Identity is at the core of modern business—and is the cornerstone of cybersecurity. That’s truer now than ever, when “the imperative to secure user and machine identities and tightly control access to critical data and systems has never been greater,” said Michael Kelley, senior research director, IT Leaders SBE, Gartner. And to this end, getting IAM right is critical.
That’s because IT providers won’t just be responsible for securing and managing human identities anymore, but machine identities as well. “Business is no longer going to be human-centric. So IAM is now at the core of autonomous business,” said David Furlonger, VP and Gartner fellow.
This was the topic of the hour at Gartner’s 2026 Identity and Access Management summit last week, when Gartner’s analysts and experts took Grapevine, Texas by storm and endeavored to give attendees the inside scoop on everything IAM—and a look at what’s coming next.
Here’s what you missed.
Identity at the Core of Business
In their opening keynote, Kelley and Akif Khan, VP, Cybersecurity and AI, Gartner, shared what the summit theme of “identity at the core” really means. “Having IAM at the core of business provides necessary sustenance for that business to grow and thrive. Modern business does not happen without identity at its core,” Kelley said, comparing IAM to an apple core—crucial to the apple’s development.
Identity is at the core of four pillars of modern business: security, compliance, digital transformation, and business agility, said Khan and Kelley.
Security. “From identity verification to authentications, from IGA to power, modern cybersecurity is identity security,” Khan said.
Compliance. “The alphabet soup of regulatory frameworks—GDPR, HIPAA, PCI DSS. They mandate robust access control [and] strong authentication, [and] audit, trade, and protect data,” Khan said. “Simply put, no IAM, no compliance delivery.”
Digital Transformation. “Organizations are evolving, offering new ways of working, innovative services to customers, and streamlining access for citizens. IAM plays a fundamental role in enabling secure access for all types of users across all platforms and devices,” Khan explained.
Business Agility. “A smart IAM strategy enables your business to adapt quickly, whether entering new markets, seizing opportunities of regulatory disruption, or adopting new technologies,” Khan said.
“Given the centrality to all of this, it follows that IAM has become a business control plane,” said Kelly. “In fact, IAM can be thought of as a system that delivers the technical functionality required for the services of IAM to be delivered. If we take the five layers of IAM access management—IGA, PAM, runtime, authorization, visibility, and observability—and we architect these in a way that is consistent with identity fabric principles, you have a set of controls that is critical for every conceivable business process, from humans to machines to workforce to partners to customers.”
The End of the Digital Business Era
In his closing keynote, Furlonger gave attendees a closer look at how AI is shifting the business landscape. With the rise of AI agents, the very structure of business is changing—moving from a digital structure to an autonomous one, he said.
“Autonomous business is a clear step change in business, Furlonger said. “It changes who we buy from and who we sell to. It won’t be just humans any longer; it will also involve machines. It’s going to change everything we do in terms of the value mechanism, how we get paid and in what form.”
Furlonger emphasized that autonomous business will be a completely new work structure. “Autonomous business is not automation,” Furlonger stressed. “Automation uses some form of limited intelligence in terms of computerized activity. It automates tasks that humans have designed, that humans largely oversee. When something goes wrong, humans fix the problems. We get speed, but [not] intelligence or differentiation.
“Autonomy is massively different. These machines now make their own decisions. They take their own actions whether we like it or not, and they fix their own problems as things go. Autonomous business means we have to get over this notion of having people-centric businesses going forward. Human roles are going to change. I think increasingly, humans are going to be used to bring empathy, creativity, and imagination [to business]—things that we forgot when we left childhood.”
What This Means for MSPs
As most MSPs know, major change equals major opportunity. Furlonger said that “50% of CEOs say that they’re working on some kind of integrated human and agent AI capabilities. This could be just Microsoft Office 365 and copilot, [or] it could be a humanoid robot standing alongside and replacing human workers in a dark factory.”
“CEOs are very ambitious,” Furlonger said, with aggressive goals regarding autonomous business and AI, “but let’s have a reality check. The train ride to autonomous business could be derailed. CEOs, for the most part, are struggling. 71% of them [are unsure] if [their] business model is fit for purpose anymore, because of AI. [Conversely], that 29% is more effectively dealing with these potential signal failures.”
As time goes on, it is going to get increasingly difficult for unprepared businesses to catch up to the 29%. That’s where MSPs have a critical role to play—to help businesses get up to speed, quickly, so they don’t get left behind in the shift.
First Steps Towards the Autonomous Era
The most immediate opportunity is in the machine identity space, said Kelley in an exclusive interview with MSP Success. “The challenge is a lot of clients don’t understand [machine identity]. They’re not comfortable with it. MSPs can provide some serious value [not only] around knowledge, teaching, training, and helping people understand what the gaps are, but also with what kinds of vendors should they work with and how can they mitigate the gaps that exist in their organization.”
However, “it’s a short-lived opportunity,” Kelley said. “A year or two from now, most of the market will have machine identity figured out. The opportunity in the meantime is that MSPs can be that authority. They can be that consulting arm, that person that companies go to, to help them define a strategy.”
Kelley advised MSPs to get a jump on AI agents as well, especially internally. “They should be experimenting [with agents],” he said. “There’s no real way to get this knowledge without implementing, trying the tools out, and getting them to work in real-world applications. I think MSPs will be served well by doing things in their own environment, maybe spinning up machine identity tools and machine identities, to see what can be possible. If I’m an MSP, I’m thinking about how I might start using AI agents to do IAM things that are predictable, repeatable, and time consuming.”
Without a doubt, there is significant change coming in the cybersecurity and identity space. MSPs have the opportunity to be early authorities in the era of autonomous business and machine identity. That’s why it’s so critical to be an early adopter at this stage—so you can ease the transition and usher your clients into the new age seamlessly.
For more of the latest in AI, read our recent survey results and learn whether your MSP is ready or at risk for the AI shift, from MSPs like you.
