[Trend Report] Securing Workforce Identities in 2026

TREND REPORT

Securing Workforce Identities in 2026

Introduction Credential compromise incidents carry enormous financial consequences, with the average data breach reaching $4.88 million globally. As work beco‑ mes borderless, digital, and increasingly automated, the very foundation of how organizations create trust is being rewritten. In this new landscape, identity has been established as the defining control point for security, resilience, and operational continuity, where every employee, device, and system can be verified, credentialed, and protected throughout its lifecycle.

While this shift is forcing enterprises to rethink how trust is established and maintained across their workforce and ecosystems, cyberattackers are incre‑ asingly exploiting both human and machine identities at an unprecedented scale. As identity becomes a strategic asset, leaders must pledge long-term vision, strong governance, and a commitment to building secure digital foundations.

This report explores identity trends shaping the future and the decisions leaders must make today to prepare for 2026 and beyond.

4 | GUIDE PQC

”

77% hacking-related breaches involve stolen credentials Verizon BBIR 2024 Crowdstrike

”

1. Remote identity verification Remote identity verification (rIDV) is becoming a critical component of the modern workforce and ecosystem security. As organizations embrace hybrid and remote work models, verifying identities without physical pre‑ sence is essential not only for employees but also for individuals who are not yet employees, such as candidates in onboarding, or external parties like suppliers, contractors, and customers. Successful rIDV ensures secure onboarding, access control, and compliance across diverse use cases.

By leveraging biometrics, digital credentials, and secure authentication methods, rIDV guarantees that only trusted individuals gain access to enterprise systems, regardless of location. Beyond security, rIDV also drives process automation, operational efficiency, and excellence, reducing manual checks and streamlining workflows while embedding compliance into everyday operations.

5 | GUIDE PQC

Trends Decentralized and remote onboarding is becoming the norm across industries.

Organizations are moving away from centralized, in‑person processes toward scalable, cloud‑based identity verification that supports employees, customers, suppliers, and partners anywhere in the world. AI now enables real‑time identity validation across borders, devices, and networks, esta‑ blishing trust from the very first interaction, reducing fraud, and strengthe‑ ning digital confidence.1 Biometric verification, liveness detection, and document authentication are now standard tools.

These tools validate identities securely and accurately, reducing fraud while improving user experience.

Regulatory pressure (e.g., eIDAS, GDPR, AML directives) is accelerating remote KYC (Know Your Customer) adoption.

Compliance is no longer optional; enterprises must demonstrate robust identity verification to meet legal obligations and avoid penalties.2 International identity documents are increasingly used to ensure global interoperability and trust.

By supporting passports, national IDs, and other cross‑border credentials, organizations can onboard distributed teams, contractors, and customers seamlessly while maintaining consistent governance standards.3

Threats Deepfakes and synthetic identities are used to bypass remote verification.4 Attackers increasingly exploit AI‑generated identities to fool biometric checks and document validation, making traditional verification methods easier to evade.

Phishing and malware targeting credentials during onboarding.5 Cybercriminals focus on new users and external parties, exploiting unfamiliar processes to steal credentials before security controls are fully established.

Compliance gaps from inconsistent KYC and data protection practices.

Fragmented verification standards expose organizations to regulatory risk, creating vulnerabilities that can lead to fines, data breaches, and loss of trust.

Actions to take now Implement multi-layered remote identity verification.

Combine biometrics, liveness detection, and secure document validation to create a layered defense against identity fraud. This approach ensures that verification is not only accurate but also resilient against spoofing, deepfakes, and synthetic identities.

Align onboarding workflows with evolving regulatory frameworks.

Design digital onboarding processes that meet the requirements of eIDAS 2.0, GDPR, and AML directives. Embedding compliance into workflows builds trust with regulators and customers while reducing the risk of penalties or reputational damage.

Leverage ICAO‑compliant identity documents for cross‑border trust.

Use internationally recognized, ICAO‑standardized identity documents (such as ePassports and national eIDs) to enable seamless verification across jurisdictions.

This reduces fraud risk, ensures interoperability, and supports global workforce mobility.

Issuance of secure and trusted identities

2. Know Your Employee (KYE) Issuing trusted employee identities is essential for enabling Zero Trust and driving secure digital transfor‑ mation. As organizations modernize access to both physical and digital resources, centralized identity issu‑ ance, whether through smartcards or mobile credentials, ensures streamlined onboarding, strong authentication, and compliance with regulatory frameworks. Trusted identities also empower automation, self‑service, and seamless integra‑ tion with HR systems and enterprise platforms, forming the backbone of a resilient workforce identity strategy.

Trends Mobile-first identities are replacing traditional username-password models.

Passwords remain one of the wea‑ kest links in digital security, easily reused, phished, and entrenched in legacy systems. With more than 300 billion passwords in use by humans and machines, identity has become both the most common attack vector and the first line of de‑ fense.6 Mobile credentials, secured through biometrics or device‑based authentication, offer stronger pro‑ tection, reduce friction for employ‑ ees, and align with the digital life‑ style of a mobile workforce.

”

Today, there are over 300 billion passwords in use by humans and machines, making identity the most popular attack vector and the first line of defense for organizations Microsoft Security report 2025 Secure employee access in the age of AI

”

Emergence of FIDO2 standards for phishing-resistant authentication.

Stolen credentials account for 77% of hacking‑related breaches, underscoring the urgency of moving beyond password‑based systems.7 FIDO2 and its evolution, passkeys, replace passwords with authentication rooted in cryptography rather than human memory. Instead of typing credentials, users confirm their presence via fingerprint, face scan, or device PIN, while their device handles a secure key exchange. Passkeys extend this principle by syncing credentials across trusted devices, turning passwordless access into an effortless, everyday experience.

For individuals, this means convenience; for enterprises, it delivers phishing‑resistant access aligned with Zero Trust strategies.

”

PKI and certificate-based issuance serve as trust anchors Password attacks make for identity integrity. up more than 99% of the Public Key Infrastructure (PKI) and identity attacks we see. certificate‑based identity issuance remain foundational for ensuring Microsoft Security report 2025 Secure employee access in the age of AI identity integrity. Certificates act as trust anchors, validating that an identity is genuine and issued by a trusted authority. This approach sup‑ ports secure communication, digital signing, and compliance with industry regulations, while enabling organizations to scale identity issuance across diverse platforms and ecosystems.

”

Learn more: The enterprise perspective on authentication - FIDO2 vs. Nexus PKI

Post‑quantum cryptography (PQC) readiness is emerging as a strategic priority.

The transition to PQC represents the most significant change in crypto‑ graphy in decades and will impact on the entire identity management ecosystem. Operating systems, firmware, cryptographic libraries, appli‑ cations, TPMs, and HSMs must all be upgraded to support quantum‑safe algorithms. Recommendations are clear: quantum‑insecure algorithms should be phased out by 2030 and banned after 2035.

The threat is already present through the “harvest now, decrypt later” strategy, where attackers collect encrypted data today with the intention of decrypting it in the future. For identity management, work on PQC must begin immediately to ensure digital identities remain futureproof.

9 | GUIDE PQC

Threats Phishing and credential stuffing attacks targeting legacy authentication systems.

Legacy username‑password systems remain highly vulnerable. Attackers exploit reused or weak passwords to gain unauthorized access, often at scale.

Insecure provisioning and misconfigured identity issuance of workflows.

Poorly designed or misconfigured processes can lead to unauthorized access, privilege escalation, or compliance violations. Secure provisioning is critical to maintaining trust in identity systems.

Lack of interoperability across identity ecosystems and devices.

Fragmented identity ecosystems hinder seamless authentication across platforms. Without interoperability, employees face friction, and organi‑ zations struggle to enforce consistent security policies.

Long-term vulnerability of classical cryptographic algorithms to quantum computing advances.

Quantum computers pose a real threat to today’s encryption methods, including those used to protect digital identities. Algorithms such as RSA and ECC, which currently underpin authentication and secure communication, risk becoming insufficient once quantum computers reach adequate capacity.8

Actions to take now Deploy passwordless authentication using FIDO2, PKI, and mobile ID technologies.

Transitioning to passwordless authentication reduces reliance on vulne‑ rable credentials and strengthens defenses against phishing. Mobile IDs complement this by offering secure, device‑based authentication that integrates seamlessly with enterprise platforms. At the same time, Public Key Infrastructure (PKI) provides the cryptographic trust anchor behind these credentials, ensuring that each issued identity is verifiable, tamper‑resistant, and compliant with regulatory standards.

Together, these technologies create a resilient identity ecosystem aligned with Zero Trust principles that is future‑proofed against evolving threats.

10 | GUIDE PQC

Implement a robust identity and access management (IAM) with MFA A strong IAM framework is essential for both security and regulatory compliance. Organizations should enforce MFA (Multi-Factor Authenti‑ cation) across all accounts, ensuring that access requires more than just a password. In addition, adhering to least-privilege principles minimizes unnecessary access rights, while regular audits of user permissions help maintain compliance with NIS2 requirements and other regulatory standards.9 According to Truesec’s 2025 Threat Intelligence Report, over 90% of ransomware incidents could have been prevented through strict MFA enforcement, blocking passwordguessing attempts, and active vulnerability management. This underscores the critical role of IAM and MFA in protecting enterprise systems against evolving threats.

”

Over 90% of ransomware incidents could have been prevented through strict MFA enforcement, blocking passwordguessing attempts, and active vulnerability management.

”

Source: Truesec’s 2025 Threat Intelligence Report

Introduce mobile identities as a complement to physical smartcards, enabling flexible credential use across devices and environments.

Mobile identities provide flexibility, allowing employees to authenticate across devices and environments without being tied to physical tokens.

This hybrid approach balances convenience with security.

Begin transitioning to PQC-compatible cryptographic algorithms and hybrid certificate models to ensure long-term resilience.

It is important to act now. Quantum computers pose a future threat to today’s cryptography, and for identity systems, this means preparations must be made well in advance to avoid security risks.

A first step is to inventory existing systems and classify components based on their security criticality. By testing PQC‑based certificates in current environments, organizations can identify where adaptations are needed, and which parts are most vulnerable.

11 | GUIDE PQC

3. Usage across the enterprise Trusted identities must be consistently applied across the entire enterprise ecosystem. From physical access to digital workflows, unified identity usage enables secure authentication, operational efficiency, and compli‑ ance across platforms. Whether employees log into cloud services, access on-prem systems, or unlock secure areas, a consistent identity framework ensures both security and usability.

Trends Zero Trust architecture is becoming the default for workforce access.

By 2025, Zero Trust has shifted from an aspirational goal to a baseline requirement. It assumes no user or device can be trusted by default, and identity is now the new perimeter. Remote work and connected devices have accelerated this shift, requiring identity-first strategies to mitigate credential-based breaches. Organizations are increasingly embedding continuous verification into daily operations. Zero Trust has evolved into a regulatory expectation in various industries, like finance and healthcare.10 Federated identity enables seamless access across cloud and on-prem environments.

Hybrid and multi‑cloud adoption have made federated identity critical for secure, unified access. Best practices emphasize centralizing iden‑ tity management, leveraging SSO, and layering security across environments.11 Federated identity also reduces administrative overhead by allowing organizations to extend trust across multiple domains, partners, and service providers. This approach is particularly valuable for enterprises with distributed workforces and complex supply chains, where consistent identity governance is essential.

SSO with platforms like Microsoft Entra further simplifies identity mana‑ gement, with Entra ID supporting SAML‑based SSO across thousands of applications to reduce password fatigue, streamline governance, and reinforce a unified federated identity strategy.

Adaptive authentication improves user experience without compromising security.

Adaptive MFA and risk‑aware identity solutions dynamically adjust authentication requirements based on context, balancing usability with protection against sophisticated threats. For example, low‑risk logins may only require a passwordless method, while high‑risk scenarios trigger stronger factors such as biometrics or hardware tokens. This approach redu‑ ces friction for legitimate users while maintaining resilience against credential 12 | GUIDE PQC

stuffing, phishing, and session hijacking. Adaptive authentication is also being integrated with AI‑driven analytics to detect anomalies in real time.

Threats Overprivileged accounts and poor access governance.12 Excessive permissions create unnecessary attack surfaces across applications, infrastructure, and physical environments. Without continuous governance, attackers, or even well-meaning employees can misuse elevated access, undermining both security and compliance. security alerts were rooted in an identity-related weakness, ”such44%as ofexcessive permissions, misconfigured roles, or credential abuse.

13

Source: reliaquest.com

”

Fragmented identity systems leading to inconsistent access controls.14 Disparate identity tools create policy gaps, duplicated identities, and uneven authentication experiences that weaken enterprise-wide security.

Insider threats and lateral movement due to weak segmentation.15 Insufficient identity boundaries enable malicious or compromised users to move laterally and access far more than their role requires, increasing the risk of data exposure or escalation.

Actions to take now Continuously verify identities, enforce least-privilege access, and segment resources to reduce lateral movement, key steps toward Zero Trust.

Move beyond perimeter defenses by adopting a Zero Trust mindset: every access request must be authenticated, authorized, and encrypted, regardless of location or device. Implement least-privilege principles to ensure users and workloads only have the minimum access required.

Combine this with micro-segmentation of resources to contain potential breaches and reduce lateral movement across networks.

Centralize identity management with federated SSO and unified access policies.

Consolidate identity silos into a single, federated framework that spans cloud and on-premises environments. Use single sign-on (SSO) to streamline user access across thousands of applications, reducing password fatigue and shadow IT risks. Enforce unified access policies that adapt dynamically to risk signals (e.g., device health, geolocation, anomalous behavior), ensuring consistent governance across distributed workforces and complex supply chains. This centralization not only strengthens compliance but also lowers administrative overhead.

13 | GUIDE PQC

Leadership responsibility and strategic identity & access management Digital security is a leadership responsibility that cannot be delegated to IT alone.16 Weak‑ nesses in identity, physical access, or informa‑ tion security can trigger severe operational, financial, and reputational consequences.

With the average data breach now costing $4.88 million globally in 202417, and only 29% of CISOs reporting adequate cybersecurity budgets18, executive sponsorship of identity and access management (IAM) has never been more critical.

”

With the average data breach now costing

$4.88 million globally in 2024.

Source: Fortinet

”

Identity has become the control point that underpins trust across the entire organization, from onboarding and workforce access to supply-chain collaboration and participation in digital ecosystems. Senior leaders must therefore treat IAM as a long-term strategic capability, not a technical function.

A strategic IAM program includes clear governance, integration with HR and workforce processes, strong information-classification practices, and ensuring that every employee and contractor holds a trusted, verifiable identity. It also requires the ability to issue, manage, and retire digital and physical credentials at scale, enforce least-privilege access, and maintain accountability through logging and oversight. Solutions such as remote identity verification (rIDV) play an important role within this broader ecosystem by ensuring that identity proofing and credential issuance are secure, consistent, and scalable.

14 | GUIDE PQC

By setting direction, establishing policy, and maintaining continuous over‑ sight, leadership ensures that IAM becomes a foundation for resilience, compliance, and operational continuity. When identity is governed as a strategic asset, not an IT task, organizations strengthen their ability to ma‑ nage risk, protect sensitive information, and build the digital trust required to operate confidently in an increasingly interconnected world.

Outlook:

Securing workforce identities 2026

Digital onboarding, distributed teams, and hybrid work have elevated the importance of comprehensive identity lifecycle management, making it an essential component of organizational security.

As we progress through 2026, workforce identities continue to be the primary attack vector for cybercriminals, whether through ransomware, espionage, or financial fraud. Compromised identities undermine every other layer of cybersecurity, making secure and verifiable identities the cornerstone of organizational resilience.

To stay ahead, enterprises must act decisively: securely verify identities irrespective of location, issue and manage both digital and physical credentials, enforce strong authentication, ensure regulatory compliance, and future‑proof technology against emerging threats.

AI is also revolutionizing workforce identities by transforming the entire lifecycle, from verification to issuance to usage, into a seamless, intelligent, and adaptive process. At the same time, AI introduces new risks to several parts of the identity ecosystem.

Digital security is a management responsibility that cannot be delegated to IT alone. By setting clear governance, maintaining continuous oversight, and treating identity and access management (IAM) as a strategic priority, organizations strengthen their ability to manage risks and safeguard sensi‑ tive information.

Securing workforce identities in 2026 is about more than preventing breaches, it is about enabling a trusted, resilient, and agile organization.

Those that invest in a unified identity ecosystem and strong governance will be best positioned to navigate evolving threats while empowering their people to work securely from anywhere. Organizations that act now will not only reduce risk but also build the confidence, continuity, and digital trust required to thrive in the years ahead.

15 | GUIDE PQC

About IN Groupe IN Groupe is a global leader in secure identity and trust services, specializing in identity solutions, secure transactions and digital services.

Building on a long-standing history of partnership with governments, the group also serves public and private organizations worldwide.

With deep expertise across the entire identity value chain, IN Groupe delivers solutions ranging from citizen ID to professional identity services, all in support of its core mission: providing every individual – whether citizen, consumer, or professional – with a secure identity in both the physical and digital worlds.

The group employs 4,000 people across 40 countries, serving governments and businesses in approximately 130 countries. It operates a global network of 20 research and development centers, as well as 10 industrial sites, and generates annual consolidated revenue of nearly €1 billion. www.ingroupe.com

References:

Gartner, “Emerging Tech: AI‑Driven Identity Verification,” 2024 eIDAS - electronic identification and trust services | Shaping Europe’s digital future 3 ANSSI_BSI_Joint_Paper_remote_identity_proofing_for_EUDI.pdf 4 Gartner (2024) Emerging Tech Analysis on deepfake‑driven attacks.

5 Verizon Data Breach Investigations Report (DBIR 2024); Microsoft Digital Defense Report (2023) 6 Microsoft Security report 2025: Secure employee access in the age of AI 7 2024 Data Breach Investigations Report | Verizon 8 How Post-Quantum Cryptography Affects Security and Encryption Algorithms - Cisco Blogs 9 Step 1 to NIS2 Compliance | Nexus Group 10 Meet regulatory and compliance requirements with Zero Trust | Microsoft Learn 11 Identity Federation Across Cloud and On-Prem: Best Practices 12 Microsoft Digital Defense Report (2023) 13 https://reliaquest.com/blog/threat-spotlight-danger-of-over-privileged-cloud-identities/ 14 Gartner Identity & Access Management Trends (2024); NIST Zero Trust Architecture Guidelines.

15 CrowdStrike Global Threat Report (2024) 16 SKR 17 Identity-Based Attack Protection for Enterprises: A Complete Guide | Fortinet 18 The CISO Report: The Path to Digital Resilience Starts with Your Board 1 2

A global leader in secure identity and trust services