Part 3 of 3

By Vidyaa Ganesh

This is Part 3 of a three-part series on IAM maturity measurement. Part 1 reviewed the published research showing that 60-70% of organizations remain at early-to-mid stages of IAM maturity. Part 2 examined the frameworks currently available and the structural reasons no standard has emerged. This final installment proposes what a credible standard would need to include.

If the IAM community is going to move toward standardized measurement, what would a credible framework need to look like? Based on the published research reviewed in this series, established precedent from other domains, and the practical needs of practitioners, seven design principles emerge.

Principle 1: Domain Decomposition, Not Monolithic Scoring

IAM is not one thing. A useful maturity framework must decompose the discipline into distinct domains and assess each independently before producing any aggregate score. Treating IAM as a monolith obscures critical gaps. An organization with excellent identity governance but absent privileged access controls has a fundamentally different risk profile than one with moderate capabilities across the board, even if their aggregate scores are identical.

Gartner’s six-dimension structure is a reasonable reference point for domain decomposition. At minimum, a framework should separately assess identity lifecycle management, access management and authentication, privileged access management, and governance. Depending on the organization’s context, customer identity, cloud identity, and identity threat detection may also warrant distinct assessment.

Principle 2: Foundational Prerequisites Must Gate Advanced Claims

This may be the single most important design principle. A framework must account for the reality that some IAM capabilities are prerequisites for others. An organization that has deployed sophisticated analytics and AI-driven threat detection but has not implemented basic multi-factor authentication on privileged accounts has a fundamentally flawed security posture. A credible maturity score should reflect that.

This principle is well-established in adjacent fields. CMMI’s staged representation explicitly requires lower-level process areas to be satisfied before higher-level ratings can be claimed. SailPoint’s Horizons framework states that to be placed in a given horizon, capabilities must cover most environments and identity types. CISA’s Zero Trust Maturity Model states that identity pillar capabilities must be established before device trust can be meaningful.

A standardized IAM framework should identify a limited set of foundational controls and ensure that gaps in those controls are reflected in the overall maturity score. Without this, organizations can game the assessment by investing in visible, advanced capabilities while neglecting the basics that actually prevent breaches.

Principle 3: Risk-Weighted Scoring

Not all IAM controls carry equal risk. The presence or absence of MFA on privileged accounts has a materially different security impact than the presence or absence of a formal identity data classification scheme. A credible framework must reflect this through some form of risk-weighted scoring.

Published research supports this approach. IBM’s 2025 data shows that organizations with extensive security automation experienced average breach costs of $3.62 million compared to $5.52 million without, a 34% cost reduction attributable to mature controls. Microsoft’s Digital Defense Report found that MFA blocks over 99% of account compromise attacks. The data makes clear that certain controls deliver disproportionate risk reduction and should be weighted accordingly.

Principle 4: Industry-Contextualized Benchmarks Derived from Empirical Data

A maturity score in isolation is nearly useless. What makes it actionable is context: how does this score compare to others in the same industry, of similar size, facing similar regulatory requirements? A credible framework must include an empirical benchmark layer.

The data for this already partially exists. SailPoint publishes industry breakdowns. Ponemon publishes breach cost data by industry. Simeio publishes maturity scores by vertical. What does not exist is a single, consistent benchmark set that covers all IAM domains across major industries. Building this requires either a large-scale survey effort or, more practically, the aggregation of assessment data across organizations over time, with appropriate anonymization and consent.

Principle 5: Transparency of Methodology

Every number in a maturity assessment should have a documented derivation. If a domain receives a higher weight than another, the rationale should be published. If a benchmark is based on a specific data source, that source should be cited. If a benchmark is estimated rather than measured, that should be disclosed.

This level of transparency is uncommon in commercial assessment tools, where scoring logic is often proprietary. But for a community standard, it is essential. Consultants need to be able to explain and defend the numbers they present to clients. CISOs need to trust that the methodology is sound before presenting results to their boards. Transparency is not just a nice-to-have. It is a prerequisite for adoption.

Principle 6: Technology Agnosticism

A standardized framework must assess capability, not tooling. The question is not whether an organization has deployed a specific vendor’s IGA platform, but whether it has a functioning identity lifecycle management process that covers joiners, movers, and leavers with appropriate automation and oversight. This distinction matters because organizations achieve similar maturity outcomes with very different technology stacks, and a useful standard must accommodate that diversity.

Principle 7: Actionable Outputs

A maturity assessment that produces only a number is insufficient. The assessment process should produce outputs that enable direct action: identification of specific capability gaps, prioritized remediation guidance, regulatory compliance mapping, and clear criteria for what moving from one level to the next requires.

Gartner’s recommendation of outcome-driven metrics for IAM aligns with this principle. The goal of measurement is not the score itself but the improvement roadmap it enables. A framework that scores but does not guide action is an academic exercise.

Gaps and Open Questions

Even with sound design principles, significant gaps remain that the community will need to address.

Non-human identity. Machine identities (service accounts, API keys, certificates, workload identities) now outnumber human identities by ratios that CyberArk’s 2025 research places at approximately 80 to 1. Yet most maturity models treat identity as synonymous with human identity. A credible standard will need to account for non-human identity management as a distinct assessment domain.

AI agent governance. As AI agents increasingly operate autonomously within enterprise environments, the question of how to govern their identities, permissions, and access patterns is emerging as a new challenge. SailPoint’s 2025 Horizons research added AI agent governance to its capability thresholds. No existing maturity model addresses this domain in depth. Any framework designed for longevity should be extensible enough to incorporate it.

The data collection problem. The most practical path to building reliable industry benchmarks is through the aggregation of anonymized assessment data across many organizations over time. This creates a chicken-and-egg problem: organizations are reluctant to contribute data to a benchmark pool unless the benchmark already exists, and the benchmark cannot exist without contributed data. Solving this will likely require a combination of opt-in data sharing, strong privacy guarantees, and a trusted neutral party to manage the aggregation.

Weighting validation. Any risk-weighted scoring system involves judgment calls about how much weight to assign to different controls and domains. These weights can be informed by published research on breach costs, attack frequency, and control effectiveness, but they cannot be fully derived from first principles. Ongoing validation through correlation analysis between assessment scores and actual security outcomes is needed to refine the weights over time.

Conclusion

The IAM community has a measurement problem. Five independent research sources, covering over 2,000 respondents, consistently show that 60% to 70% of organizations are at early-to-mid stages of IAM maturity. At the same time, the industry relies on a fragmented set of incompatible frameworks that prevent meaningful comparison, benchmarking, or progress tracking.

This is not a technology problem. The tools exist. This is a standards problem. The community lacks a shared, vendor-neutral, empirically-grounded framework for measuring IAM maturity, and the absence of such a standard has real consequences: CISOs cannot articulate their posture to boards in comparable terms, consulting firms deliver assessments that start from scratch with each engagement, and the industry has no aggregate data pool that could identify systemic weaknesses and drive collective improvement.

The design principles outlined in this series are not radical. Domain decomposition, foundational prerequisite gating, risk-weighted scoring, empirical benchmarks, methodology transparency, technology agnosticism, and actionable outputs are all well-supported by existing research and established practice in adjacent disciplines. What is missing is the will to build and adopt a standard that incorporates them.

Identity practitioners are the people best positioned to solve this. They live the problem daily. They understand the domains. They see the consequences of unmeasured and unmeasurable IAM programs. The question is whether the community will continue to tolerate a landscape where every assessment is a one-off, or whether it will converge on a shared approach that raises the bar for everyone.

About the Author

Vidyaa Ganesh is a Senior IAM Engineer and Team Lead at Raah Technologies, with over six years of experience spanning enterprise IAM implementations, strategic advisory, and maturity assessments. She has held consulting roles at KPMG Canada and Indigo Consulting, delivering identity governance and privileged access programs for financial services, energy, telecommunications, and public sector clients. She holds Okta and Saviynt certifications and a Master of Engineering from Concordia University. She is a member of IDPro.

Endnotes

17. Gartner, IAM Program Maturity Model (September 2025).

18. ISACA, CMMI Version 3.0: “A maturity level rating is achieved when all process areas at that level have been appraised as meeting their specific and generic goals.”

19. SailPoint, Horizons 2025-2026: “To be in one horizon, customer capabilities need to cover most environments and identities.”

20. CISA, Zero Trust Maturity Model (2023).

21. IBM Security, Cost of a Data Breach Report 2025.

22. Microsoft, Digital Defense Report (Microsoft Security, 2024).

23. NIST, SP 800-30 Rev 1: Guide for Conducting Risk Assessments (2012). See also FAIR Institute.

24. SailPoint, Horizons 2025-2026, Exhibit 7.

25. IBM Security, Cost of a Data Breach Report 2025, Industry Analysis section.

26. Simeio, State of Identity 2024.

27. Gartner, IAM Program Maturity Model (September 2025). Recommends outcome-driven metrics (ODMs).

28. CyberArk, The Urgent Reality of Machine Identity Security in 2025 (CyberArk, 2025), 2,600 decision-makers.

About the Author

Vidyaa Ganesh is a Senior IAM Engineer and a solutions architect with over six years of experience delivering identity governance programs for financial services, energy, telecommunications, and public sector clients. She holds a Master of Engineering from Concordia University, is a member of IDPro, and is the creator of AXIS (axis.identara.ca), an open IAM maturity assessment framework.

The post What Good IAM Measurement Looks Like appeared first on IDPro.

Part 1 of 3

By Vidyaa Ganesh

Five independent sources, 2,000+ respondents, one conclusion: most organizations cannot measure their IAM maturity. And that is a problem.

Identity and access management has become one of the most consequential areas of enterprise security. The IDSA’s 2024 survey of 521 security professionals found that 90% of organizations experienced at least one identity-related security incident in the prior 12 months, with 84% reporting direct business impact. IBM’s 2025 Cost of a Data Breach report, based on 600 organizations and over 3,400 interviews, puts the global average breach cost at $4.88 million, with compromised credentials remaining the most common initial attack vector.

These numbers create obvious pressure for organizations to invest in IAM. And they are investing. But a harder question follows: how do you know whether your IAM program is actually working? How do you measure where you stand relative to your industry, track improvement over time, or communicate your posture to a board of directors in terms that hold up to scrutiny?

The honest answer, as of early 2026, is that most organizations cannot do any of these things reliably. There is no widely accepted, vendor-neutral framework for measuring IAM maturity. What exists instead is a patchwork of vendor-specific models, consultant-developed scorecards, and ad hoc approaches that vary from one engagement to the next. The measurements produced by these approaches cannot be compared across organizations, across time, or even across different consultants assessing the same organization.

This is the first installment in a three-part series examining this problem. In this piece, we look at what the published research actually says about where organizations stand. In Part 2, we survey the frameworks currently in use and analyze why no standard has emerged. In Part 3, we propose design principles that a credible, community-adopted standard would need to follow.

What Published Research Tells Us

Before discussing what a standard should look like, it is worth understanding what the data actually says about where organizations stand. Several independent research efforts have attempted to measure IAM maturity across large populations, and their findings tell a remarkably consistent story.

SailPoint Horizons of Identity Security (2025-2026)

SailPoint’s annual Horizons research surveyed 375 IAM decision-makers across North America, Europe, Asia, and Latin America. The study evaluates organizations across four enablement areas (strategy, technology and tools, operating model, and talent) covering 60 IAM capabilities, then assigns each organization to one of five maturity horizons using a clustering algorithm.

The headline finding is striking: over 40% of organizations remain at Horizon 1, the lowest maturity level. These are organizations where identity is not a strategic focus, capabilities are highly immature, and there is no centralized operating model for managing identities across the organization. When you include Horizon 2, the number climbs to roughly 63% of organizations stuck at the bottom two tiers.

Industry breakdowns reveal meaningful variation. In financial services, 34% are at Horizon 1, with 13% reaching Horizon 4 or above. In technology, the distribution is bimodal: 46% at Horizon 1, but 15% at Horizon 4 or higher, reflecting a split between early-stage companies with minimal IAM investment and mature enterprises with sophisticated programs.

Ponemon Institute and GuidePoint Security (2025)

The Ponemon Institute, in partnership with GuidePoint Security, surveyed 626 IT professionals on the state of IAM maturity in 2025. On a 10-point effectiveness scale, only 50% of respondents rated their IAM tools as effective (scoring 7 or higher). Just 23% qualified as high performers, rating their effectiveness at 9 or 10.

The study also found that 50% of organizations experienced an identity-related incident in the prior 12 months. Even among high performers, 39% still experienced incidents, compared to 58% for others. Manual processes remain dominant: 34% of organizations still use spreadsheets for access reviews, and only 17% use an identity governance platform for this purpose.

IDSA Trends in Identity Security (2024)

The Identity Defined Security Alliance surveyed 521 qualified security professionals at organizations with 1,000 or more employees. The findings reinforce the pattern: 90% experienced an identity-related incident, 84% reported direct business impact, and 91% invoked their incident response plans for identity-related events.

When asked to self-assess their maturity, only 8% of respondents placed their organization at the highest level. The majority clustered in the middle tiers, suggesting widespread acknowledgment that current capabilities are insufficient.

Other Sources

Bravura Security, in partnership with Gartner Peer Insights, conducted a smaller study of 100 IT leaders across North America and EMEA using a four-level maturity scale. Their finding: the average organization falls between levels 2 and 3 on a four-point scale, consistent with the other sources.

Simeio’s State of Identity research, covering 80 measures across industries, found a cross-industry average maturity of 2.4 on a five-point scale. Financial services scored highest at approximately 2.6, with healthcare and public sector trailing.

What the Data Tells Us

Five independent research efforts, using different scales, different sample sizes, and different methodologies, converge on the same conclusion: the majority of organizations, somewhere between 60% and 70%, remain at early-to-mid stages of IAM maturity. The consistency across sources is significant. This is not one vendor telling a convenient story. It is a pattern that holds up regardless of who is asking the question or how they frame it.

Table 1. Cross-source validation of IAM maturity findings

NEXT IN THIS SERIES

Part 2: A Landscape of Incompatible Approaches

Several maturity frameworks exist in the IAM space. Each offers something useful. None has achieved the status of a shared standard. We examine why.

Endnotes

1. Identity Defined Security Alliance, 2024 Trends in Securing Digital Identities (IDSA, 2024), 521 respondents.

2. IBM Security, Cost of a Data Breach Report 2025 (Ponemon Institute Research, 2025), 600 organizations, 3,470 interviews.

3. SailPoint Technologies, The Horizons of Identity Security 2025-2026 (SailPoint, July 2025), 375 IAM decision-makers.

4. SailPoint, Horizons 2025-2026, Exhibit 7, p. 15.

5. Ponemon Institute and GuidePoint Security, The State of Identity and Access Management (IAM) Maturity (May 2025), 626 IT professionals.

6. Identity Defined Security Alliance, 2024 Trends in Securing Digital Identities (IDSA, 2024).

7. Bravura Security and Gartner Peer Insights, IAM & PAM Maturity Survey (Bravura Security, 2024), 100 IT leaders.

8. Simeio, State of Identity 2024 (Simeio Solutions, 2024).

Disclaimer: The views expressed in the content are solely those of the author and do not necessarily reflect the views of the IDPro organization.

About the Author

Vidyaa Ganesh is a Senior IAM Engineer and a solutions architect with over six years of experience delivering identity governance programs for financial services, energy, telecommunications, and public sector clients. She holds a Master of Engineering from Concordia University, is a member of IDPro, and is the creator of AXIS (axis.identara.ca), an open IAM maturity assessment framework.

The post The Measurement Problem appeared first on IDPro.