Prediction one: a shift toward stronger, smarter passwordless authentication
We may finally see a shift from the longstanding practice of forced periodic password changes as IT departments worldwide adopt guidance from major cybersecurity authorities. The National Cyber Security Centre (NCSC), the European Union Agency for Cybersecurity (ENISA), and the National Institute of Standards and Technology (NIST) all recommend against mandatory password resets, citing evidence that frequent changes often lead to weaker passwords and reduced security. This shift could be a significant step forward in balancing security with user experience.
Easy-to-use enterprise-level alternatives to using passwords for operating systems such as Windows 10/11 include innovative authentication methods such as the Fast Identity Online (FIDO) standards. Windows Hello and Microsoft Edge have been supported by FIDO since 2018, yet widespread adoption of physical (FIDO2) keys in enterprise settings is still lagging due to cost barriers. We’ve seen the adoption of mobile passkeys (FIDO2) that are claimed to be phishing-resistant and are easy to use. Passkey usage means users no longer need to enter usernames and passwords for authentication. The passkey uses device biometrics to unlock their devices to sign into apps and websites. Expect the usage of passkeys to continue to accelerate in 2025.
Prediction two: the rise of AI-driven human augment decision-making in identity management
In 2025, we may see the first widespread implementation of AI-human augmented decision-making in identity management. Not all organizations are ready to configure systems to ‘just do it’, that is, allowing AI to make decisions without human intervention; the industry will closely observe whether the human AI-augmented decision-making approach delivers value and can build trust. A key challenge to full automation of decision-making will be the transparency of recommendations and how humans can override automatically made decisions with feedback, adjusting the recommendation engine for future decisions. Decision makers need to feel confident that they can trust the recommendation and that their feedback is effective, because they’re still accountable to the business when critical identity decisions are made without direct human oversight.
Prediction three: from preventative to proactive security with GenAI integration
Identity governance and administration (IGA) products will likely evolve into more proactive security tools. For example, offering real-time recommendations and insights to enhance IT security operations and maintain identity / data hygiene. Moving on from analysis of existing assigned permissions and incorporating user behavior / behaviour information as well, especially from cloud/SaaS systems that can easily share these logs. Integrating Generative AI will be a key driver in this change to become more proactive. For example, intelligent notifications using desktop collaboration tools to deliver daily ‘messages of the day’ with personalized suggestions to strengthen identity security posture. Traditionally focused on prevention, IGA will shift toward contributing to operational security and security hygiene posture. The adoption of new, user-friendly interaction methods, such as the Generative AI-powered natural language model, will drive this transformation.
Prediction four: enhanced vendor support for the Shared Signals Framework
In 2025, we’ll see accelerated adoption of the OpenID Shared Signals Framework (SSF) from vendors as organizations prioritize real-time communication between security tools to enhance adaptive security postures. With the identity perimeter now central to modern security strategies, more enterprises will integrate SSF to achieve seamless data sharing across disparate systems, enabling a more resilient defense / defence against evolving threats. With its flexibility and scalability, the SSF will lead to more collaborative security ecosystems, breaking down silos across cloud providers, SaaS applications, and security systems, thereby enhancing security in an increasingly hybrid and complex environment.
Prediction five: balancing regulation and innovation for enhanced security
Regulation will continue to shape Identity Governance and Administration, with frameworks like the Network and Information Systems 2 (NIS2), Digital Operational Resilience Act (DORA) in the EU reinforcing compliance-driven initiatives. At the same time, a push toward corporate effectiveness will highlight the efficiency benefits of automated and AI-supported IGA solutions. In both instances, security will remain a priority, with principles like ‘least privilege’ becoming crucial to limit hacker access, aiming to ensure that, if an attacker gains entry, their ability to move across systems and platforms is restricted, mitigating potential damage.
Another hot spot where regulation and innovation are coming together is the EU AI Act. As AI is offered in high-risk applications such as Identity and Access Management (IAM) and IGA, there’s plenty of analysis and preparation for vendors as well as customers. The EU AI Act represents a landmark regulatory effort as it attempts to balance safeguards to protect individuals from potential harm but must not restrict innovation.
Prediction six: GenAI/ML will enhance identity governance
GenAI and machine learning (ML) are likely to play a more significant role in Identity Governance and Administration by simplifying tasks like access requests and approvals, where they can provide valuable guidance and support. However, the effectiveness of GenAI/ML in the deepest aspects of IGA, such as business logic analysis and role mining, may be limited due to bad data hygiene. This often results from inconsistent governance and could skew GenAI/ML insights. Nonetheless, AI/ML will be useful at a higher level, potentially aligning regulatory requirements, business processes, and job-related permissions more effectively. The goal of this particular innovation is ‘can a user and chat assistant accomplish their goal with a time and cost reduction?’ We estimate that the cost per transaction of a user and AI chat assistant will be a fraction of a help desk call price.
Predictions one to four are by Paul Walker, field strategist, five and six are by Theis Nilsson, vice president global advisory practice, Omada
