Identiverse 2025 once again proved to be a cornerstone event for identity and access management (IAM) professionals, offering a week packed with insights, innovation, and collaboration in Las Vegas. The conference detailed new challenges and trends facing the industry while highlighting the emerging solutions that are shaping today’s identity landscape. From AI-informed strategies to the rise of non-human identities, here’s a comprehensive look at some of the most significant takeaways from this year’s event.

The Push for Convergence

A dominant theme throughout the conference was the urgent need for convergence. Unifying identity and network access, aligning business goals with security priorities, and bridging the gap between technical teams and executive leadership were emphasized across multiple keynotes and sessions. Speakers underscored that identity is no longer just a subset of IT, but a central pillar of organizational strategy, requiring cross-departmental collaboration and a shared vision.

AI Agents: A New Frontier

AI agents and agentic AI were frequently mentioned, signaling their growing importance in identity security. Organizations are grappling with how to safely deploy these agents to enhance efficiency and reduce costs without introducing undue risks. These agents, with their expanded access privileges, could potentially cause financial damage or privacy breaches if not properly governed.

Key challenges include the lack of governance frameworks or standards for managing AI agents, highlighting the need to treat them as a new user type akin to traditional categories such as employees, contractors, and vendors. This emerging focus on AI agents underscores the necessity of developing robust security measures and policies to safeguard their use.

Non-Human Identities Take Center Stage

Non-human identities, spanning service accounts, APIs, bots, IoT devices, and AI agents, outnumber human identities in many organizations today. Recent ESG research shows NHIs exceed human identities by at least 20:1, and the gap is increasing. Managing these identities has become a significant priority, as their lack of clear ownership, lifecycle management, and proper controls creates considerable security risks.

Conference discussions emphasized the following key points:

• A push to establish machine identity management as its own program, complete with standards for naming, ownership, access, and credential rotation.
• Integration with DevOps and CI/CD pipelines to automate identity creation and enforce least privilege from inception.
• The application of Zero Trust principles to non-human identities, including strong authentication and continuous monitoring.
• Emerging tools like SPIFFE, workload identity federation, and secrets managers as viable solutions to manage the complexity of these identities.

One intriguing innovation discussed was the use of transactional tokens: short-lived, narrowly scoped tokens issued just-in-time for specific API calls or operations. These tokens help enforce least privilege principles, reduce credential misuse risks, and support Zero Trust security for non-human identities.

[Watch Now: Machine Identities: Uncovering the Hidden Risks in your Environment]

Notable Session Insights

Our team found that several conference sessions provided deep insights and practical advice.

“Why IGA Projects Fail”

This session candidly examined the common pitfalls that derail identity governance and administration (IGA) initiatives. Key issues identified included the lack of clear business ownership, excessive customization, and neglect of change management. The session’s core takeaway was that effective governance requires disciplined program management and stakeholder alignment from the outset, not just the deployment of tools.

“How to Get the CISO’s Attention”

This talk provided a practical guide for identity professionals on how to frame identity risks in terms of business impact. By leveraging metrics such as regulatory exposure and insider threat scenarios, and focusing on measurable outcomes, identity teams can better engage CISOs and drive organizational support for IAM initiatives.

If this sounds interesting, we’re covering how to create business value from IAM in our upcoming webinar.

“Hidden Dangers in Azure: Over-Privileged Roles and API Vulnerabilities”

This session shed light on the risks posed by over-privileged roles within Azure’s RBAC model. The presenter revealed a critical API vulnerability that could be exploited to extract secrets and pivot into other environments, potentially causing major breaches. Actionable strategies shared included tightening Azure role assignments, adhering to least privilege principles even for read-only roles, and creating custom roles tailored to specific needs.

Identity Governance: Challenges and Trends

The conference highlighted that identity governance remains a critical yet complex area in the IAM landscape. While solutions and tools continue to evolve, the foundational challenges, such as aligning stakeholders, ensuring clear ownership, and embedding governance into organizational processes, still persist. The emphasis on thinking beyond technology to include influence and program management resonated strongly across sessions.

In Conclusion

Identiverse 2025 highlighted the importance of identity programs extending beyond implementation to emphasize influence, innovation, and integration. As the identity ecosystem becomes more intricate with the rise of AI agents and non-human identities, organizations must adopt proactive strategies to manage risks, ensure compliance, and align IAM efforts with broader business objectives.

Until next year!

‍

‍

Special thanks to Anshul Chaudhary, Frank Urena, and Tim Watson for their contributions to this article.

‍