After acquiring EmpowerID, the Danish IGA vendor wants to govern human, machine and AI identities in real time. Field Strategist Thomas Müller-Martin explains the roadmap, the role of partners and why regulation helps.
AI agents act within fractions of a second, often with broad access to company systems, yet few organisations know exactly what these agents are allowed to do. Omada, the Copenhagen-based provider of identity governance and administration (IGA), wants to close that gap with real-time control. Thomas Müller-Martin, field strategist at the company, outlined the direction in an interview on 28 October 2026.
Two topics, one common thread
The market is moving at high speed, said Müller-Martin, driven above all by agentic AI. Two topics stand out for Omada. First, AI agents access internal IT systems and work with context that must remain traceable and controllable, so they need governance and security. Second, AI itself should make identity governance simpler. Omada already applies it, for example, to support risk classification. The need is real: an EMA study cited by the company puts the failure rate of IGA programmes at nearly 30 percent.
EmpowerID as a building block
The strategic step is the acquisition of EmpowerID, a specialist in AI agent governance, announced on 24 September 2026 and following Omada’s Agent Governance solution from June. According to the company, the deal adds runtime agent governance: access decisions are made at the moment of the request, using live risk and governance context, so agents can be stopped once they leave their permitted boundaries. EmpowerID CEO and co-founder Patrick Parker joins Omada as chief innovation officer. Müller-Martin describes the two companies as complementary; the roadmap combines agentic governance with sovereignty. Humans, applications, workloads and agents are to run through the same lifecycle, access and certification services, fed by a single, continuously maintained view of identities and entitlements. Every grant, decision and review is recorded as it happens, so that proof of control becomes a by-product rather than a project assembled before each audit. Omada CEO Jakob H. Kraglund frames the difference as governing AI rather than merely monitoring it, and KuppingerCole co-founder Martin Kuppinger sees runtime authorization extending IGA from who is entitled to access to what agents are actually permitted to do.
In practice, the first task is visibility: which agents exist, how critical are they, and how do they map to regulatory requirements? Because agents operate in less than a second, Müller-Martin argued, a gateway to resources is needed, with real-time risk control, anomaly detection and a human in the loop. The aim is to limit an agent’s reach without losing control. Whether agents should also be deleted automatically is still under consideration.
He already sees shadow AI at work: employees bypass passwords and security measures with unapproved tools, and companies struggle to assess the resulting risks. Clear policies are needed. He also pointed to rising token consumption, which Omada wants to contain by structuring agentic processes upfront. On pricing, Omada licenses per identity; agents are priced differently and lower, while the human identity remains the main focus.
Sovereignty and regulation
As a Danish company, Omada positions itself as one of few European vendors in this field and cites sovereignty as a unique selling point. In Germany’s public sector, the topic is gaining weight, partly because SAP’s identity management is reaching end of life and monolithic setups are considered insufficiently agile. Omada points to its flexibility as a product strength and, for regulated customers, to Omada Identity Cloud Private, which according to the company runs in the customer’s own tenant with enforceable data boundaries. According to the company, KuppingerCole named it an Overall Leader in the 2026 Leadership Compass for IGA.
Regulation, Müller-Martin said, offers protection rather than burden. DORA, NIS2 and TISAX make traceability highly relevant in many places, with need-to-know, least privilege and the avoidance of conflicts of interest as focal points. Omada bundles its answer, centred on employee roles and permissions, in a package of 20 controls.
Partners instead of distributors
Omada works intensively with partners such as Securix, adesso and SVA, but deliberately not through distributors. Governance involves many stakeholders, Müller-Martin explained, and established teams can guide the change; business advisory is decisive for the move to agentic AI. He named Bayerische Landesbank, DEKRA, Haftpflichtkasse, Mahle and Mercedes-Bank as reference customers. Finance, automotive and insurance remain the target industries, though the focus is broadening.
The company employs around 400 people worldwide, with its headquarters in Copenhagen and Germany as its core market. After regaining stability, Omada plans significant growth, not necessarily through headcount but by concentrating on partners. For visibility, it relies on the KuppingerCole event, on it-sa with its walk-in traffic, and on partner events and Rethink IAM formats. Its pitch to customers: a Danish-built platform that lets them decide how and where it runs and who can reach their data.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de