Identity Governance & Administration

# Executive Summary * The Identity Governance & Administration (IGA) market is at an inflection point, driven by the exponential growth of unsecured AI agents and non-human identities, creating an urgent need for a new generation of security platforms. * Foundational demand remains robust, as relentless, identity-based cyber threats make IGA a non-discretionary component of Zero Trust security architectures. * The competitive landscape is undergoing a significant consolidation wave, highlighted by major acquisitions, shifting the focus from best-of-breed solutions to integrated security platforms. * A structural shift to cloud-native and passwordless solutions is accelerating, favoring vendors with modern, subscription-based architectures over legacy providers. * Leaders are differentiating through technological innovation in AI-driven security and vertical-specific expertise, while some firms are burdened by transitions away from legacy hardware. * Financial performance is bifurcating, with high-growth players exposed to these key trends significantly outpacing the broader market. ## Key Trends & Outlook The single most significant driver transforming the Identity Governance & Administration industry is the explosive and largely unsecured proliferation of AI agents and other non-human identities (NHIs). The scale of this challenge is immense, with the ratio of machine-to-human identities surging to over 80:1, and 91% of organizations using AI agents with only 10% having a mature security strategy. This creates a massive, immediate, and high-margin market opportunity for vendors that can discover, manage, and secure these identities. Leaders are moving quickly to capture this demand; CyberArk is launching its Secure AI Agents Solution in December 2025, while Okta is expanding its platform with Auth for GenAI. This trend is the primary catalyst creating a clear divergence between innovators and the rest of the market over the next 6-12 months. This growth is built upon a resilient foundation of non-discretionary security spending. With identity at the center of over 90% of all cyber breaches, IGA has become the critical underpinning for modern Zero Trust security frameworks. This imperative shields the sector from typical budget scrutiny and ensures consistent demand for comprehensive platforms that can unify access controls across complex enterprise environments. The top opportunity lies in securing AI and non-human identities, a greenfield market that will define leadership for the next decade. The primary risk is the rapid consolidation of the market, where large platform players like Palo Alto Networks are acquiring key IGA capabilities, potentially marginalizing smaller, independent vendors who cannot compete with the scale and integration of these emerging titans. ## Competitive Landscape The Identity Governance & Administration market is highly competitive, featuring a mix of large platform vendors and specialized providers, and is currently undergoing a wave of consolidation. Some firms, like Okta, compete by offering a comprehensive and independent cloud platform. This core strategy involves providing a neutral identity fabric that integrates with a vast ecosystem of other security and IT tools, aiming to be the central "Switzerland" of identity. This approach attracts customers who want to avoid vendor lock-in with a major ecosystem player, and the broad integration network serves as a significant competitive moat. However, this model faces intense competition from massive, well-resourced platform players who can bundle identity solutions at a discount. Okta explicitly positions itself as the "leading independent identity partner" with over 7,000 integrations, competing directly with Microsoft's bundled Entra ID. Another successful approach involves deep specialization in a critical security niche, as demonstrated by CyberArk's dominance in privileged access. This core strategy focuses on dominating a specific, high-stakes area of identity security with best-of-breed technology and deep domain expertise. Such specialization allows firms to command premium pricing due to differentiated technology that solves a critical, complex problem better than anyone else, often making them prime acquisition targets. The vulnerability lies in the risk of being marginalized if its niche functionality is adequately replicated by a larger platform. CyberArk built its leadership on "industry-leading privilege controls" and is now extending that specialized expertise to the new frontier of securing AI agents, with its acquisition by Palo Alto Networks validating this model's value. Finally, several players build defensible businesses by focusing on the unique regulatory and security needs of specific verticals, such as Telos in government or OneSpan in finance. This core strategy involves tailoring IGA solutions to the specific security, compliance, and operational requirements of a particular industry. This allows companies to build deep customer relationships and a sticky revenue base due to specialized expertise and solutions that meet stringent regulatory requirements, such as FedRAMP. The main vulnerability is a limited total addressable market compared to horizontal platforms, with growth tied to the fortunes of its target vertical. Telos derives approximately 90% of its revenue from the U.S. federal government, with its Xacta platform holding the critical FedRAMP High Authorization. OneSpan serves over 60% of the world's 100 largest banks. The key competitive battleground is shifting towards securing AI and non-human identities, and recent M&A activity suggests the market may favor integrated platforms over point solutions in the long run. ## Financial Performance Revenue growth in the Identity Governance & Administration industry is sharply bifurcating, reflecting varying exposures to high-demand trends versus headwinds from legacy business model transitions. This bifurcation is driven directly by exposure to the high-demand trends of advanced identity security versus headwinds from legacy business model transitions. Growth leaders are those with strong positions in securing critical infrastructure and machine identities, while some firms are navigating pivots away from mature hardware products. CyberArk's +43% YoY revenue growth in Q3 2025 exemplifies the powerful tailwind from its focus on the identity security imperative. In contrast, OneSpan's modest +1% YoY growth in Q3 2025 highlights the drag from its declining legacy hardware business, even as its strategic subscription segment grows. {{chart_0}} Strong gross margins are characteristic of software-centric leaders, but operating margins vary based on investment posture. The industry's software-as-a-service (SaaS) model inherently supports high gross margins. Leaders command premium pricing due to the mission-critical nature of their solutions and technological differentiation. Operating margins reflect strategic choices, with some reinvesting heavily in R&D and go-to-market to capture emerging opportunities like AI agent security. Okta's 80% subscription gross margin in Q1 FY26 is the benchmark for a mature, cloud-native platform, demonstrating the inherent profitability of the model. {{chart_1}} CyberArk's 19% non-GAAP operating margin in Q3 2025, while healthy, also reflects its significant investments to lead in new categories. {{chart_2}} Capital allocation is dominated by strategic M&A to acquire new technology and consolidate the market. Companies are aggressively using M&A to position themselves for the next wave of growth. This involves acquiring key capabilities in adjacent areas, such as passwordless or modern IGA, and, most significantly, large-scale consolidation by broader security platforms seeking to own the identity layer. The most significant event is CyberArk's $25 billion acquisition by Palo Alto Networks, a clear signal that best-of-breed identity security is a must-have asset for platform vendors. OneSpan's smaller acquisition of Nok Nok Labs shows the same trend of using M&A to buy, rather than build, critical new technology like FIDO authentication. Balance sheets across the industry are generally strong, with healthy cash positions and manageable debt. Strong recurring revenue models and healthy cash flow generation allow companies to maintain robust balance sheets. This provides the financial flexibility to fund organic R&D, pursue strategic tuck-in acquisitions, and weather economic uncertainty without undue stress. OneSpan serves as a representative example, holding $85.6 million in cash and equivalents in Q3 2025 against an undrawn $100 million credit facility, reflecting a healthy liquidity position typical of a well-managed firm in this sector. {{chart_3}}