Complexity and AI put identity protection to the test
Identity has become a core pillar of cybersecurity strategy. Remote work, cloud-first adoption, and distributed supply chains have moved identity from “a tactical IT consideration to a strategic pillar of cybersecurity,” according to Cisco Duo’s 2025 State of Identity Security report.
The study is based on a survey of 650 IT and security leaders across North America and Europe. It points to rising AI-driven threats, weak adoption of phishing-resistant authentication, and growing financial risk as key factors shaping identity security priorities in 2025.
Confidence crisis in identity providers
One of the central findings is a lack of trust in identity providers. The report notes that “confidence in their ability to stop identity-based attacks remains strikingly low.” Security leaders are increasingly concerned that fragmented visibility, identity sprawl, and legacy systems are undermining protection.
Identity Security Posture Management (ISPM) solutions are also underused. The report states that adoption “is lagging,” even though posture management provides a framework for enforcing policy and improving security outcomes.
Complexity creates blind spots
Complexity in identity infrastructure is a recurring theme. According to the report, “complexity in identity infrastructure challenges security posture.” Identity data is often spread across multiple systems, creating friction and expanding the attack surface.
The report highlights that many leaders “lack full visibility into identity vulnerabilities, and into admin access.” These blind spots make it harder to enforce policies, detect threats, and respond to incidents.
MFA adoption falls short
Phishing resistance is widely recognized as critical, but practical deployment continues to lag. Cisco Duo found that while most security professionals support phishing-resistant multifactor authentication, only a small share have fully implemented hardware tokens such as FIDO2.
The report points to “operational friction” as a barrier to wider use, including token management, hardware costs, and compatibility challenges. Passwordless access is also viewed as a long-term goal, but legacy system integration and workforce readiness remain obstacles.
AI raises the stakes
AI-driven phishing, insider threats, and supply chain risks are reshaping how organizations think about identity. The report says these threats are “dominating risk assessments” and forcing leaders to re-examine their existing tools.
At the same time, identity threat detection and response (ITDR) is emerging as a priority. The report notes that ITDR adoption is held back by “complexity, scalability, and integration concerns,” but interest is growing as organizations confront more sophisticated attacks.
Budgets and consolidation
Despite the challenges, there are signs of progress. Cisco Duo reports that a large majority of financial decision-makers are increasing investments in identity security. “Identity leaders have a critical window to accelerate modernization and close long-standing gaps,” the study concludes.
Tool consolidation is also gaining traction. Leaders are looking for fewer, integrated solutions as a way to cut through complexity. The report frames consolidation as “strategic simplification, not just savings,” and emphasizes that integrated solutions are becoming essential as multi-cloud adoption rises.
Financial impact is real
Researchers found that more than half of surveyed organizations have experienced measurable losses from identity-related breaches. The report states, “Identity risk isn’t theoretical, it hits the bottom line.”