Every few years, security buyers watch the same movie: a pain everyone quietly tolerates becomes a pain nobody can ignore, point solutions appear, an analyst gives the thing a name, the platforms and acquirers move in — and two years later it’s a line item in every RFP, and nobody remembers arguing about it. Endpoint detection ran this arc. SaaS data backup ran it. Identity threat detection is running it now. Here’s the thesis: identity resilience — the ability to withstand and rapidly reverse damage to the identity systems everything else depends on — is next. The vocabulary already exists, the acquisitions have started, the regulators are effectively mandating it, and the only genuinely open question is whether it becomes a standalone category or gets absorbed as a mandatory capability of the platforms around it. Either way, buyers should get ahead of it.
How Do Security Categories Actually Form?
Security categories form when a tolerated risk becomes an intolerable one — usually through a repeatable four-step pattern: painful incidents, point solutions, an analyst-blessed name, then consolidation into platforms. Three recent runs of the movie:- SaaS data backup. For years, “Salesforce is highly available” passed for a data protection strategy — until enough bad API syncs and deletion mistakes taught everyone that available and recoverable are different words. Point vendors like OwnBackup built the category; in September 2024 Salesforce agreed to acquire Own Company for approximately $1.9 billion, and what began as a third-party workaround became a first-party platform capability. Tolerated risk → point tools → absorption.
- Identity threat detection and response (ITDR). Attacks on identity infrastructure were an acknowledged-but-unnamed problem until Gartner coined ITDR in its 2022 top-trends list, describing “the collection of tools and best practices to defend identity systems.” Within two years, ITDR went from neologism to a standard evaluation line.
- Active Directory resilience. A generation of ransomware incidents in which recovering AD was recovering the business built a real market for AD-specific backup and recovery — proof that identity systems merit their own resilience tooling, not a checkbox in a general-purpose backup suite.
The Forcing Functions Are Already Here
A category needs pressure from multiple directions at once — and identity resilience has five:- Identity is the control plane, and the primary target. Microsoft’s Digital Defense Report 2025 describes 100 trillion security signals processed daily and 38 million identity risk detections a day. When the IdP is damaged — by an attacker or an admin — everything behind it degrades at once.
- The shared-responsibility penny has dropped. Okta’s October 2023 support-system incident — attackers accessed support-case files from 134 customers and downloaded a report covering all customer support system users — was contained and transparently handled, but it forced a broad realization: the vendor’s job is service availability, and your tenant’s configuration and recoverability were never in the contract. Meanwhile the native safety nets are thin: Entra ID’s recycle bin covers some deletions for 30 days (not security groups, not modifications); Okta has no undelete at all.
- Regulators stopped asking nicely. The EU’s Digital Operational Resilience Act, applicable since January 2025, requires financial entities to maintain — and test — backup, restoration, and recovery for critical ICT systems, and it’s hard to name a more critical ICT system than the one performing every authentication. NIS2 pushes similar business-continuity and backup obligations across essential sectors. “We’d rebuild the tenant by hand” does not survive an audit built on those texts.
- Complexity keeps compounding. Enterprise Strategy Group research (May 2025) found workforce identity teams running an average of 11 tools. Every tool means more configuration, more integration, more automated writes into the identity fabric — and now AI agents and non-human identities are multiplying both the objects under management and the actors making changes. More change, more changers, more blast radius.
- The insurance and audit stack is converging on recovery. Cyber-insurance questionnaires and SOC 2 assessments increasingly probe not whether you back up, but whether you can demonstrably restore — with access controls, approvals, and evidence. Identity systems are walking into that spotlight.
The Signals It’s Already Happening
The clearest tell that a category is forming isn’t marketing — it’s M&A, convergent product design, and shared vocabulary. All three are visible:| SIGNAL | WHAT HAPPENED | WHAT IT TELLS YOU |
| Consolidation has started | Semperis — the AD resilience heavyweight — acquired MightyID (Okta/Ping backup, restore, and failover) in February 2026, branding the combination “identity resilience” | Established players are buying their way into cloud-IdP recovery; the term is on press releases, not just blogs |
| Product patterns are converging | Independent vendors have converged on the same architecture: continuous capture, point-in-time restore measured in minutes, dependency-aware recovery orchestration | When competitors independently converge, the market has spoken about the requirement set |
| Pricing has standardized | Per-protected-user-per-month is the emerging norm across the space | Standardized pricing is a category trait — buyers can compare like for like |
| Platform precedent exists | Salesforce absorbing Own for ~$1.9B made SaaS-data resilience a first-party concern | The absorption endgame is proven; identity is the same movie with higher stakes |
| The megatrend has a name | Analysts coined ITDR in 2022 for detection; resilience is the unfinished half of the same story | Detection without recovery is a smoke alarm without a fire exit |
What Will the Category Look Like?
Five predictions, offered with dates deliberately fuzzy and direction deliberately firm:- Recovery objectives will enter identity RFPs. “What’s your RPO and RTO for the identity tier?” becomes a standard procurement and audit question — recovery point objectives of minutes, not days, will be the defensible answer, and honest recovery-time math (scoped restores in minutes; rate-limited full-tenant rebuilds in hours) will separate credible vendors from optimistic ones.
- Backup without restoration rehearsal will stop counting. The bar moves from “we have backups” to “here’s last quarter’s verified restore report” — the same maturation SaaS backup went through, accelerated by DORA-style testing mandates.
- Consolidation continues, in both directions. Standalone identity-backup vendors get acquired by resilience platforms, security suites — or the identity providers themselves, exactly as Salesforce absorbed Own. Expect the point-tool window to be measured in a few years, not decades.
- The platforms will improve — and it won’t close the gap. Okta and Microsoft will keep strengthening native protections, and buyers should cheer. But an independent, encrypted, off-platform copy with cross-object dependency restore and change attribution is structurally something the platform can’t be for itself — the auditor’s question “what if the platform, or an admin on it, is the failure?” keeps third-party resilience alive even in a world of better recycle bins.
- Resilience will attach to the moments of change. The riskiest hours in an identity estate’s life are migrations, consolidations, and policy overhauls — which is why resilience capability will increasingly ship inside the tooling that performs those changes, not just alongside it. Watch for backup, rollback, and attribution to become table stakes in migration and identity-ops platforms.
The Honest Counterargument
Could this thesis be wrong? The strongest version of the objection: identity resilience never becomes a category — it becomes a feature. Gartner never draws the Magic Quadrant; the capability gets absorbed into ITDR suites, backup platforms, and the IdPs’ own roadmaps; and “identity resilience vendor” ends up a transitional species, like standalone anti-spyware. It’s a fair scenario — and here’s why it doesn’t change the conclusion: features that become mandatory shape buying decisions exactly the way categories do. Whether the analyst taxonomy files identity recovery under resilience platforms, ITDR, or backup suites, the enterprise requirement lands identically: continuous capture of identity configuration, independent encrypted storage, dependency-aware restore, attribution, and rehearsed recovery with evidence. The organizations that build that muscle now win in both futures. The ones that wait are betting their control plane on a taxonomy debate.What Should Security Leaders Do Now?
You don’t need to wait for the category to be official to close the gap it names:- Ask the uncomfortable question this quarter. If your busiest Conditional Access policy was mangled today — or your most-referenced security group deleted — what’s the actual recovery path, and how long would it take? If the answer involves the word “probably,” that’s the finding.
- Put identity in the disaster recovery program with its own tiers, recovery objectives, and runbooks — not as a footnote to the database chapter.
- Demand recovery evidence, not backup promises — from your own team and from any vendor: dry-run previews, verification reports, restore rehearsals on a schedule.
- Treat change windows as the highest-risk hours. Migrations, consolidations, and policy pushes deserve automatic pre-change snapshots and a rehearsed rollback path — insurance priced in minutes of setup.
