall.” The only thing left to tell you whether to trust a request is the identity of whoever's asking — not where they happen to be.

And the numbers confirm this is a real battleground. Verizon's 2025 DBIR found that stolen passwords and identities were the No. 1 way attacks got in — thieves aren't breaking down the door, they're “walking in the front door with a stolen key.” For web-app attacks specifically, 88% involved stolen credentials.

Once “identity” becomes both the key to the house and the thief's No. 1 target, the market that protects it grows too. IAM is expanding from about $26B in 2025 to around $43B by 2030, growing roughly 10–12% a year.

At the heart of modern IAM is an idea called zero trust — literally “don't trust by default.” Its slogan is “never trust, always verify.” Unlike the wall era, where “once you're inside, you're trusted,” zero trust says every single request has to pass a fresh identity check. There's no “pass once, get in everywhere.”

The actual mechanism is walking through an “identity gate” of three checkpoints in a row — every time you (or an app, or an AI) try to touch anything:

The first checkpoint is authentication (authn). MFA matters a lot here, because a password alone is easy to steal — but if a second step is required, a thief with just the password can't get in. CISA and the industry say phishing-resistant MFA blocks over 99% of identity-based attacks — the number that explains why every organization is rushing to require it.

The second checkpoint is authorization (authz), following the principle of least privilege — “grant the smallest amount of access needed.” Even after you authenticate, that doesn't mean you can reach everything; you can only reach what your job actually requires. This is IGA's job. And the third checkpoint is a special gate for powerful accounts — important enough to get its own chapter next.

But the truth is, it's easier said than done. Even though 63% of organizations worldwide say they've done zero trust in part or in full, Gartner estimates only about 10% will reach a “complete and measurable” level by 2026 — the gap between “claiming to do it” and “actually doing it” is still wide, and that's exactly where the IAM market keeps growing.

In an organization's keyring, there's one key unlike all the others — the master key that opens every room. In IT, that's the admin or root account, or any account that can control servers, databases, and the entire cloud. If a thief steals an ordinary employee's account, they only get partial access. But steal the master key and it's the same as seizing the whole organization. That's why Privileged Access Management (PAM) gets carved out for special guarding.

ภาพประกอบ (keys.png)

PAM runs on an idea that sounds simple but is powerful: instead of letting admins carry the master key around at all times, you keep the key in a central “vault” and check it out only when needed. The system (1) stores admin passwords in a vault and rotates them so often that nobody even knows the real password, (2) grants access only when it's needed (just-in-time) and pulls it back the moment the job is done, and (3) logs every action of those powerful accounts so it can be audited later.

How big a deal is PAM? CyberArk, the market leader here, says more than 10,000 organizations worldwide, including over 55% of the Fortune 500, use its system to protect these “crown jewels” — a sign that PAM isn't an add-on toy but a core pillar of large-organization defense.

Because IAM is the “control plane” of security, it's the point where the rest of the field converges:

• The foundation of all Cybersecurity: whether you're protecting devices and networks or protecting data, every defense starts with one question — “who's asking for access?” IAM is the answer to that question
• Grows with hyperscale cloud: the more an organization moves to the cloud, the more the old wall disappears, and the more it must lean on identity as the perimeter — the cloud is why IAM exploded
• Made urgent by AI agents: as AI starts doing work for people, it has to log in and access systems itself — AI's identity becomes a new perimeter IAM has to handle (see the next chapter)
• Connects to AI Security & Agent Guardrails: controlling “who an AI agent is and what it can do” is exactly where IAM and AI governance meet

And looking inside IAM itself, the three sub-topics we covered aren't separate — they link up like a single conveyor belt: Workforce/Customer IAM is the first checkpoint that proves who you are (SSO + MFA) · IGA is the layer that decides what rights you should have and clears out the excess · and PAM is the innermost layer guarding powerful accounts. All three have to work at once to count as real zero trust — miss any layer and a thief slips in through that gap.

IGA (Identity Governance) in particular is the layer that answers “who should have which rights, and can you prove it to an auditor?” — driven by regulation (SOX/HIPAA) more than fear of threats. It's roughly an $8–9B market, and it just saw a big deal: SailPoint returned to the market at a ~$12.8B valuation in 2025.

The 2025–2026 IAM market has two standout features. The first is a split between giants who sell it “bundled in a package” and specialists who go deep. Microsoft leads on share with Entra ID (formerly Azure AD), because it comes bundled with the Microsoft 365 that organizations already use, while Okta, CyberArk, and SailPoint are specialists who go deeper in each area.

The second is a wave of consolidation. The deal that shook the field most was Palo Alto Networks announcing it would buy CyberArk for about $25B (announced July 2025, closing Feb 2026) — a clear statement that “identity” has become a pillar every major security company needs. It was the second-largest US tech deal of 2025, behind Alphabet buying Wiz.

So far we've talked entirely about the identity of “people.” But the reality now flipping the field is this — most of what logs into today's systems isn't human. It's software: scripts, bots, automated services, and most recently AI agents doing work for people. These are collectively called non-human identities (NHI), and each one needs its own passwords, keys, and access rights, just like a person.

ภาพประกอบ (machines.png)

The numbers are startling: in a typical organization, NHI outnumber human identities by tens to one — research gives different figures by environment, from about 45:1 in a typical organization to 80:1 and over 100:1 (peaking around 144:1) in cloud/DevOps. And it's growing fast — the number of machine identities per organization is rising about +44% a year, incomparably faster than human identities.

Why is this scarier than human identity? Because most NHI have no MFA (a bot can't tap a confirmation on a phone), they're often “set up and forgotten” with nobody to shut them off when they're done, and their keys (passwords/secrets) tend to scatter across code and config files. Research found that 43% of leaked secrets were outside source code — spread across CI/CD tools and work chat apps. So this is the “new perimeter” that CyberArk, Okta, and a new wave of players are all racing to claim.

The first clear direction is going “passwordless.” Passwords are identity's weakest point — stolen, guessed, tricked out of you. Technologies like passkeys and phishing-resistant MFA are replacing them, because they block over 99% of identity-based attacks. The future of logging in is “nothing to steal.”

The second direction is merging IAM with AI governance. As AI agents do more work for people, the question “who is this agent, what can it do, who's responsible” becomes a major problem — IAM, Agentic AI, and AI Security will be inseparable. Whoever controls AI's identity first wins the next wave.

But there are risks worth watching on this path:

Risk one — getting swallowed by the giants' “bundle.” Microsoft throws Entra in with the Microsoft 365 every organization already uses, so many customers pick what's “free in hand” over paying extra for a specialist. This is permanent pressure on Okta, Ping, and the specialists — their challenge is to be good and neutral enough to be worth paying extra for.

Risk two — the consolidation wave and concentration. The Palo Alto–CyberArk deal is a sign the market is consolidating into a few platforms. That's convenient for customers, but it also shrinks the options and hands more bargaining power to a few vendors.

Risk three — the machine-identity time bomb. NHI, growing tens of times faster than humans and lacking MFA, are the largest and least-watched attack surface right now. If AI agents spread faster than IAM tools can keep up, that gap becomes where the big breaches of the future happen.

In short: IAM is the story of all of security shifting from “building a wall” to “checking who you are.” Now that the wall has fallen along with the cloud, identity has become both the key to the house and the thief's No. 1 target. And when most of what's asking for access is no longer a person but an AI — the oldest question in security, “who are you?”, becomes the hardest and most important problem of this era.