IAM Budgets Rise 55% by 2031 as AI Agent Identity Becomes Distinct Buying Category

AI agents force IAM spending up 55% in five years

Global spending on identity and access management will increase from $26.2 billion in 2026 to $40.5 billion in 2031, according to Juniper Research. The 55% increase reflects enterprise buyers treating privileged machine access and AI-agent authorization as separate procurement priorities, not extensions of workforce identity budgets.

The forecast projects 88 million businesses deploying IAM by 2031, up from 67.6 million in 2026. That expansion covers cloud IAM, workforce and customer identity, machine identity, passkeys, and controls for AI agents—a scope that extends well beyond the employee single sign-on and multi-factor authentication that dominated IAM buying through 2024.

For procurement teams, the implication is upward pressure on IAM budgets across multiple cost centers. Workforce identity, privileged access, customer identity, and machine-identity management are increasingly funded and evaluated separately. Buyers should separate genuine capacity requirements from vendor bundling and demand adoption metrics—reduced help-desk resets, phishing-resistant authentication rates, privileged-session coverage, machine-identity inventory—rather than accept market-growth projections as justification for expanded spending.

Privileged access vendors reposition around agent sessions

Keeper Security was included in Gartner's 2026 Magic Quadrant for Privileged Access Management for the second consecutive year. The company's KeeperPAM platform now extends privileged controls to databases, cloud-native secrets, and AI-agent sessions through KeeperDB, Universal Secrets Sync, and KeeperAI for monitoring unusual activity by AI agents operating as privileged users.

The development signals a broader repositioning across the PAM market. AI-agent monitoring increases pressure on CyberArk, Delinea, BeyondTrust, One Identity, and Microsoft to show enforceable controls for agent identities, tool invocation, session recording, and automated remediation—not merely password vaulting for human administrators.

Enterprises evaluating PAM should verify whether "AI security" positioning covers enforceable authorization and session governance or only anomaly detection. Relevant requirements include per-agent identities, short-lived credentials, approval gates for high-impact actions, complete tool-call logs, and support for secrets used by CI/CD pipelines and cloud workloads. Keeper's announcement disclosed no pricing, customer counts, or measurable detection benchmarks.

DHS prepares $250 million in identity contracts

The U.S. Department of Homeland Security is preparing solicitations for two biometric identity-services contracts valued at $50 million to $100 million each, plus a separate DHS-wide identity, credentialing, and access-management blanket purchase agreement also valued at $50 million to $100 million. The five-year, firm-fixed-price GSA Schedule orders are expected to be solicited December 1, 2026, with awards targeted for January 2027.

The program covers biometric examination, identity management, accuracy analysis, the IDENT repository and its HART replacement, plus DHS-wide identity, credentialing, and access management. For federal contractors and enterprises serving regulated sectors, the procurement signals continued public-sector spending on authoritative identity repositories and identity assurance. Suppliers should plan for requirements around biometric accuracy, interoperability, auditability, data protection, and fixed-price delivery risk.

Okta reports agentic attack tools targeting identity flows

Okta's threat-intelligence team reported that agentic attack tools were used to accelerate reconnaissance of identity flows, with activity increasing significantly during October and early November 2026. The tools automate discovery of authorization endpoints, OAuth relationships, federation configurations, and identity APIs.

The development reinforces the need for monitoring across identity providers—not just protection of the central directory. Vendors that can detect abnormal discovery of authorization endpoints and OAuth relationships gain a differentiation opportunity against Microsoft Entra ID, Ping Identity, and other platforms.

Enterprises should review whether their IAM monitoring detects reconnaissance before credential abuse occurs. Budget priorities should include identity-threat detection, OAuth and API governance, strong controls for service accounts, phishing-resistant authentication, and rapid investigation of unusual identity-flow enumeration.

Okta Access Gateway vulnerabilities require immediate patching

Two Okta Access Gateway vulnerabilities require immediate attention: CVE-2026-115547, rated 9.1, could allow an existing Access Gateway administrator to execute system commands. CVE-2026-115546, rated 8.1, could let a signed-in user tamper with sign-in settings and potentially reach the administrative console. The fixes were released in Access Gateway 2026.10.2.

A separate PHP-related issue fixed in 2026.44.0 caused some applications to return HTTP 503 errors; Okta addressed that regression in 2026.44.1.

Okta Access Gateway customers should inventory exposed administrative interfaces, prioritize the security fixes, validate post-upgrade application availability, and confirm that emergency access and rollback procedures work. Buyers comparing hybrid access products should include patch cadence, exploitability, outage history, and deployment complexity in total-cost assessments.

What to watch

The buying signal is a shift from conventional workforce IAM toward AI-agent authorization, privileged machine access, and identity-threat detection. The most defensible near-term spending cases are controls with measurable coverage—privileged-session monitoring, secrets rotation, phishing-resistant authentication, identity-flow detection, and patchable hybrid access infrastructure—rather than broad "AI identity" positioning without disclosed benchmarks or customer metrics. Enterprises should treat AI-agent identity as a distinct procurement category with specific technical requirements, not an upsell opportunity within existing workforce identity contracts.