Identity & Access Management has evolved into the nerve centre of the digital enterprise. It not only regulates access, but increasingly serves as a detection mechanism, response accelerator and strategic enabler for growth and innovation. In an era where AI agents make autonomous decisions, employees work from anywhere, and corporate data is distributed across multiple clouds and applications, the quality of (logical) access management determines whether an organisation can operate safely and agilely.

The bar is high. Under pressure from regulations such as NIS2, DORA and the AI Act, organisations must carefully document who, when and why gains access. At the same time, the threat landscape is shifting: not the first login attempt, but the misuse of existing accounts lies at the root of more than 80% of incidents involving data breaches or disruptions.[1] Legacy systems are primarily designed to enable access, not to detect and curtail abnormal usage at lightning speed, as recently became evident in incidents at the Public Prosecution Service and Eindhoven University of Technology.

Moreover, the concept of 'user' has expanded significantly. Beyond employees and external partners, applications, bots, scripts and AI models also require access. The number of these non-human identities is growing faster than any other identity type due to automation, cloud technology and supply chain collaboration. At 70% of organisations, there is no explicit policy for this type of user, and these entities fall outside the scope of access policies and monitoring. The result: a larger attack surface and limited control over an increasingly complex ecosystem.

These challenges compound existing bottlenecks: cumbersome onboarding and offboarding, limited visibility into entitlements structures, and the tension between usability and control. Organisations that view access management solely as a compliance instrument thereby fall behind. Industry leaders instead invest in AI-driven detection, automated lifecycle workflows and real-time synchronisation of identity data. They realise measurable benefits: lower costs, higher productivity and significantly less risk.

This research explores how organisations position access management within their broader security strategy. We examine the maturity of policies, how they handle human and non-human identities, the ability to contain incidents and collaboration between IT and security.

Participating in this research provides insight into where your organisation stands relative to peers, which approaches colleagues adopt and what strategic choices lie ahead. The results give you a clear picture of current practice and the direction in which others are moving. You will also receive a personalised benchmark report that invites reflection. [1] https://www.traxion.com/nl/blog