2. Manage your identities more effectively
Security leaders have been saying “identity is the new perimeter” for almost a decade, but identity management is still overlooked or taken for granted. That’s a real problem, because the average organization now manages tens (if not hundreds) of thousands of human identities, machine identities, applications, AI agents, and countless other identity types.
When I worked for Hyatt, I saw firsthand how challenging it could be to manage the endless cycle of visitor identities alongside full-time staff, part-time workers, contractors, and others. Manual management is impossible at this scale, which means an effective identity platform is essential.
I have my teams start by ensuring the most basic security measures are in place. For example, we’ve known for decades that multifactor authentication (MFA) significantly decreases the likelihood that an identity will be compromised. MFA isn’t a magic bullet that will solve every problem, but research shows that accounts with MFA are 99% less likely to be hacked. Personally, I would go one step further by implementing passkeys, which have proven even more effective and alleviate friction on remembering and entering passwords. It’s a win-win situation, as some security enhancements can create unwanted friction. This is the opposite of that.
