Published by Airitos | Identity & Access Assessments · Architecture & Strategy · Implementation Services
The threat landscape has never moved faster. Cybercrime cost the global economy a staggering $10 trillion in 2025, and projections now put that figure at $12.2 trillion annually by 2031. The average cost of a single data breach has surpassed $4.4 million globally — and exceeds $10 million in the United States alone. For Identity and Access Management (IAM) practitioners and cybersecurity leaders, 2026 is not a year to stand still. It is a year of compounding complexity, where the convergence of artificial intelligence, quantum computing, regulatory fragmentation, and an exploding identity surface is testing the limits of even the most mature security programs.[1]
At Airitos, we work directly with organizations navigating these pressures every day. This post maps the eight most consequential obstacles facing IAM and cybersecurity professionals in 2026 and beyond — not to alarm, but to equip. Understanding what is breaking, and why, is the essential first step toward building what endures.
1. The AI Arms Race: When Your Adversary Never Sleeps
The single most disruptive force reshaping cybersecurity in 2026 is artificial intelligence — not as a defensive tool, but as an offensive weapon. According to the World Economic Forum’s Global Cybersecurity Outlook 2026, developed with Accenture, 94% of surveyed leaders identify AI as the most significant driver of cybersecurity change, and 87% flagged AI-related vulnerabilities as the fastest-growing cyber risk throughout 2025.[2][3]
Attackers are now deploying autonomous or “agentic” AI systems capable of conducting reconnaissance, writing their own malware, and adjusting payloads without human intervention. These systems use natural language processing to craft hyper-personalized phishing messages, impersonate executives through real-time voice cloning, and generate synthetic identity profiles for large-scale fraud. AI-generated phishing emails now achieve click-through rates more than four times higher than human-crafted counterparts. AI-enabled fraud surged 1,210% in 2025, with projected losses reaching $40 billion by 2027.[4][5][6]
The Agentic AI Problem
A new and particularly thorny dimension emerges from agentic AI — autonomous agents that execute workflows, trigger API calls, analyze data, and make decisions across cloud applications without direct human oversight. These agents blur the line between trusted automation and exploitable attack surface. For IAM professionals, the fundamental question shifts: it is no longer sufficient to govern who has access, but what is acting autonomously on behalf of your organization and whether those actions are properly bounded.[7][8]
Airitos Perspective: Governing AI agent identities requires the same rigor applied to privileged human accounts — purpose-bound credentials, time-limited access, delegation chains to accountable human owners, and continuous behavioral monitoring for anomalous activity.
2. The Non-Human Identity Explosion: The Identity Blind Spot Nobody Can Afford
Perhaps the most underestimated challenge of 2026 is the sheer scale of non-human identities (NHIs) — service accounts, API tokens, automation credentials, certificates, bots, and AI agents — that now vastly outnumber human identities in virtually every enterprise environment.[9]
ManageEngine’s 2026 Identity Security Outlook, drawn from 515 identity and security leaders in the US and Canada, found that nearly half of surveyed organizations report machine-to-human ratios above 100:1, with some sectors reaching 500:1. The numbers inside those ratios are alarming: 97% of non-human identities carry excessive privileges, just 0.01% of machine identities control 80% of cloud resources, and 71% are not rotated on recommended timelines.[10][11]
The consequences are predictable and severe. Attackers have learned that bypassing multi-factor authentication (MFA) is often easier through stolen NHI tokens than through attacking human credentials directly. Orphaned service accounts, exposed API keys, hardcoded secrets, and expired certificates create persistent attack surfaces that governance programs consistently overlook. One Identity has predicted that 2026 will see the first major breach traced directly to an over-privileged AI agent — an incident that, critically, will not look like an attack but simply like the system doing exactly what it was designed to do.[7][9][10]
What Good Governance Looks Like
The organizations that are getting this right are:
- Conducting continuous discovery and inventory of all NHIs across every environment
- Implementing short-lived, scoped credentials that expire automatically after task completion
- Blocking the creation of high-privilege service accounts lacking verified ownership
- Triggering alerts on abnormal token activity across multiple systems in real time[12][7]
Modern identity and access management strategies must treat non-human identities as governed assets — not afterthoughts.[12]
3. Deepfakes, Voice Cloning, and the Collapse of Identity Verification
Social engineering has always been the adversary’s most reliable weapon. In 2026, it has become their most automated one. AI-powered deepfakes and voice cloning have transformed targeted fraud from a craft requiring skill into a scalable industrial operation available to virtually anyone through Deepfake-as-a-Service (DFaaS) toolkits.[13]
The Entrust 2026 Identity Fraud Report quantifies the impact: deepfakes are now linked to one in every five biometric fraud attempts, deepfaked selfies increased by 58% in 2025, and injection attacks — which allow fraudsters to feed manipulated images directly into verification systems — surged 40% year-over-year. The World Economic Forum reports that 73% of organizations were directly affected by cyber-enabled fraud in 2025. A single deepfake video call cost engineering firm Arup $25.6 million.[14][6][15]
For IAM professionals, these statistics expose a fundamental vulnerability in identity proofing. When deepfakes can convincingly mimic users and live biometric capture experiences, organizations can no longer rely on “seeing is believing” verification methods. Multi-layered identity assurance — combining behavioral biometrics, device binding, contextual signals, and liveness detection — is no longer optional; it is the baseline.[15]
Only 13% of companies currently have anti-deepfake protocols in place. The gap between threat sophistication and defensive readiness has never been wider.[16]
4. The Quantum Countdown: “Harvest Now, Decrypt Later” Is Not a Future Problem
When most security professionals think about quantum computing, they think of a future threat. That framing is dangerously wrong. The “Harvest Now, Decrypt Later” (HNDL) attack model means the quantum threat is operational today.[17][18]
Nation-state Advanced Persistent Threats (APTs) are actively exfiltrating encrypted data — session tokens, authentication credentials, sensitive IAM configurations — with the explicit intent to decrypt it when quantum capability matures. Google has publicly warned that quantum computing could render traditional encryption methods obsolete as early as 2029. IBM’s research concurs, noting that fault-tolerant quantum computers could begin approaching cryptographic relevance by the end of the decade, with quantum risk materializing asymmetrically — some cryptographic systems will fail earlier than others.[19][18][17]
The algorithms most at risk are the foundations of modern IAM: RSA, ECC, and Diffie-Hellman — the protocols that secure digital signatures, public-key infrastructure (PKI), and authentication token exchange. Shor’s algorithm, running on a sufficiently powerful quantum computer, could theoretically derive private keys from public keys in polynomial time, dismantling the cryptographic chain of trust that underpins every PKI-based identity verification.[20][17]
In 2026, 37% of Global Cybersecurity Outlook survey respondents believe quantum technologies will affect cybersecurity within the next 12 months. NIST finalized its first Post-Quantum Cryptography (PQC) standards in 2024, including ML-KEM and HQC algorithms co-authored with IBM. The migration to post-quantum cryptography is no longer a future roadmap item — it is an active program requirement for every organization that handles long-lived sensitive data.[18][21][3]
Airitos Perspective: Organizations should begin their post-quantum IAM assessment now: audit the cryptographic dependencies in your PKI, MFA tokens, and SSO protocols, then build a phased migration plan toward NIST-approved PQC algorithms.
5. Zero Trust: The Promise vs. The Reality
Zero Trust has moved from visionary architecture to board-level mandate. And yet, in 2026, many implementations are quietly failing. The concept is sound; the execution is where organizations are struggling — and understanding why is essential for any IAM strategy team.[22]
Common Failure Modes
Tool saturation is the most pervasive problem. Organizations have accumulated separate identity providers for workforce, partners, and customers; multiple conditional access engines; overlapping EDR, XDR, and NDR platforms; and microsegmentation tools layered on legacy networks — creating complexity rather than reducing risk. The result is policies that exist on paper but are not consistently enforced in practice.[22]
Identity sprawl follows closely. Zero Trust promises “never trust, always verify,” but that principle breaks down when an organization cannot enumerate all the identities in its environment — particularly the non-human ones described above. According to Gartner, 70% of security failures start with mismanaged identities, not advanced malware. When identities are fragmented across siloed directories, federated access policies become impossible to enforce.[23]
Legacy system integration remains a persistent barrier. Many organizations still rely on older applications not designed for Zero Trust, requiring complex workarounds, phased modernization strategies, and ongoing resource investment that budget holders are reluctant to commit to.[24][25]
Strategic misalignment may be the most damaging flaw of all. When Zero Trust is implemented as a compliance response rather than a business enablement model, it produces uniform controls applied to vastly different risk scenarios, excessive friction on critical revenue systems, and security KPIs measured in tool coverage rather than outcomes. Security teams lose credibility. Business units bypass controls.[22]
The path forward requires moving from product accumulation to a governance-driven IAM framework — one that aligns identity controls directly to business-critical assets and maps clearly to regulatory obligations.[7]
6. The Supply Chain: When Trust Becomes a Weapon
Supply chain attacks represent a force multiplier that no single organization can defend against in isolation. One compromised vendor update, one tainted package repository, one breached managed service provider — and hundreds or thousands of downstream customers become victims simultaneously.[26][27]
The numbers from 2026 are stark. Unauthorized vendor account access accounts for 47% of supply chain attack vectors. 70% of organizations are very or extremely concerned about cybersecurity risks in their supply chains. AI-driven threats have now overtaken all other categories as the #1 supply chain risk ranked by security leaders, yet 67% of organizations still rely on static security audits for third-party assessment — a mismatch between threat sophistication and defensive posture.[27][28][29]
ISC2’s 2026 predictions explicitly name identity-based attacks on access infrastructure and attempts to compromise AI model pipelines as two of the most pressing supply chain threat vectors for the year ahead. The January 2026 zero-day vulnerability in Cisco Unified Communications products (CVE-2026-20045) demonstrated once again how a single flaw in a widely trusted vendor’s product can give unauthenticated attackers root-level system access across entire client ecosystems.[26][27]
For IAM professionals, the supply chain challenge is fundamentally an access and trust governance problem: third-party identities must be treated with the same rigor as internal privileged accounts, vendor credentials must be scoped and time-limited, and continuous monitoring must extend beyond the organizational perimeter.[30][27]
7. Regulatory Complexity: Compliance as a Moving Target
The regulatory environment for cybersecurity and IAM has never been more demanding — or more fragmented. For organizations operating across borders, the convergence of NIS2, GDPR, DORA, and emerging national frameworks is creating a compliance burden that strains already-limited security teams.[31][32]
NIS2 and DORA: The New EU Baseline
The EU’s NIS2 Directive has fundamentally expanded the compliance surface. No longer confined to critical infrastructure operators, NIS2 now encompasses a far broader range of essential and important entities, requiring:
- Documented cybersecurity risk management programs reviewed periodically
- Supply chain security measures with mandatory contractual terms for direct suppliers
- Incident reporting within strict deadlines (72 hours for significant incidents)
- Direct personal liability for management bodies — directors and C-level executives face individual consequences for non-compliance[32][33]
DORA (the Digital Operational Resilience Act) layered additional requirements specific to financial entities, with ICT risk management, third-party oversight, and operational resilience testing obligations that are now fully enforceable.[32]
Meanwhile, GDPR enforcement continues to intensify. Data breach notification failures remain the most common penalty trigger, and regulators are increasingly scrutinizing actual security controls — particularly Article 32 (security of processing) — rather than accepting privacy notices at face value. The intersection of GDPR’s automated decision-making rules (Article 22) with the EU AI Act is creating entirely new compliance obligations for organizations using AI-powered IAM systems.[32]
The compliance challenge is not simply knowing the rules — it is operationalizing them consistently across jurisdictions where national NIS2 implementations vary significantly. Organizations that build IAM programs aligned to ISO 27001 and NIST frameworks create structural overlaps that can satisfy multiple regulatory requirements simultaneously, reducing compliance overhead while improving actual security posture.[33][7]
8. The Talent Crisis: Capability, Not Just Headcount
Behind every technical challenge described in this post is a human one. The global cybersecurity workforce gap reached 4.8 million unfilled positions as of the most recent ISC2 estimate, against an active workforce of 5.5 million and total demand of 10.2 million — a 19% widening of the gap in a single year.[34][35]
The 2026 SANS Institute report marks a historic inflection point: for the first time, skills gaps have decisively overtaken headcount shortages as the industry’s top workforce challenge. When asked to choose between “not enough staff” and “not the right skills,” 60% of organizations identified capability gaps as the greater problem. Of the ISC2’s 16,029 respondents in its 2025 study, 95% reported at least one skill need — up five points year-over-year — and 88% experienced a significant cybersecurity event in the past 12 months tied to a skills shortage.[35][36]
The skills most in demand — and most scarce — are precisely the ones most needed for the challenges above: AI security governance, cloud security architecture, post-quantum cryptography, and IAM engineering across hybrid environments. Regulatory pressure on hiring has surged from 40% to 95% in a single year according to SANS, creating a bidding war for talent that most mid-market organizations cannot win on compensation alone.[37][36][35]
The strategic response is not simply to hire more — it is to invest in automation, training pipelines, and partnerships that extend the capabilities of the professionals you already have.
The Convergence Point: Why IAM Is Now Your Security Strategy
A decade ago, identity and access management was a supporting pillar of cybersecurity — important but secondary to perimeter defense. By 2026, the identity perimeter has replaced the network perimeter as the primary security boundary. Every user, device, API endpoint, and autonomous AI agent is a potential gateway. The static castle-and-moat model has not merely eroded — it has fully dissolved.[38]
Google Cloud’s analysis found that weak or absent credentials accounted for 47.1% of observed cloud security incidents in the first half of 2026, making identity compromise the single most common initial access vector. Misconfigurations — frequently IAM misconfigurations — accounted for a further 29.4%. Together, identity failures and cloud configuration errors account for more than three-quarters of all cloud compromises.[39]
The path forward requires organizations to move from viewing IAM as a product stack to treating it as a strategic practice — one that integrates with security operations (via ITDR), with HR systems (for seamless lifecycle management), with AI governance frameworks, and with business risk management at the executive level. Access decisions must be grounded in a rich context: user behavior, device health, request purpose, and real-time risk signals — not static credentials and fixed policies.[8][38][7]
Conclusion: Building for What Comes Next
The obstacles outlined in this post are not independent problems requiring independent solutions. They are interconnected symptoms of a single structural shift: the attack surface has become unbounded, and the identity layer is now the only coherent place to enforce trust.
Organizations that invest in a modern, agile IAM foundation — one governed by policy rather than driven by product, informed by continuous monitoring rather than periodic audits, and built on frameworks that anticipate quantum and AI disruption — will be positioned to harness what comes next. Those that delay will find themselves defending an indefensible perimeter with increasingly outdated tools.[38]
At Airitos, we specialize in translating these complex, fast-moving realities into structured assessments, resilient architectures, and practical implementation roadmaps. Whether you are evaluating your current IAM posture, building a Zero Trust strategy from the ground up, or preparing for post-quantum migration, our team brings the expertise and independence you need to move forward with confidence.
Ready to assess where your identity security program stands? Visit airitos.com to connect with our team.
Sources: World Economic Forum Global Cybersecurity Outlook 2026 (Accenture); ManageEngine Identity Security Outlook 2026; ISC2 Cybersecurity Workforce Study 2024/2025; SANS Institute Evolving Cyber Workforce Report 2026; Entrust Identity Fraud Report 2026; IBM Security; Google Cloud Threat Horizons Report H1 2026; SecurityScorecard 2026 Supply Chain Cybersecurity Trends Report; Gartner; NIST Post-Quantum Cryptography Standards 2024.
