Rethinking identity maturity: Why confidence in your IAM program might be misplaced

In today’s digital-first world, identity is no longer a simple gatekeeper—it’s a strategic control plane. Identity and Access Management (IAM) has evolved into a key enabler of enterprise agility, compliance, and resilience. But according to recent research (link below) by CIO/ FoundryCo, sponsored by OpenText, many organizations are unknowingly operating with a false sense of IAM maturity.

While most security and IT leaders describe their IAM programs as “managed” or even “optimized,” the reality is much different. The data reveals that identity-related incidents are frequent, foundational practices remain underused, and integration complexity continues to stall progress.

The illusion of identity maturity

Organizations participating in the study experienced an average of four identity-related incidents in the past year. Despite this, many still believe their IAM efforts are mature. In truth:

• Only 36% enforce least-privilege access.
• Just 28% use just-in-time (JIT) access models.
• A majority struggle with consistent policy ...