Executive Summary

The Research Compass Identity and Access Management 2026 represents KuppingerCole's strategic research agenda for the identity market. This document gives technology leaders, vendors, and investors advance visibility into our planned market evaluations, supporting informed decisions across procurement, product development, and investment strategies.

Takeaways for 2026

• Expanded Leadership Coverage: Expect a total of 18 Leadership Compass reports focusing on emerging and critical identity domains.
• Identity Fabric Adoption: The transition from monolithic IAM architectures to modular Identity Fabrics will enhance scalability and flexibility, enabling more seamless orchestration across identity systems.
• Non-Human Identity Management (NHIM): As Non-Human Identities (NHI) rapidly increase because of IoT and API integrations, effectively managing these entities - including emerging types such as agentic AI - has become essential. This requires advanced credentialing and comprehensive lifecycle governance.
• Market Dynamics and Consolidation: With ongoing growth in the identity market, substantial consolidation and increasing platformization are expected, especially within PAM, CIEM, Identity Orchestration, and NHI management domains.
• Regulatory Influence: European regulatory frameworks like NIS2, DORA, and eIDAS 2.0 are expected to further differentiate the regional market and influence global compliance strategies.
• Dynamic Authorization and AI Integration: Artificial intelligence is reshaping dynamic authorization by enabling real-time, context-aware access controls. The utilization of real-time signals and evolving standards are fostering adaptive and continuous enforcement of access policies, while simultaneously influencing the detection and response mechanisms within identity security.

How to Use This Document

2026 Market Trends & Drivers

The Research Compass Identity and Access Management 2026 reflects our assessment of where markets are heading and what forces are shaping technology decisions. This section provides context for why specific topics appear on the 2026 calendar.

Identity & Access Management Trends

1. Identity Fabric Architecture Takes Hold

IAM is transitioning from traditional monolithic architectures to modular frameworks coordinated through APIs and integration layers. This evolution enables organizations to increase agility, minimize redundancy, and upgrade individual components without replacing entire systems. Enterprises are moving beyond isolated point solutions and organizational silos - particularly in large-scale sectors such as aerospace, defense, and pharmaceuticals - toward integrated identity architectures that encompass workforce, customer, and non-human identities. As a result, there is a growing demand for platforms capable of orchestrating across multiple identity repositories and protocols, while ensuring consistent policy enforcement.

LC Implications: Evaluation criteria increasingly emphasize orchestration capabilities, multi-protocol support, and architectural flexibility over feature depth in any single area.

2. Fine-Grained Policy-Based Access Control Facilitates Zero Trust

Modern approaches like OPA and Cedar, combined with AI-driven dynamic policies, are elevating PBAC's potential. This evolution allows for real-time, context-aware decisions that allow for scalable, intelligent access control. As PBAC integrates AI, its utility in handling dynamic environments solidifies its comeback.

LC Implications: Evaluation criteria will expand to include AI-driven policy management capabilities, emphasizing dynamic and adaptive policy enforcement.

3. Decentralized Identity Reaches Enterprise Pilots

Verifiable credentials and decentralized identifiers are moving from conceptual frameworks to enterprise pilots, particularly in workforce credentialing, supply chain verification, and regulated industries. Momentum is increasing as large ecosystem players begin to enter this space (for example, Apple’s wallet direction) and as the European Digital Identity Wallet and emerging EU Digital Identity business wallet concepts push implementations toward market-ready patterns. Adoption is expected to accelerate quickly as platform support, procurement confidence, and regulatory alignment converge.

LC Implications: New evaluation categories forming; existing LCs adding decentralized identity integration and wallet ecosystem readiness (including EU DI wallet alignment and major-platform interoperability) as evaluation criteria.

4. Non-Human Identities Proliferate

The rapid increase in workloads, machines, containers, APIs, IoT devices, AI agents, and agentic AI - each representing distinct facets of an emerging challenge - has resulted in non-human identity volumes that far exceed those of human identities. Organizations are facing significant difficulties in maintaining visibility, managing lifecycles, and controlling certificate proliferation.

LC Implications: Machine identity becomes standalone LC topic rather than subsection of broader PKI or PAM evaluations.

5. Passwordless Authentication Goes Mainstream

Authentication is shifting from passwords to passive methods like biometrics and contextual signals. FIDO2/WebAuthn is now widely used in enterprises, while consumer passkeys are increasing expectations for similar support at work. These changes improve security and user experience with seamless verification.

LC Implications: Passwordless becomes baseline expectation rather than differentiator; evaluation focus shifts to implementation friction, recovery processes, and legacy system accommodation.

6. Adaptive Access with Signal Sharing and Enrichment

Standards like CAEP and SSF enable adaptive access decisions through real-time risk assessment. These systems support continuous, dynamic access control essential for effective Zero Trust, responding quickly to user and device risk changes.

LC Implications: Greater focus on standards-based signal handling, enrichment quality (device posture, session, identity), and policy agility (latency, automation, rollback). Prioritization of cross-vendor interoperability, uniform signal semantics, and robust governance for trust, tuning, and auditing.

7. Emergence of Autonomous Identity Systems

AI is increasingly integral to IAM frameworks, supporting the management of high-volume, fast-evolving environments such as M2M and IoT. Autonomous Identity systems leverage AI to identify anomalies, recommend entitlements, and manage access autonomously. This "AIdentity" aids in scaling IAM operations beyond human limitations, ensuring timely and effective access decisions in complex scenarios.

LC Implications: Evaluation criteria now focus on autonomous decision-making, model governance (including traceability and explainability), and safety controls such as policy guardrails and human override. Platforms stand out by effectively applying AI to identity, access, and analytics, demonstrating outcomes like reduced risk, faster remediation, better efficiency, and scalable management of non-human identities.

Regulatory & Compliance Drivers

European Regulations

• NIS2: Network and Information Security Directive drives security investment across essential and important entities (October 2024 deadline, implementation ongoing)
• DORA: Digital Operational Resilience Act creates specific requirements for financial services ICT risk management
• eIDAS 2.0: European Digital Identity framework drives wallet and verifiable credential adoption
• EU AI Act: Creates specific requirements for AI systems in security contexts

Global Developments

• U.S. State Privacy Laws: Patchwork of state regulations (beyond CCPA) drives CIAM complexity
• Critical Infrastructure Protection: Multiple authorities implementing sector-specific security requirements
• Non-EU Cyber Resilience Laws (for example UK): Expanding cyber risk management duties drive MFA, PAM, supplier access governance, and audit-ready identity logging across supply chains and managed service providers
• APAC Critical Infrastructure Regimes (for example Singapore): Enforced codes and standards increase requirements for access control, privilege separation, monitoring, and incident response integrated with IAM
• Incident Disclosure & Reporting Mandates (global trend): Faster, governance-driven reporting expectations increase demand for high-fidelity identity telemetry, privileged activity traceability, and evidentiary IAM controls

Advisory Project Observations

Our advisory engagements reveal patterns that validate and inform LC priorities:

• Non-Human Identities (NHI) emerge as a key focus, with initiatives rapidly expanding across industries, expected to be prominent in 2026.
• While traditional PAM is still essential, it must adapt to secure modern privilege areas like cloud control planes, SaaS admin consoles, APIs, and Non-Human Identities.
• Zero Trust awareness grows post-hype, with meaningful implementations emerging as organizations realize it requires a paradigm shift.
• Dynamic Authorization complexity rises with cloud expansion, driving the need for diverse, real-time authorization models beyond traditional RBAC.
• IAM delivery as an internal managed service challenges existing platforms with chargeback, delegation, and multi-tenancy needs.
• AI functions both as a domain within IAM and as a driving force providing emerging capabilities behind it. This creates a need for governance that defines who may use specific AI capabilities, while AI itself streamlines access requests, access reviews, and the identification of risky entitlement patterns.
• Cyber supply chain risk management (CSCRM) and Third-Party Access Governance (TPAG) are growing priorities as businesses manage more external identities like suppliers, customers, and administrators.
• Centralized vs. delegated IAM is an essential operating-model choice for distributed organizations; without clear boundaries and suitable IAM platforms, decentralization becomes friction and centralization becomes a bottleneck.

The 2026 Leadership Compass Calendar

The 2026 Leadership Compass Calendar provides advance visibility into KuppingerCole's research agenda for 2026. Please note that the indicated publication months are preliminary and subject to change. While we make every effort to adhere to the planned schedule, publication dates are not binding and may be adjusted due to editorial, strategic, or operational considerations. No legal claims can be derived from this timeline.

Calendar Overview

Figure 1 - The 2026 Leadership Compass Calendar Identity and Access Management

Click here to access the recent KC research calendar

Identity & Access Management

(1) Planning, to be confirmed later

Topic Deep Dives

Consumer Identity and Access Management (CIAM)

Market Definition: Consumer Identity and Access Management (CIAM) encompasses solutions that offer secure, personalized digital experiences across sectors such as retail, finance, healthcare, and government services. CIAM platforms provide essential capabilities for user registration, authentication, consent and privacy management, fraud detection, identity verification, and identity lifecycle management at scale, catering to the increasing demand for seamless and secure user access.

Why Now: The adoption of CIAM is driven by the need to enhance user experience, combat account takeover and new account fraud, comply with privacy regulations, and ensure secure access across multiple devices and channels. Consumer expectations and regulatory pressures are rising, prompting innovations like risk-adaptive authentication, behavioral biometrics, and decentralized identity support. The trend towards composable, API-first CIAM architectures allows flexible integration of identity services across consumer-facing platforms.

Evaluation Focus Areas:

• Flexible Deployment Options: Support for SaaS, PaaS/IaaS, hybrid, private, and on-premises setups.
• Advanced Authentication Methods: Multifactor, passwordless authentication, and risk-adaptive features.
• Integration and Orchestration: Connectors for and the ability to create custom workflows for third-party IDV, FRIPs, CDPs, CPMs, CRMs, and SIEM systems.
• Privacy and Compliance: Built-in consent management and data localization for regulatory adherence.
• API and Microservices Architecture: Facilitate comprehensive, scalable identity service integration.

Expected Vendor Population: A global range of 25 vendors from start-ups to large firms that provide comprehensive CIAM solutions, focusing on adaptability, security, and compliance. Solutions must support advanced authentication, robust integration capabilities, and privacy management features tailored to evolving consumer and regulatory landscapes.

Related KuppingerCole Research: This document has already been published:

• Leadership Compass: Consumer Identity and Access Management (CIAM) (2026)
• Buyer’s Compass: Consumer Identity and Access Management (CIAM) (2026)

Passwordless Authentication B2C

Market Definition: Passwordless Authentication for Consumers focuses on authentication technologies designed to secure and simplify access for large, heterogeneous consumer user bases across digital services. These solutions replace passwords with mechanisms such as passkeys, biometrics, cryptographic credentials, and device-bound authenticators, enabling scalable, low-friction authentication while mitigating common consumer threats such as credential stuffing, phishing, and account takeover, and providing resilient account recovery mechanisms for lost or replaced consumer devices. The market emphasizes high-volume scalability, cross-device continuity, and seamless integration into consumer-facing applications, balancing strong security controls with minimal impact on user experience.

Why Now: The consumer identity landscape is under increasing pressure from large-scale automated attacks, rising fraud costs, and growing user intolerance for complex login processes. At the same time, platform providers and regulators are pushing for stronger authentication models that reduce reliance on shared secrets. The emergence of standards-based passkeys, widespread biometric adoption on consumer devices, and growing regulatory focus on digital trust are accelerating the shift toward passwordless models. Organizations delivering consumer digital services must now decide whether to modernize authentication through passwordless, standards-aligned architectures or continue operating legacy password-based approaches that undermine both security and customer experience.

Evaluation Focus Areas:

• Consumer Experience and Conversion Impact: Frictionless login, registration, and secure account recovery with measurable impact on adoption, retention, and support cost reduction.
• Security and Fraud Mitigation: Resistance to phishing, credential stuffing, automated bot-driven attacks, and account takeover at consumer scale.
• Scalability and Performance: Ability to support high transaction volumes, global user populations, and peak traffic scenarios.
• Authenticator and Device Ecosystem Support: Native support for passkeys, biometrics, mobile devices, and cross-platform continuity.
• Risk-adaptive and Context-aware Authentication: Dynamic decision-making based on behavioral signals, device posture, and threat intelligence.

Expected Vendor Population: We expect to evaluate approximately 25 vendors, including consumer IAM specialists, platform-centric identity providers, and large-scale authentication vendors, offering passwordless capabilities optimized for consumer-scale environments rather than enterprise workforce use cases.

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Leadership Compass: Passwordless Authentication for Consumers: Securing Fast Business Online (2025)

Passwordless Authentication for Enterprises

Market Definition: Passwordless authentication refers to security methods that eliminate the use of traditional passwords, leveraging alternatives such as biometrics, cryptographic keys, or device-based authenticators. This approach addresses security vulnerabilities, user inconvenience, and high management costs associated with passwords, promoting enhanced security, simplified compliance, and seamless user experiences across enterprise systems.

Why Now: Interest in passwordless authentication is rising quickly across enterprise and consumer environments, positioning it as the next dominant model for user verification. The shift is driven by the need to reduce exposure to password-related attacks while maintaining smooth user interactions. As organizations expand their digital services and rely more heavily on cloud platforms, they are increasingly faced with a strategic decision: consolidate identity under a single, coherent platform that supports stronger security and operational consistency, or continue operating a mix of disconnected systems that require continual effort to manage and secure.

Evaluation Focus Areas:

• Integration and Usability: Seamless, user-friendly authentication across all devices.
• Security and Privilege Management: Control access to sensitive information seamlessly.
• Compliance and Policy Enforcement: Support for policy creation and enforcement.
• Authenticator Diversity and Platform Compatibility: Support various authenticators and integrations.
• Risk-based, Contextual Authentication: Dynamic access control using threat context.

Expected Vendor Population: We anticipate evaluating a diverse vendor population of around 25 – 30 vendors, ranging from start-ups to large enterprises, without bias towards solutions targeting specific use cases.

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Leadership Compass: Passwordless Authentication for Enterprises (2024)

SAP Access Control & Security

Market Definition: The SAP Access Control and Security market includes solutions for managing access rights, entitlements, role design, Segregation of Duties (SoD) enforcement, and security enforcement and governance within SAP environments. This encompasses legacy systems like SAP ECC, modern platforms such as S/4HANA, SAP Business Technology Platform (SAP BTP), and SAP's SaaS offerings like SuccessFactors, Ariba, and Concur. Critical for compliance and operational integrity, these solutions must integrate deeply with SAP's unique entitlement model and provide built-in SoD rulebooks tailored for SAP functions.

Why Now: Driven by both security and compliance needs, the demand for SAP-specific access control solutions is rising due to regulatory pressures like SOX and GDPR as well as a steep increase in cyber-attacks targeting SAP environments. The transition to S/4HANA and hybrid IT landscapes intensifies the need for solutions that provide seamless integration and SAP-specific risk alignment. As organizations increasingly depend on SAP cloud services, adaptive governance solutions capable of offering security hardening, threat analytics, and real-time access visibility are crucial.

Evaluation Focus Areas:

• Breadth and Depth of SAP Integration: Support for SAP Fiori, SAP Gateway, ABAP, and HANA.
• Security and Compliance Features: Built-in SoD rulebooks embedded deeply within SAP landscapes.
• Deployment Flexibility: Hybrid models supporting both on-premises and SaaS options.
• Advanced Governance Capabilities: Real-time access visibility and continuous control monitoring.
• Specialized Security Features: Threat analytics and security hardening capabilities.

Expected Vendor Population: 12 solutions that not only meet the stringent demands of SAP access control but also excel in integrating deeply within SAP environments.

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Leadership Compass: Access Control Tools for SAP Environments (2023)

Business Application Risk Management

Market Definition: Access and SoD Control for Line-of-Business (LoB) Applications market centers on solutions enabling centralized governance and entitlement management across various business-critical applications, including SAP, Salesforce, Workday, Oracle eBusiness Suite, and Microsoft Dynamics. These solutions ensure uniform access management, SoD enforcement, and compliance across hybrid environments, providing comprehensive integration with diverse LoB platforms.

Why Now: Driven by identity sprawl and varied access control needs across cloud and on-premises systems, organizations seek solutions to manage access provisioning and provide strong SoD policy enforcement. Increasing regulatory demands and cloud adoption necessitate robust cross-application access visibility and compliance workflows, emphasizing the importance of automation, analytics, and accountability in the audit readiness process.

Evaluation Focus Areas:

• Broad Connector Libraries: Support for diverse LoB systems like Salesforce and Oracle.
• Centralized Governance Interface: Unified management across different entitlement models.
• Automation and Risk Insights: Efficient audit readiness and risk-based access decisions.
• Scalability and Agility: SaaS delivery, low-code configuration, and API integration.
• Advanced Policy and Workflow Features: Policy-as-code, workflow automation, and ML for insights.

Expected Vendor Population: 10 vendors that offer comprehensive, scalable solutions for access and SoD control across business-critical applications, ensuring compliance and operational efficiency in modern enterprise landscapes.

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Leadership Compass: Access Control Tools for Multi-vendor LoB Environments (2023)

B2B IAM

Market Definition: Business-to-Business Customer Identity and Access Management (B2B IAM) specializes in managing identities for external users like partners, suppliers, and contractors. It requires federated trust models and decentralized administration, diverging from Consumer IAM and demanding adaptation to diverse user management practices.

Why Now: B2B IAM's complexity necessitates standards-based federation and adaptive authentication methods for interoperating across organizational boundaries. The growing need for secure onboarding, role-based access, and advanced identity governance drives its adoption, emphasizing efficiency and risk reduction.

Evaluation Focus Areas:

• Flexible Deployment and Architecture: Support for multiple deployment models and microservices.
• Multi-factor and Passwordless Authentication: Includes support for mobile apps and biometrics.
• Risk-adaptive Authentication: Context-aware, utilizing behavioral analytics and threat intelligence.
• Identity Federation and Integration: Support for SAML, JWT, OIDC, and OAuth standards.
• Governance and Compliance: Lifecycle management and compliance certifications.
• Fine-grained Access Control: support for RBAC, ABAC, PBAC, and ReBAC to enable complex hierarchical business relationships and to facilitate network, resource, and data object level authorization.
• Integration with HR systems, background checking applications, IDV, and collaboration solutions.

Expected Vendor Population: A global range of 25 vendors from start-ups to large firms.

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Whitepaper: B2B IAM: The Key To Secure Third-Party Access (2025)

IGA (Identity Governance and Administration)

Market Definition: IGA covers the technologies and processes for managing the complete identity lifecycle - from onboarding through offboarding - and governing access entitlements across enterprise systems. Core capabilities include identity lifecycle management, access request and approval workflows, access certification, role management, and policy enforcement.

Why Now: The IGA market is undergoing fundamental transformation as organizations migrate from legacy on-premises deployments to cloud-delivered solutions. This 2026 evaluation captures a market where cloud-native IGA has reached functional parity with traditional solutions for most use cases, while convergence with adjacent categories (PAM, access management) creates new architectural options.

Evaluation Focus Areas:

• Identity Lifecycle Management: Capabilities for provisioning, de-provisioning, joiner/mover/leaver processes.
• Architecture and Deployment: Support for cloud-native architecture, and multi-tenant or single tenant capabilities, scalability, SDK support, and flexible deployment models
• Access Governance: Support for access reviews, creation of certification campaigns, SoD, identity-based risk scoring, policy enforcement, and reporting.
• Interoperability and Connectivity: Breadth of connector support for on-premises and SaaS systems, API support
• AI, Analytics, Automation: AI/ML for access recommendations and anomaly detection and further use cases such as intelligent workflows generation, behavior analytics engine
• Support for non-employee identities (contractors, partners) as well as NHIs

Expected Vendor Population: 44 vendors across established leaders, cloud-native challengers, and converged platform providers.

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Leadership Compass: Identity Governance and Administration (2024)
• Buyer’s Compass: Identity Governance and Administration (2025)

PAM (Privileged Access Management)

Market Definition: The Privileged Access Management (PAM) market addresses solutions for managing task-based access to data, services, and applications across legacy and multi-cloud infrastructures. It encompasses capabilities for system-wide configuration changes, security setting alterations, and privileged access across human and machine identities. PAM solutions now integrate with Cloud Infrastructure Entitlement Management (CIEM) and secrets management platforms to extend privileged control over service accounts and machine-to-machine access.

Why Now: The rising interest in Zero Trust architectures and the need to reduce standing privileged accounts have intensified demand for dynamic authorization, ephemeral credentials, and workload automation. As PAM converges with CIEM and non-human identity platforms, it becomes a key component of identity fabric architectures and ITDR strategies. The evolving market attracts new vendors and investors, facilitating growth and innovation.

Evaluation Focus Areas:

• Comprehensive Integration Support: Seamless integration with cloud and on-premises systems.
• Dynamic and Ephemeral Credentials: Automated, short-lived credential management.
• Advanced Access Control and Monitoring: Fine-grained access and privileged session management.
• Automation and Analytics: Zero Trust support with JIT provisioning and behavior analytics.
• Secrets and Credential Management: Secure vaulting and lifecycle governance.

Expected Vendor Population: A broad spectrum of 25 PAM vendors. offering robust, innovative solutions that address the complexities of privileged access in today's hybrid and cloud-native environment

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Leadership Compass: Privileged Access Management (2024)

Modern Access Governance (IAG & IVIP)

Market Definition: Identity and Access Governance (IAG) is a critical IAM discipline focused on managing access rights across an organization's IT environment. It provides tools for access entitlements management, role design, and running access certification campaigns. The evolution of IAG is complemented by Identity Visibility and Intelligence Platforms (IVIP), which integrate IAM data from IGA, PAM, AM, and directories, using analytics to deliver insights for governance, risk management, and access optimization. IVIP enhances visibility into identities, relationships, and activities, supporting better decision-making and reducing identity-related risks.

Why Now: The growing importance of security and compliance has driven the need for robust governance frameworks facilitated by IAG solutions. Simultaneously, the emergence of IVIP addresses the demand for a comprehensive data visibility layer, improving the functionality of existing IAM systems. Organizations are prioritizing enhanced analytics and intelligence to manage static entitlements effectively and employ Just-In-Time access models, ensuring efficient risk evaluation and identity posture scoring in real-time.

Evaluation Focus Areas:

• Advanced Analytics and Risk Integration: Leverage AI/ML to improve risk assessment and anomaly detection.
• Comprehensive Identity Data Unification: Correlate data across IGA, AM, and PAM for holistic governance.
• Real-Time Monitoring and Intelligence: Provide continuous and contextual analysis, enhancing posture scoring.
• Adaptive Access Management: Integrate dynamic access models and reduce reliance on static entitlements.
• Visibility and Intelligence Enhancement: Fortify IAM systems with a data-centric approach to identity governance.

Expected Vendor Population: 25-30 vendors

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Leadership Compass: Identity and Access Governance (2024)
• Advisory Note: IVIP: Identity Visibility and Intelligence - Platform or Capabilities? (2025)

Identity Fabrics

Market Definition: Identity Fabrics provide a comprehensive and integrated IAM framework that supports seamless, controlled access to assorted services for all identity types. The paradigm evolves beyond singular solutions, embracing a mixture of services to achieve enterprise identity and access objectives, whether through a centralized IAM core or an orchestration-centric IDaaS model.

Why Now: The complexity of digital transformation in identity management necessitates modern IAM solutions. Identity Fabrics address diverse demands, including secure integration for different identity types, B2B onboarding, BYOI, remote access, and Zero Trust architecture. They also facilitate compliance, KYC optimization, and analytics support, offering flexible solutions for today's varied organizational challenges.

Evaluation Focus Areas:

• Integration and Orchestration: Bridging modern and legacy IAM systems seamlessly.
• Deployment Flexibility: Support for both centralized and orchestrated IDaaS models.
• Comprehensive API Support: Enabling service consumption via digital and cloud services.
• Architectural Modernity: Microservices and container-based deployments.
• Support for All Identity Types: Employees, devices, consumers, and more.

Expected Vendor Population: 25 vendors offering comprehensive solutions for building the foundation of customer’s Identity Fabrics that deliver robust, integrated IAM services, delivering future-proof IAM solutions with seamless integration and comprehensive capabilities across all types of identities and environments.

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Leadership Compass: Identity Fabrics (2025)

SSPM - SaaS Security Posture Management

Market Definition: The wide usage of SaaS applications by most enterprises has introduced new risks, many of which stem not from advanced malware or state-sponsored actors, but from poorly managed SaaS configurations, unmanaged cross-domain trust, unsanctioned application usage, inconsistent identity management practices, and the lack of detection of malicious SaaS application use.

Most of the reported SaaS application-related security incidents stem from a failure on the part of the customer, not the application service provider. SaaS Security Posture Management (SSPM) solutions are intended to help organizations using SaaS to identify and manage the risks for which they are responsible.

Why Now: The growing enterprise dependency on SaaS applications to run their businesses and host their sensitive data introduces risks that most organizations have not caught up to. The frontline of security is no longer on premises; it is in the cloud. As such, organizations need to sharpen their security focus on their SaaS applications now more than ever. SSPM solutions focus on mitigating these risks by offering insights into identity security, such as monitoring user permissions, Single Sign-On (SSO) coverage, password policies, and identifying privileged accounts. Additionally, SSPM addresses non-identity risks like configuration drift, unsanctioned application usage, and compliance challenges.

Evaluation Focus Areas:

• SaaS Discovery and Inventory: Monitoring usage across both sanctioned and unsanctioned apps.
• Configuration and Posture Management: Ensuring secure setups and detecting drifts.
• Identity and Access Posture: Managing permissions, MFA and SSO issues, and user privileges.
• Integrations and OAuth Governance: Overseeing SaaS-to-SaaS connections and permissions.
• Automation and Compliance Mapping: Enabling quick remediation and regulatory alignment.
• Threat Detection and Response: Detecting and remediating active threats such as account takeovers (ATOs)

Expected Vendor Population: This Leadership Compass covers a universe of at least 25 vendors, including startups, standalone SSPM providers, and those offering SSPM as part of broader security platforms.

Expected Vendor Population: 20-25 vendors

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Buyer’s Compass: SaaS Security Posture Management (2025)

Lean IGA (Identity Governance and Administration)

Market Definition: Identity Governance and Administration (IGA) refers to the technologies and processes for managing the complete identity lifecycle - spanning from onboarding through offboarding - and governing access entitlements across enterprise systems. This segment specifically caters to medium and mid-sized organizations, typically with 51–1,000 employees, focusing on governance, lifecycle automation, and access control assurance optimized for environments with small identity teams, SaaS-heavy applications, and constrained deployment capacity.

Why Now: The rise in security and compliance demands in the current market has made robust governance frameworks essential, particularly for medium and mid-sized organizations. These entities face unique challenges that require agile and scalable IGA solutions due to their limited resources but increasing reliance on SaaS applications. The evolving regulatory landscape and the need for quick, effective integration and management of access rights underscore the urgency for tailored IGA solutions that deliver efficiency and audit-readiness with minimal customization.

Evaluation Focus Areas:

• Cloud-native Architecture: Facilitates support for SaaS and multi-tenant environments that are essential for medium-sized enterprises.
• Legacy System Connectivity and Migration: Integration tools that simplify the transition from legacy systems to modern architectures.
• Convergence with IAM Solutions: Seamless support and integration with PAM, decentralized identity, and other IAM systems.
• AI/ML for Enhanced Access Management: Employs AI and ML for access recommendations and detecting anomalies.
• Support for Non-employee Identities: Capabilities to manage access efficiently for contractors, partners, and other non-employees.

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Leadership Compass: Identity Governance and Administration (2024)
• Buyer’s Compass: Identity Governance and Administration (2025)

Identity Verification – EU and Identity Verification – NA

Market Definition: Identity Verification involves validating and confirming the real-world identities of individuals through remote and digital processes. This capability, once limited to in-person scenarios, now includes advanced methods for digital identity verification, crucial for onboarding in sectors like financial services, healthcare, e-commerce, and telecom.

This research will be split into two Leadership Compass documents, addressing regional regulatory, market, and adoption differences: Identity Verification – EU and Identity Verification – US.

Why Now: The shift from analog to digital identity verification is driven by the need for seamless, automated experiences integrated into diverse processes like onboarding, KYC, risk management, and site access. Technological advancements enable identity verification to support these processes efficiently, necessitating solutions that accommodate diverse verification needs, including document, biometric, and video verification.

Evaluation Focus Areas:

• Comprehensive Verification Methods: Includes document, biometric, and optional video-based identity verification.
• Standards Compliance: Alignment with relevant global and regional standards, including NIST 800-63-3 IAL, ISO 18013-5, and eIDAS standards.
• Integration and Orchestration: Seamless support for systems like onboarding and risk engines.
• Privacy and Security: Strong controls, securing ML usage and data protection. Emphasis on detecting document, audio, photo, and video deepfakes to prevent enrollment attacks.
• Geographical and Technological Coverage: Broad scope for documents, algorithms, and deployment options.

Expected Vendor Population: 20-25 vendors in the EU and 20-25 vendors in the US selected based on their capacity to provide secure, automated identity verification, with strong privacy safeguards and extensive geographical reach.

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Leadership Compass: Identity Verification (2025)
• Buyer’s Compass: Identity Verification (2025)

Enterprise Secrets Management

Market Definition: The Enterprise Secrets Management market focuses on managing a wide array of secrets, like passwords, API keys, encryption keys, and certificates, for both machine/workload identities (non-human) and human identities within an enterprise. Originating from the Enterprise Key and Certificate Management (EKCM) field, the market is critical for maintaining a strong cybersecurity posture by preventing account takeovers and sophisticated attacks targeting these secrets.

Why Now: Organizations increasingly depend on diverse secrets management to address security risks, ensuring confidentiality, integrity, and availability across IT environments. The threats of secrets sprawl, insufficient auditing, and poor lifecycle management drive the need for centralized automated solutions. Enterprises require robust strategies for transitioning to passwordless authentication, securing cloud environments, and supporting DevOps processes securely.

Evaluation Focus Areas:

• Comprehensive Secrets Coverage: Include passwords, API keys, certificates, and more.
• Support for All Identity Types: Encompass machine, workload, and human identities.
• Enterprise-Grade Management: Centralized policy, governance, and auditing.
• Flexible Cryptographic Support: Public key infrastructures, passkeys, and crypto agility.
• Use Case Versatility: API authentication, privileged access, code security, and email security.

Expected Vendor Population: 15-18 vendors delivering holistic, integrated solutions for secrets management that secure machine-to-machine interactions, safeguard human user credentials, and facilitate resilient, agile IT operations.

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Leadership Compass: Enterprise Secrets Management (2025)
• Buyer’s Compass: Enterprise Secrets Management for Humans, Workloads, and Things – Akeyless (2025)

IAM System Integrators - EU

Market Definition: IAM System Integrators are experts who design, implement, and manage IAM solutions by integrating vendor products into an organization's operations. Their services include strategy, architecture, tool selection, implementation, migration, and ongoing management. They do not supply IAM suites but work with technologies like IGA, SSO/MFA, CIAM, PAM, and identity infrastructure from third-party vendors. Integrators ensure identities and access are governed across hybrid environments, supporting secure and compliant IAM at scale. Their value lies in making IAM processes operational, auditable, and effective, ensuring appropriate access is consistently enforced.

Why Now: The rapid increase in demand for expertise in implementing Identity and Access Management (IAM) solutions is driven by escalating cyber threats and the emergence of regulations such as GDPR and HIPAA. As European organizations increasingly depend on IAM System Integrators to achieve compliance and maintain security, the importance of engaging qualified and experienced integrator resources becomes paramount for delivering projects efficiently and within budget.

Evaluation Focus Areas:

• Comprehensive IAM Technology Support: Full stack IAM, PAM, IGA, CIAM, and more.
• Operating Systems and Directory Services: Support across varied platforms and services.
• Integration and Customization: Tailored integration and solution customization capabilities.
• Professional Services Support: 24x7 support, human resource skills management
• Engagement support history: Types of engagements supported, number of engagements conducted over the last 3 years

Expected Vendor Population: 10-15 providers of IAM system integration services in Europe, extending from consulting to managed services.

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Leadership Compass: IAM System Integrators – EU (2023)

IAM System Integrators - NA

Market Definition: US IAM Service Providers design, implement, and manage Identity and Access Management solutions by integrating third-party technologies, rather than offering their own IAM suites. They deliver strategic advice, architectural planning, tool selection, implementation, migration, and ongoing management, using IGA, SSO/MFA, CIAM, PAM, and identity infrastructure. These providers maintain secure, compliant, and scalable governance of identities and access across hybrid environments, focusing on operationalizing, auditing, and consistently enforcing access controls.

Why Now: The US market is experiencing a surge in the demand for IAM expertise due to the rise in cyber threats and the necessity to comply with regulations like GDPR and HIPAA. This increasing dependency on IAM Service Providers highlights the need for qualified and experienced resources to ensure effective implementation and management, delivering solutions efficiently and within budget. Engaging adept service providers is crucial for organizations to maintain secure and compliant IAM frameworks.

Evaluation Focus Areas:

• Comprehensive IAM Technology Support: Full stack IAM, PAM, IGA, CIAM, and more.
• Operating Systems and Directory Services: Support across varied platforms and services.
• Integration and Customization: Tailored integration and solution customization capabilities.
• Professional Services Support: 24x7 support, human resource skills management
• Engagement support history: Types of engagements supported, number of engagements conducted over the last three years

Expected Vendor Population: 10-15 providers of IAM system integration services in the US, extending from consulting to managed services.

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Leadership Compass: IAM System Integrators North America: Go Big or Boutique? (2024)

Access Management

Market Definition: Access Management refers to capabilities that control and monitor authenticated user access to applications, systems, and data. It encompasses essential features like authentication, authorization, Single Sign-On (SSO), and identity federation, traditionally associated with Web Access Management (WAM) and Identity Federation solutions.

Why Now: As the IDaaS market surpasses on-premises IAM, organizations face challenges in integrating multiple authenticators and bridging on-premises identity infrastructure with cloud-based authentication, leading to inconsistent security and user experiences. The rise of AI agents and non-human identities (NHIs) in workflows demands a paradigm shift for secure management, requiring dynamic authentication and policy-based authorization to mitigate risks like unauthorized access and data breaches.

Evaluation Focus Areas:

• Interoperability and Integration: Supporting seamless hybrid architectures and multiple authentication standards.
• AI and NHI Management: Dynamic security for non-human identities.
• Scalability and Flexibility: Cloud-native agility for modern environments.
• Risk-Based Authentication: Enhancing security with ITDR capabilities.
• User Experience Optimization: Balancing usability with strong security.

Expected Vendor Population: 30-35 vendors excelling in providing comprehensive, flexible Access Management solutions that enhance security, streamline user experiences, and support the integration of emerging technologies within IAM frameworks.

Related KuppingerCole Research: To better understand the broader context, readers may refer to earlier publications that address adjacent market segments and capabilities:

• Leadership Compass: Access Management (2025)

Predictions & Outlook (2026-2027)

Market Consolidation

Identity Market Consolidation

The identity market will see continued consolidation around two poles: full identity platforms offering IGA, PAM, and access management in integrated suites, and specialized point solutions for specific use cases (CIAM, non-human identity, decentralized identity).

Prediction: At least two significant acquisitions will reshape the IGA vendor population by end of 2026, likely involving established players acquiring cloud-native challengers to accelerate platform modernization.

Prediction: The non-human identity management sector, especially solutions addressing IAM for AI agents, is likely to draw acquisition interest from both identity platform vendors and providers of secrets management or DevOps tools. This market segment is considered highly strategic and unlikely to remain independent.

Technology Shifts

AI Integration Maturity

As AI capabilities move from marketing slogans into core IAM and IGA workflows, organizations increasingly expect demonstrable improvements in governance quality, risk reduction, and operational efficiency. The focus shifts from generic “AI-powered IAM” messaging to measurable outcomes in access decisions, entitlement hygiene, and governance processes.

Prediction: By 2026, IGA purchasing decisions will be driven by measurable AI outcomes such as less access review effort, reduced toxic access, and more automation. Vendors that cannot show clear improvements will lose to those providing integrated, transparent AI analytics and recommendations.

Prediction: Policy-based access management (PBAM) is becoming an AI-powered system for real-time access control, using risk scores from behavioral analytics to inform decisions and update policies. For low-risk scenarios, AI will adapt policies automatically, following least-privilege and zero-trust concepts, while humans set limits and handle exceptions.

Prediction: Autonomous governance is feasible for specific IGA and access management cases, with AI-supported workflows managing joiner-mover-leaver processes, low-risk access requests, and routine privilege clean-up under policy oversight.

Zero Trust Implementation Maturity

Zero Trust transitions from architecture buzzword to measurable program with defined outcomes.

Prediction: Organizations will shift from "implementing Zero Trust" to "measuring Zero Trust maturity" using frameworks that assess actual risk reduction rather than technology deployment checkboxes.

Decentralized Identity Commercialization

Verifiable credentials and digital wallets move from pilot to production in specific high-value use cases.

Prediction: European Digital Identity Wallet initiatives drive first wave of enterprise adoption for workforce credentialing, professional certifications, and supply chain verification by late 2026.

Prediction: Decentralized identity remains complementary to, not replacement for, traditional identity management through 2027. Organizations will operate hybrid identity architectures.

Risks & Opportunities

For CISOs and Security Leaders

Prepare for:

• Board expectations for AI security strategy (both protecting AI and using AI for security)
• Operational technology security accountability expansion
• Third-party/supply chain security scrutiny intensification
• Security team skills gap in cloud-native and AI contexts

Opportunity:

• Security as business accelerant positioning (supporting AI adoption, cloud transformation)
• Automation to address talent shortage
• Consolidation to reduce operational complexity

For IAM and CIAM Leaders

Prepare for:

• Machine identity management accountability
• Passwordless authentication user expectations
• Privacy regulation complexity (especially U.S. state-level patchwork)
• IGA modernization pressure from cloud transformation

Opportunity:

• Identity as digital transformation foundation
• Customer experience differentiation through low-friction authentication
• Workforce experience improvement through consumer-grade access

For Vendors

Prepare for:

• Platform consolidation pressure (differentiate or be acquired)
• AI capability expectations across all product categories
• Customer demand for deployment flexibility (cloud, on-premises, hybrid)
• Increased scrutiny of security of vendor's own products

Opportunity:

• Market creation in new categories (AI-driven Policy-based Access, Non-Human Identity Management)
• Vertical specialization as horizontal markets mature
• Geographic expansion (especially European market with regulatory drivers)

Stakeholder Guidance: How to Use This Calendar

For CISOs and Security Leaders

Technology Roadmap Alignment

Use the LC Calendar to synchronize your technology evaluation cycles with KuppingerCole research availability:

• Q-1 to Publication: Prepare internal requirements and stakeholder alignment
• Publication Quarter: Consume LC for shortlist development
• Q+1: Conduct focused evaluations of shortlisted vendors
• Q+2: Procurement and implementation planning

Budget Cycle Considerations

If your organization follows a calendar-year budget cycle:

• Q1-Q2 LC publications inform current-year procurement decisions
• Q3-Q4 publications inform next year budget requests and planning

Vendor Evaluation Timing

Avoid vendor evaluations immediately before LC publication - waiting 4-6 weeks for updated research provides better market context and leverage in vendor negotiations.

Recommended Actions:

1. Map 2026 LC topics to your security architecture gaps
2. Identify 3-5 LCs most relevant to your 2026 priorities
3. Schedule analyst inquiries for topics requiring deeper guidance
4. Consider advisory engagement for complex selection decisions

For IAM and CIAM Program Owners

Strategy Alignment

Use the LC Calendar to validate your identity strategy against market direction:

• Are your planned initiatives aligned with market maturity?
• Are you investing in categories that are consolidating?
• Are new categories relevant to your architecture direction?

Capability Gap Identification

Map your current identity capabilities against planned LCs:

• Topics without coverage suggest potential gaps
• Multiple relevant LCs may indicate fragmented point solution approach
• Use LCs to assess vendor consolidation opportunities

Business Case Support

LC publications provide objective market context for investment justification:

• Market growth data supports investment rationale
• Competitive analysis demonstrates peer behavior
• Vendor positioning informs build-vs-buy decisions

Recommended Actions:

5. Review Q1-Q2 identity LCs (IGA, Access Management, CIAM, PAM) for full market understanding
6. Assess machine identity gap - most organizations underestimate this exposure
7. Use LC criteria to benchmark current vendor capabilities
8. Plan IGA modernization evaluation if operating legacy platform

For Vendors and Product Teams

Product Strategy Alignment

Understand how KuppingerCole will evaluate your market to inform product direction:

• Review prior LC evaluation criteria to identify capability gaps
• Anticipate criteria evolution based on trends section
• Assess positioning in adjacent categories as markets converge

LC Inclusion Timeline

If you seek inclusion in an upcoming LC:

The Leadership Compass: Understanding the Framework

What is a Leadership Compass?

A Leadership Compass is KuppingerCole's vendor evaluation for a defined market segment. Each LC provides:

• Market definition and scope boundaries
• Vendor evaluations across standardized criteria
• Comparative analysis through visual positioning
• Guidance for technology selection decisions

Unlike point-in-time snapshots, Leadership Compass reports represent sustained research efforts incorporating vendor briefings, customer references, product demonstrations, and ongoing market monitoring.

The KuppingerCole Research Framework

The Leadership Compass sits within a broader research portfolio designed to support technical decisions at every stage:

What Makes KuppingerCole's Approach Distinct

Global Reach with European Perspective: Our analyst team maintains global coverage while having deep expertise in European market specifics, including regulatory environments (GDPR, NIS2, DORA, eIDAS).

Practitioner Experience: Our analysts combine rigorous research with practical insights gained from close involvement in real-world implementation contexts, while maintaining full independence.

Independence: KuppingerCole maintains strict separation between research and commercial activities. Commercial relationships do not influence vendor inclusion or ratings.

Transparency: This Research Compass exemplifies our commitment to methodology transparency - we explain not just what we evaluate, but how and why.

Methodology & Process

Understanding how Leadership Compass reports are produced helps readers contextualize our findings and apply them appropriately in their decision-making.

Topic Selection Criteria

LC topics are selected through structured evaluation considering:

Client Demand Signals

• Frequency of analyst inquiry topics
• Advisory project patterns
• Conference session attendance
• Direct client requests

Market Evolution Indicators

• Vendor population changes (new entrants, exits, M&A)
• Technology maturity progression
• Competitive differentiation patterns
• Pricing model shifts

Regulatory & Compliance Drivers

• New regulatory requirements creating market demand
• Compliance deadlines for driving procurement cycles
• Regional regulatory variations requiring market segmentation

Technology Shifts

• Capabilities reaching production readiness
• Architecture changes (cloud-native, API-first)
• Integration pattern evolution
• AI/ML capability maturation

Vendor Selection Process

Inclusion Criteria:

• Active market presence with generally available product
• Minimum customer deployment base (varies by market maturity)
• Sufficient market traction to warrant evaluation effort
• Geographic availability aligned with report scope
• No minimum revenue threshold: inclusion based on comprehensive market coverage

Invitation Process:

9. Market scanning to identify candidate vendors
10. Formal invitation with timeline and requirements
11. Vendor questionnaire completion
12. Product demonstration and briefing
13. Customer reference validation
14. Draft review for factual accuracy

Note: Vendor participation is voluntary. Non-participation does not prevent inclusion if sufficient public information exists, though depth of coverage may be limited.

Evaluation Framework

Each Leadership Compass employs KuppingerCole's standardized evaluation dimensions:

Security

• Architecture and design principles
• Compliance certifications
• Vulnerability management
• Data protection capabilities

Functionality

• Core feature completeness
• Advanced/differentiating capabilities
• Integration breadth and depth
• Customization and extensibility

Deployment

• Deployment models including on-premises, hybrid, and Software as a Service (SaaS)
• Implementation complexity
• Time to value
• Operational requirements
• Upgrade and maintenance burden

Interoperability

• Standards support
• API coverage
• Partner integrations
• Migration capabilities

Usability

• Administrative experience
• End-user experience
• Documentation quality
• Support effectiveness

These dimensions are weighted based on market-specific priorities and aggregated into overall ratings for Product Leadership, Innovation Leadership, and Market Leadership.

Lifecycle & Refresh Cadence

Initial Publication: Full market evaluation

Major Revision (18-24 months): Complete re-evaluation with updated vendor population, revised criteria reflecting market evolution, and refreshed ratings

Retirement: Markets that consolidate, merge with adjacent categories, or become commoditized may be retired or merged into broader evaluations

Quality Assurance

• Multi-analyst review for objectivity and completeness
• Vendor fact-check on draft (factual accuracy only, not ratings)
• Editorial review for consistency and clarity
• Methodology audit ensuring criteria application consistency

Copyright

© 2026 KuppingerCole Analysts AG. All rights reserved. Reproducing or distributing this publication in any form is prohibited without prior written permission. The conclusions, recommendations, and predictions in this document reflect KuppingerCole Analysts' initial views. As we gather more information and conduct deeper analysis, the positions presented here may undergo refinements or significant changes. KuppingerCole Analysts disclaims all warranties regarding the completeness, accuracy, and adequacy of this information. Although KuppingerCole Analysts' research documents may discuss legal issues related to information security and technology, we do not provide legal services or advice, and our publications should not be used as such. KuppingerCole Analysts assumes no liability for errors or inadequacies in the information contained in this document. Any expressed opinion may change without notice. All product and company names are trademarks™ or registered® trademarks of their respective holders. Their use does not imply any affiliation with or endorsement by them.

KuppingerCole Analysts supports IT professionals with exceptional expertise to define IT strategies and make relevant decisions. As a leading analyst firm, KuppingerCole Analysts offers firsthand, vendor-neutral information. Our services enable you to make decisions crucial to your business with confidence and security.

Founded in 2004, KuppingerCole Analysts is a global, independent analyst organization headquartered in Europe. We specialize in providing vendor-neutral advice, expertise, thought leadership, and practical relevance in Cybersecurity, Digital Identity & IAM (Identity and Access Management), Cloud Risk and Security, and Artificial Intelligence, as well as technologies enabling Digital Transformation. We assist companies, corporate users, integrators, and software manufacturers to address both tactical and strategic challenges by making better decisions for their business success. Balancing immediate implementation with long-term viability is central to our philosophy.

For further information, please contact clients@kuppingercole.com.