Two years ago, we asked whether artificial intelligence (AI) could represent a revolution for IAM in our article “Artificial intelligence: a revolution in IAM? – RiskInsight”. We already emphasized the need for a nuanced approach, based on concrete use cases, test-and-learn logic, and a requirement for trust compatible with the specific challenges of identity and access.

Today, the assessment has become more precise: AI has not caused the disruption that some predicted, but it is beginning to find a real, more targeted, and above all more pragmatic role within IAM.

What we also observe is that AI leads to an expansion of the scope of IAM: IAM must now also address issues related to AI and AI agents. To delve deeper into this point, we invite you to explore our article “Securing AI Agents: Why IAM Becomes Central – RiskInsight”.

As a reminder, AI is progressively establishing itself as a lever for transforming information systems, and IAM is no exception to this trend. Faced with the multiplication of identities driven by transformations of different natures, whether it be infrastructure evolutions with the cloud, business vision changes with the rise of CIAM, or the arrival of new technologies like AI agents, organisations must deal with increasingly rich and difficult-to-maintain authorisation models.

In this context, AI promises to make IAM services more efficient and accessible, whether through intelligent recommendations, conversational assistants, better data utilisation, or processing volumes that are difficult to manage with traditional approaches.

However, these contributions call for caution. IAM directly concerns access security: at this stage, AI must remain an assistance tool, under human supervision, as responsibility cannot be delegated to it. In practice, it still primarily manifests as peripheral components (copilots, chatbots, agents) that enhance existing systems without disrupting critical functions. The challenge is therefore no longer so much about whether AI has a place in IAM, but rather about identifying where and how to apply it in a truly relevant way.

2.    What AI use cases truly make sense in IAM?

The contributions of AI in IAM are unevenly distributed:

• Identity Governance & Administration (IGA) concentrates the bulk of initiatives thanks to its data volumes and frequent decisions (reviews, validations, recommendations).
• Access Management (AM) is also heavily featured, with projects primarily aimed at accelerating and streamlining the user authentication process.
• Privileged Access Management (PAM) is seeing the emergence of more targeted uses, particularly around the detection and monitoring of privileged behaviours.
• The potential of AI in Customer Identity and Access Management (CIAM) remains relatively underexploited, even as it is becoming strategic. This is particularly evident in the emergence of AI agents capable of interacting or acting on behalf of users, especially through chatbots.
• AI currently offers limited value for Trust Services, where processes are already largely automatable without AI, and is positioned more as peripheral support.

To organise these initiatives without ending up with a long list, two main categories of use cases can be identified:

1. Those that aim to resolve current challenges in existing processes.
2. Those that make it possible to address new issues that traditional approaches cannot cover.

The value of AI first emerges from current IAM pain points…

This first family of use cases generally constitutes the most natural entry point, as it relies on existing IAM processes.

AI then plays an accelerating role, by reducing costs and operational burden, while improving the experience, quality of service, and speed of execution, without calling into question the control model.

…to become a lever for overcoming the limitations of traditional approaches

The second category of use cases falls into a different category: here, AI is no longer merely aimed at saving time but unlocks analytical capabilities that are beyond the reach of traditional approaches, by cross-referencing multiple data points (identity, organisation, permissions, usage, events) across large volumes of data. In particular, it enables the large-scale detection of atypical access, such as rare combinations of rights, authorisations inconsistent with a role, or accumulations linked to successive exceptions.

AI also enables the analysis of career trajectories, identifying how certain profiles evolve over the course of job changes, projects or emergencies, to target remedial actions. It also enables intelligent prioritisation of these remedial actions by combining application criticality, data sensitivity and usage signals, whilst in the field of PAM, emerging uses aim to identify behaviours involving unusual privileges to trigger enhanced controls.

Finally, this also paves the way for delegating lower value-added tasks, such as handling Level 1 tickets, for which automation was technically feasible but economically difficult to justify. Today, some AI-powered IAM solutions make this substitution realistic and accessible.

The multiplication of pain points and automation avenues should not lead to the indiscriminate deployment of AI. Some needs can be effectively addressed using simple rules or algorithms, and whenever access is involved, every potential error carries a security risk. It is therefore essential, once use cases have been identified, to select and prioritise them, rather than accumulating initiatives.

3.    Prioritise AI in IAM before it becomes a pile of initiatives

Once relevant use cases have been identified, it is necessary to determine which ones to focus efforts on, as not all justify the same level of investment. Prioritisation can thus be based on two key axes: added value and implementation complexity.

The challenge here lies in the ability to analyse these two aspects rigorously for each use case.

The first axis, relating to value, can thus be understood through several sub-criteria:

• Operational cost reduction: measuring how the use case helps avoid certain recurring costs.
• Efficiency gains and reallocation of efforts: the ability to free up time and redirect teams towards higher value-added tasks.
• Reducing cyber risk: the impact of the use case on reducing identified cybersecurity, IT, or control risk.
• Contribution to regulatory and strategic issues: to what extent does the use case meet a priority regulatory or strategic expectation (e.g., DORA, ECB, audits).
• Impact on the affected populations: assess who the use case serves and with what frequency of use, as modest but daily use by a large number of users can create more value than a more ambitious use case limited to a restricted scope. The main populations to consider are generally IAM administrators, IAM integrators, end-users, and approving managers.

The second axis, complexity can be assessed according to four complementary dimensions, consisting of:

• Technical complexity: the technological effort required to deploy the use case, whether in terms of integrations, architecture, AI models used, or dependencies on the existing information system.
• Organisational complexity: the level of coordination required between teams, scopes, and processes to effectively support the use case.
• Associated risks: cyber, regulatory, or operational risks that may be introduced or reinforced by the implementation of the use case.

As a reminder, this approach aims primarily to guide thinking and structure decision-making; it is only a proposal that must therefore be adapted to each context.

High-impact but quick-to-deploy use cases should be prioritised. Conversely, those requiring significant effort (unavailable data, complex integrations, high security requirements) for limited benefit should be discarded or deferred. To make the trade-off concrete, a “matrix” logic works well:

However, this approach also requires being clear on one point: AI depends heavily on data (quality, completeness, traceability, repositories) and the ability to exploit it securely. Without solid foundations, even a promising use case will remain at the demonstration stage. To generate value in real-world conditions, it must be able to rely on sufficiently robust IAM foundations: data quality, structured repositories, process stability, clarity of the authorisation model, etc. Thus, prioritisation must be confronted with the reality of available solutions and their maturity.

4.    A booming market, with usage still largely unequal

The IAM market is strongly energised by AI, with expanding roadmaps and the emergence of so-called “AI-native” products, designed from the outset to integrate assistance, analysis, and automation mechanisms. These approaches generally address either a targeted need or a differentiation strategy in a rapidly evolving market.

In parallel, traditional IAM solutions are progressively enhancing their offerings with AI functionalities and generally benefit from greater resources than AI-native players to support this transformation, primarily in cloud environments, which are more conducive to their deployment than on-premises architectures.

However, there remains a notable gap between promise and reality in production: most of the functionalities available today are still peripheral assistance (search, summarisation, copilots) rather than AI truly embedded in critical functions.

Adoption also remains gradual, particularly in large organisation, where the priority remains optimising existing systems, stabilising repositories, reducing technical debt, and ensuring compliance. AI-native approaches, still relatively new, must be integrated into a realistic roadmap and a clear operating model. AI should not be seen as a miracle product, but rather as a lever to be incorporated into a global IAM transformation.

5.    Conclusion – From the announcement effect to a controlled trajectory

AI applied to IAM seems to be reaching a turning point. The real challenge is not to accumulate use cases: it is to build a coherent, selective, and sustainable approach. Because it intervenes in access decisions, AI in IAM requires a higher level of caution than in other areas. The promise of automation must never mask the responsibility of humans and organisations. Any recommendation must be understandable, contestable, and justifiable, especially in an audit context. It is necessary to clearly define who validates and who arbitrates, ensure the acceptance of business teams without which AI will be bypassed, ensure regulatory compliance, and rigorously frame the data exposed to assistants to prevent any exfiltration of sensitive information.

To maintain this trajectory, it is not enough to evaluate use cases in isolation: the foundations must be evolved (quality of identity data, repositories, role model, controls), an operational model capable of supervising AI on a daily basis must be defined, and emerging uses, particularly around AI agents, must be secured. AI for IAM should therefore not be thought of as an immediate revolution, but as a gradual progression, from assistance modules to advanced analysis capabilities, ultimately leading to better-controlled automation.

Ultimately, approaching AI in IAM well means moving forward pragmatically, targeting uses that offer the best balance between value and complexity, maintaining control over sensitive decisions, and staying attentive to the real market maturity.

6.    Five priorities to move from AI ambition to IAM results

In summary, here are the key points to bear in mind to adapt to this transformation:

1. Identify AI use cases that truly make sense for IAM, whether they involve improving existing processes or unlocking new capabilities for analysis and automation.
2. Objectively define the value and complexity of each use case to prioritise them for implementation.
3. Build a progressive, controlled, and governed trajectory, rather than accumulating initiatives without an overall vision.
4. The market is structuring itself rapidly: talk to your vendors to understand what they are really offering.
5. Also inquire about emerging new solutions, particularly AI-native ones, and do not hesitate to contact us if you wish to discuss your initial field feedback or broaden your market vision.

Cet article AI for IAM: A pragmatic trajectory rather than a revolution est apparu en premier sur RiskInsight.

To dive deeper into IAM, our experts have created an IAM maturity assessment tool.

Interview with Anatole CATHERIN, Manager and IAM expert for almost 10 years at Wavestone.

Hi Anatole, thanks for your time! First of all, can you explain what IAM really is?

Identity and Access Management (IAM) is a discipline that sits at the crossroads of three worlds:

1. Cybersecurity strengthening: It comprises managing identities, the rights granted to these identities and user access to company resources. Each user has access confined to the limits of their role within an organization. To successfully achieve this, organizations need to know who, within their information system, can perform which actions and why. IAM is therefore an essential component of cybersecurity, especially during implementation of a Zero Trust policy.
2. Business enablement: Identity and Access Management is also a business enabler and a facilitator for successful digital transformation within organizations as it increases operational process efficiency to employees and customers. For example, IAM enables the control and fluidity of arrivals, departures or mobility by ensuring that new employee benefit from accurate accesses. In case of subsequent mobility or departure, the relevant accesses are removed and no information is lost.
3. UX enhancement: IAM facilitates a seamless user experience for employees within an organization. Moreover, the best IAM systems operate behind the scenes to enable work on arrival and enhanced connectivity based on security requirements.

Why is it so difficult to build an IAM system that works?

As you can imagine, the challenge and complexity of IAM is striking (and maintaining) the balance between security and fluidity of navigation.

To successfully implement IAM, it is important to assess the current state. With good reason, clients have difficulty measuring the effectiveness of their existing IAM system. There is no dedicated benchmark in the market evaluation.. The NIST pillars are high-level and do not cover all the challenges related to IAM; the existing benchmarks only deal with the cybersecurity aspect of IAM and ignores the impact on the operational efficiency of an organization’s internal procedures and the fluidity of the user experience.

The goal in creating the IAM Framework was to create a framework that evaluates the entire discipline and that can be used to build an efficient roadmap.

Can you tell us a bit about the IAM maturity assessment tool?

More than a tool, it’s a framework and a tool-based methodology that supports customers and provides them an overview of their IAM maturity.

The Framework enables the understanding of an organization’s current state (which IAM perimeters are deployed (or not), which IAM axes require further work, etc.). It provides an overview, with the right framework, the right angle and the right resolution to cover all IAM topics.

The maturity assessment consequently allows the prioritization of workstreams that culminates in an IAM action plan!  Thanks to this framework, we can identify the main areas for improvement, while accounting for organizational nuances by introducing the notion of scope.

In short, it meets three objectives: Evaluate, Improve and Extend IAM to other perimeters (beyond internal and service providers, with customers or partners). It was intended to be exhaustive to highlight our customers’ shortcomings and subsequently measure their progress and the effectiveness of their transformation program.

Our ambition is to make it the primary evaluation standard, entirely dedicated to IAM, with a sufficient level of granularity to cover all issues!

How is it structured?

Concretely, our tool is composed of about fifty questions that cover the 6 IAM themes:

1. Governance
2. Identity management
3. Entitlement management
4. Access control
5. Privileged access management
6. Reporting and controls

It can be used in several cases, here are 2 examples:

Can you tell us about the last time you used it with a concrete example?

We tested the questionnaire in the field through several missions, during which the use of the IAM Framework helped accelerate the process. These missions comprised:

• the definition of an IAM roadmap for a large energy company
• the framing of a migration to an IAM tool for a banking group, which allowed the measurement of gaps between their existing solution and the new one
• IAM maturity assessment for an insurance company, to identify friction points and areas for improvement and to establish a roadmap

For these three projects, the assessment grid made it possible to identify all addressable topics (regardless of whether the client was aware of them at the outset) in order to provide an actionable roadmap covering all IAM issues. In other words, the Framework can be used as an analysis framework for the implementation of a project.

We plan to launch new missions on the subject and we are looking forward to supporting new customers in their journey to improve their IAM structure!

A final word?

I will end by reminding you of the key components of the Framework:

• It is “ready to use”: the fifty questions encompassed in the framework designed by Wavestone experts covers all IAM topics
• It offers a standardized and formalized vision of its maturity on the subject of access and identity management: this assessment is also an opportunity to involve all the key players impacted by IAM: cyber teams, IT teams, internal audit teams and business teams,
• It facilitates the prioritization of actions within a transformation program:as explained above, it can be used at different times and can therefore be used as a support for a broader reflection,
• Finally, it is a flexible means of use: It can be used at a very high level (a strategic level) or to develop very specific actions.

Want to evaluate yourself? Please contact us!

Cet article [INTERVIEW] IAM Maturity Assessment – Where do you stand and why is it crucial? est apparu en premier sur RiskInsight.