The emergence of agentic identity security adds another dimension to all of this. AI agents are now accessing systems, making decisions, and acting on behalf of organisations, and the identity conversation has expanded from how we authenticate users to how we ensure an agent gets precisely the access it needs and nothing more, while continuously verifying it stays within those boundaries.

Doing that well requires real-time correlation of identity events across your SSO provider, cloud IAM, application logs, and privileged access tools at a speed and scale that most traditional SIEM platforms weren’t designed to handle. Protecting identities in 2026 means protecting every identity: human, machine … and agent.

John Cannava
CIO at Ping Identity

From an IT leadership perspective, Identity Management Day takes on new urgency this year as both individuals and organisations are managing human identities while also governing AI as it takes on increasingly agentic roles. The impact AI will have on identity will likely be far greater than we anticipate, which means our approach to security has to evolve in lockstep.

In this new reality, the login is no longer the primary security boundary – access must be continuously evaluated and enforced. In agentic systems, risk doesn’t end at sign-in; it evolves dynamically at runtime as users and systems interact. Identity can no longer be verified once and trusted indefinitely. It must be continuously evaluated at every high-impact action.

That’s why approaches like zero trust and decentralised identity are becoming critical to reducing risk while still enabling the business to move quickly. As AI-driven attacks increasingly target centralised data and try to imitate legitimate users, organisations need to move away from single points of failure and verify every access request in real time, no matter who or what is behind it. This requires rethinking identity across both workforce and customer environments.

As the way we work continues to change, the focus has to be on securing the workforce, maintaining customer trust, and delivering digital experiences that are both seamless and secure. The future of identity will depend on how well we adapt to this more dynamic, continuous model of trust.

Sean Deuby
Principal technologist at Semperis

The sixth Identity Management Day highlights the evolving nature of identity.

The meteoric rise of AI in general and its impact on non-human identities (NHIs) has focused attention on identity security as never before. But in the long view, it simply highlights the same issues we have seen in identity management since it was called “identity management”. And discovery has always been a part of it.

Enabling the business has always been the priority for IT. Managing the identity pieces you have created for the business has not, because it does not directly benefit the business.

Do you need this group created, populated, and added to an application? Sure. Do you need this service account immediately? Right away. Let’s give it some extra privileges because we know we will not have to troubleshoot permission problems in the future.

But ask yourself: how often have you seen “Please remove this account because we’re not using it anymore”? Rarely. Unless you’re a regulated business, identity governance and administration (IGA) is usually an afterthought. This has been the reality of IT as long as there’s been IT.

I lump this into the identity security category I call “eat your vegetables”: you know it’s good for you, but you don’t do it enough. Even after 26 years of general availability, identity governance is far from a given in Active Directory environments, especially smaller ones.

Since identity systems such as Active Directory have very long lifespans, these daily decisions accumulate over years or decades of production. Organisations find they have thousands or tens of thousands of under-regulated NHIs (we call them service accounts on premises). This is one of many reasons identity systems are a favourite target of threat actors; they know very well these NHIs are overprivileged, underprotected, and neglected.

Take these same factors, surround them with the tinder of cloud services’ ease of use, pour the gasoline of AI onto it, and give developers the match. That’s the dumpster fire we’re looking at today, with NHIs outpacing human identities at what seems like a geometric progression. We’re right to be concerned.

How does “finding identity” fit into this? We can’t just wring our hands about the situation; we need to take steps immediately. We must put controls in place as soon as possible. And we must discover what’s already out there, using any tools we have, so we know the scope. You don’t know the size of your dumpster fire until you’ve looked.

Nam Lam
Group vice president, Australia and New Zealand, at SailPoint

World Identity Management Day is a moment to ask an honest question: Is the way we think about identity keeping pace with the world we are actually operating in?

For most organisations, the answer is no. Identity security has traditionally been treated as a static discipline. You grant access, you review it periodically, and you hope nothing changes too dramatically in between. But the enterprise of 2026 is anything but static. Workforces shift constantly, and applications multiply into the thousands. AI agents are proliferating across business units at a pace that outstrips any governance program built for the human era.

The result is a growing gap between what organisations think they have under control and what is actually happening across their identity landscape. In Australia and New Zealand, that gap carries real regulatory, financial, and reputational consequences.

Part of the problem is how we still define risk. In the past, privileged access belonged to a select few. Today, a payroll bot approving salary runs or a junior analyst with API access to sensitive data can each trigger significant impact. Risk no longer lives in job titles. It lives in context, and that is precisely what static governance was never designed to read.

What this day should prompt is a shift in mindset to embrace an adaptive identity security model. Static controls tell you who had access last year. Adaptive identity security tells you whether the access being requested right now, in this context, by this identity, at this hour, makes sense and acts accordingly. It is also the layer that makes zero trust work in practice. Many Australian organisations have embraced zero trust in principle but struggle to operationalise it, because architecture alone cannot enforce least privilege dynamically. Adaptive identity security provides that enforcement.

SailPoint’s own research makes the urgency clear. Eighty-two per cent of enterprises are already using AI agents, yet fewer than half have governance policies to manage them. Seventy-five per cent of machine identities have no designated owner. Each one represents an access pathway that nobody is watching.

The tools to address this exist today. Real-time risk scoring, just-in-time access, continuous authorisation, and unified visibility across human and non-human identities are well within reach, and the organisations investing in them are moving faster, complying more confidently, and recovering more quickly when threats materialise.

Identity security is not a control function. It is the foundation on which a secure, resilient, and agile enterprise is built. World Identity Management Day is a prompt to treat it that way.

Brett Chase
Director, Sales Engineering, APJ at Cohesity

Identity is at the core of today’s cyber threat landscape. Nine out of ten cyberattacks now start with identity through compromised credentials or misused identities. In Australia, the rise of materially significant cyber incidents makes it clear that weak or inconsistent identity management practices remain a major but preventable root cause.

Historically, identity management has been viewed through a narrow, human-centric lens, focused on employee access controls, enforcing role‑based permissions, and ensuring workers have the right level of access to applications and data. But that view is now outdated.

The reality is that this no longer reflects today’s digital environments. When identity controls are weak, attackers exploit the gaps using social engineering, credential theft, and technical exploits. Techniques such as phishing, password spraying, MFA fatigue, or credential-stealing malware allow attackers to gain an initial foothold. Once inside, they impersonate legitimate users, escalate privileges, and move laterally across networks, often undetected, to gain access to critical systems and data.

The rapid adoption of generative AI, automation, and emerging agentic systems has also increased the prevalence of non-human identities such as scripts, workloads, and AI agents that can access and act on data at speed. Without proper governance and controls, these non-human identities can become an unmonitored pathway for attackers.

James Ross
Regional Vice President – ANZ, at Saviynt

Identity management was built for people, but today, the busiest users in your network aren’t human. We are seeing an explosion of non-human identities—from simple automation scripts to autonomous AI agents, all interacting with sensitive data at a velocity no human could match.

The friction lies in how these entities behave. They don’t take breaks, they make independent decisions, and they usually ship with broad permissions by design. Yet, most teams are still trying to shove these machine behaviours into security frameworks designed for a 9-to-5 workforce.

Identity can't just be a compliance checkbox anymore; it has to be the principal system for governance and enforcement point. Organisations that recognise this shift will be able to deploy AI safely. Those that don’t are essentially handing the keys to a fleet of autonomous actors they can’t see, let alone stop.