Ping Identity and Deloitte Outline Six Identity Security Trends for 2026

Summary
Ping Identity and Deloitte outline six 2026 IAM trends, including AI-agent identity, helpdesk and hiring fraud, decentralized identity, quantum-resistant cryptography and continuous verification, alongside global trust survey findings.
Key points
- The report says 17% of consumers trust the organizations managing their identity data, 75% are more concerned about data security than five years ago, and 23% are confident they can spot a scam.
- It argues that enterprises need verified AI-agent identities, delegated authority controls, dynamic entitlements and human oversight.
- It identifies helpdesk social engineering, including AI-generated voice deepfakes, as a way to trick staff into resetting credentials or disabling MFA; it recommends mandatory identity verification during recovery.
- It describes hiring fraud tactics including deepfake interviews, false credentials and bait-and-switch hiring, and cites a 220% rise in IT-worker hiring fraud incidents over the past year.
- It recommends decentralized, consent-based identity systems to give users more control over personal data and reduce risks from centralized data silos.
- It advises auditing cryptographic dependencies and preparing for quantum-resistant cryptography and modernized signing mechanisms.
- It advocates continuous verification of access requests, credential resets and privilege escalations rather than relying on a single login checkpoint.
Article Details
- Publisher
- Ping Identity and Deloitte
- Report Period
- 2026 outlook and beyond; last updated 2025-11-01
- Scope
- Six identity and access management trends: AI agents, helpdesk security, hiring fraud, decentralized identity, quantum computing, and continuous verification.
- Sample Size
- Not disclosed
- Key Statistics
- 17% of consumers trust the organizations managing their identity data; the cited survey sample size is not provided.
- 75% of people globally are more concerned about their data security than five years ago; the cited survey sample size is not provided.
- 23% of people worldwide are confident in their ability to spot a scam; the cited survey sample size is not provided.
- IT worker hiring fraud incidents increased 220% over the past year, according to a cited Fortune article.
- The report states that organizations implementing continuous verification achieve 50% faster threat detection and response; supporting study details are not provided.
- Recommendations
- Establish verified, governable identities for AI agents and extend accountability to their actions.
- Embed identity verification into every helpdesk workflow and remove password dependencies from recovery and verification.
- Use high-assurance identity verification throughout hiring and onboarding, including reusable, verifiable digital credentials.
- Audit cryptographic dependencies and adopt quantum-resistant cryptography and modernized signing mechanisms.
- Continuously validate access requests, credential resets, and privilege escalations with real-time assurance.
People
Andre DurandPing Identity Founder & CEO; quoted on identity, accountability, and proof-based trust.Darryl JonesPing Identity VP of Consumer Product Strategy; quoted on how agentic AI may affect e-commerce and consumer journeys.Vikram KunchalaDeloitte Principal and Digital Trust & Privacy Leader; quoted on the need for transparency, security, and user autonomy as agentic AI evolves.
Vendors
DeloitteSix trends shaping the future of identity and access management—jointly published by Ping Identity and Deloitte to help you future-ready your strategy in today’s trust-nothing era.Ping IdentitySix trends shaping the future of identity and access management—jointly published by Ping Identity and Deloitte to help you future-ready your strategy in today’s trust-nothing era.
Industries
financeBreaches across industries, from hospitality to finance, increasingly trace back to compromised support interactions where attackers tricked agents into resetting credentials or disabling MFA.HospitalityBreaches across industries, from hospitality to finance, increasingly trace back to compromised support interactions where attackers tricked agents into resetting credentials or disabling MFA.
