Author: Vlad Shapiro

By Vladislav Shapiro, IGA Expert, Costidity Inc.

My 2024 Market Guide analysis is the first edition without Henrique Teixeira, who decided to move on to greener vendor pastures while also now making shoes! This year’s guide became almost twice as long as the previous one (36 minute read vs 19 minutes, and double the number of pages). However, you’ll see a different tone in the guide: the grumpy old Identity traveler (see my 2023 analysis) was substituted with a realist practitioner. 

Just look at the Key Findings: 

• More concise: 3 findings instead of 4 
• No “one advice fits all”: “There is no one best-practice … IGA initiative and corresponding feature set” 
• A need for seeing the whole picture: the word “analytics” is out (2 in 2023, 0 in 2024) while words like “visibility” (three times) and intelligence (once) are in
• Often one IGA solution is not enough: “Native features in IGA tools …. are still insufficient… leading … to implement supplemental tooling.”
• Extra attention to product newcomers: the word “vendor” is gone (twice in 2023), while “substantial innovation… robust startup activity” is in.

Summary: Gartner analysts spent more time with mature customers and implementation partners, and decided to give their intelligent views more visibility, which is a substantial shift for the guide. 

As a mathematician with heart, I pay attention to numbers and words. This guide has number 4 all over it. The fourth edition of Gartner’s market guide has four authors, released in 2024 on 08/26 (8+2+6=16=4×4), and 20 listed vendors (4×5). Along with that, some key word usage throughout the guide outside of the typical “Identity”, IGA”, “security”, “access”, “data”, “feature”, “business”, include: 

• “Visibility” – 30 times
• “Risk” – 25 times
• “SaaS” – 25 times
• “Analytics” – 24 times
• “Intelligence” – 19 times
• “Value” – 14 times
• “Innovation” – 6 times
• “Substantial” –  6 times

Based just on the frequency of those words, one can see the direction Gartner is proposing: 

• For customers: to have a successful IGA program, your enterprise should be able to see, measure, analyze and evaluate identity and access data. 
• For vendors: to be substantially innovative and have a real SaaS IGA offering. 

The 2024 edition has an interesting innovation in the vendor’s list: out of “at least 55 vendors in IGA market”, “20 vendors listed… verified that they offer a SaaS version … and sell in multiple regions”. As a result, many familiar to public vendors are not on the list, including Microsoft and SAP. It’s very interesting that Delinea is the only PAM-centric vendor left from last year’s list, with other players like Broadcom and CyberArk missing. To get the hidden message from Gartner, please pay attention to “verified … SaaS version” in combination with “innovation” and “visibility”.  Vendors, take notes.     

One of the biggest additions to the guide is the introduction of the VIA model (visibility, intelligence, actions) as a part of the Market Analysis. This model will be a huge help for IGA/IAM practitioners who, for years, have been screaming about a lack of visibility across the industry about actual reasons why a person has assigned entitlements/roles and how it’s used by an individual. The same goes for non-human identities, as one cannot build a successful program being “visually impaired”. As the VIA model states, “Intelligence quality depends on visibility” and “action quality depends on intelligence”. 

General observations: 

• The Market Guides “Key Findings” has an interesting relationship with “visibility”, as its mentioned more and more with each new finding: 
• The first “finding” is about “there is no ONE best-practice for an IGA initiative”, so no visibility
• The second one talks about “enabling visibility” (used 1 times) 
• The third one talks about “comprehensive visibility” and “integration and visibility” (2 times) 

Combining this with the VIA model, it creates a powerful message that the visibility of the real situation at your organization is key for a successful IGA program.               

The most intriguing feature is “support for shared signals”, which includes “continuous access evaluation protocol (CAEP)”, one more unpronounceable acronym for non-native English speakers like me. Then, possibly, bearing in mind people like me, Gartner’s authors decided to become English teachers and explain that “sharing” means “ability to send, receive and respond” signals. Thank you for not going further and explaining the meaning of the verbs above!  

Continuing the 2023 tradition, market description contains a forecast, but this time in percent only (13.9%) and for “1Q24”. No more $31.99 billion from a year ago. Since the Market guide was written in August 2024, Gartner is seemingly forecasting the past. 

It looks like Gartner analysts read my 2023 analysis and decided to bring acronyms back to Figure 1, but only in one place: “Access policy mgmt..”. To my surprise, PBAC did not make “incl. RBAC, ABAC, SOD). Is it a hidden message to PlainID leadership or did they just run out of room?  

The 2024 market directions are, let say, multi-directional. Although drivers are clearly defined ( “shift to SaaS”, “influence of security and business enablement”, “visibility” (again!), “intelligence”, “improved speed/ease of integration”), what will happen next is not. For example, when it comes to SaaS, “some sectors are seeing increased uptake of SaaS migration”, but “self-hosted options will remain in some sectors and regions”. Also, “business drivers are highly variable”, “we don’t anticipate that AI-enabled IGA will become a mandatory feature”, “it is difficult to rapidly and easily integrate target systems with IGA solutions”. At the same time, Gartner is giving one strong prediction: “additional evolution of available IGA technologies from light IGA to full-features IGA in the coming year”. Just combine this statement with the fact that only companies with full-featured IGA solutions are on the list of representative vendors, and you understand why this prediction is solid. An interesting observation is that there is no mentioning of service providers in this section. Instead, the last sentence is about “use of AI-enabled software engineering methods to accelerate target system integration with IGA solutions”.  Something tells me that implementation providers should be ready to respond to the “are you using AI?” question in RFP in the nearest future. Just a warning, not a prediction.    

This year’s Market Analysis has a lot to say about identity-first security approach: 

• Definition of identity-first security goal: “to shift from a point-in-time configuration to real-time, dynamic enablement, which will include account provisioning and policy orchestration, with the right entitlement and attributes determined dynamically”.  This statement needs a separate discussion, but “dynamic” is definitely the most important word defining the direction of the trend. 
• “SMR leaders should adopt identity-first security approach to their IAM program positioning their organizations as proactive instead of reactive”
• “Identity-first security requires centralized policies to be extended to decentralized assets”

My conclusion: Gartner analysts realized that identity-first security principles need explanation for both IAM and IT security specialists. Use this guide in a conversation about getting funds from IT Security budget towards IAM for achieving implementation of identity-first security. 

There is also a message to the potential customers: “IAM leaders should weigh in the value of adding an IGA integration and visibility solution relative to the acquisition cost”. Here is the hidden message: if you do not have an ROI report on a proposed solution, then chances of getting a budget are very slim.   

One more theme of analysis is “machine identity management”. The main statement is about “implementing IGA-based machine identity management capabilities as a part of an identity fabric that includes required PAM and credentials/secrets management components”.  I comprehend this as a strong Gartner analyst’s request to treat machine identities with the same attention as human ones. 

Now let’s talk about the vendor list. This is the first year using a short list: “Gartner estimates 55 vendors in the IGA market overall. 20 vendors listed offer a SaaS version and sell in multiple regions”. The big news is not who is in the list, but who is not: Microsoft. You can make the conclusions by yourself why. 

I am not planning to analyze each of the 20 vendors, rather, provide their unique messages straight from the vendor profile. Note that unique message does not represent solution features or rating, just something essential about the vendor itself:

Just like last year, I’m continuing the tradition of using the Most Valuable Quotes of the Guide (MVQs). You can vote for MVQ via LinkedIn by connecting with me and messaging your favorite number. Here are the nominees: 

1. “There is no one best-practice identity governance and administration (IGA) initiative” 
2. “Support for shared signals, including ability to send shared signals and receive and respond to shared signals”
3. “Requirements to add local language models (LLMs), for GenAI specifically, to keep sensitive client access configuration data out of public LLMs”

Gartner provides 3 market recommendations for SRM leaders. This time recommendations are very similar to the first page recommendations, with a couple of clear messages for IAM/IGA leaders:

•  IGA program will have success only if it corresponds to an “organization’s required outcomes”
• Spending on IGA is an investment of your enterprise, so “accelerate the realization of business value from IGA investments”
• Follow VIA model and concentrate on visibility

In conclusion on recommendations: it does not matter if you read the first two pages or last two pages – you will see recommendations in both cases. 

For the first time, the Market Guide ends with two notes: potential top-value access intelligence use cases and IGA requirements for Machine identities. My guess, Gartner analysts responded to reader’s demands to explain both.

I would love to hear your opinion about the guide and my observations.

By Vladislav Shapiro, IGA Expert, Costidity Inc.

The third times a charm, or at least that’s what Gartner was thinking when putting together this Market Guide. It looks like 2023 is on a slower pace compared to 2022 in terms of acquisitions as the biggest deal to date is CISCO buying Oort, while Thoma Bravo is sitting on the sidelines figuring out who is the next target. At the same time, there was a hurricane of conferences; all major identity events (Gartner IAM Summit in US and London, Kuppinger Cole and Identiverse) took place within 75 days between March 20th and June 3^rd. 

Since I’m a fan of tradition (Tradition!) we’re continuing to use travel analogies in my analysis of the market guide. As 2021 was an identity traveler’s book, 2022 showed us a travel map of identity, and now 2023 sounds like a review of someone who just came back from their identity travels in a very grumpy mood as all key findings were negative. I don’t think any IGA-related reports (MQ or Market Guide) have previously contained the words “confusion”, “difficult to determine”, “not” (twice!), “inflexible” and “slow” right on the first page. In my opinion, it’s a warning, especially for vendors, that they’re not going into Gartner-suggested directions: change the course or else…. Remember that Gartner is still consulting your potential/existing clients and created this list of “representative vendors”. 

As a mathematician with heart, I pay attention to numbers and feelings. This years’ guide does not contain details on vendors or their products, so one needs to read the in-between-the-line messages and apply them to what we know about the vendors to see the real story. My analysis will help with that.

This year, there are more listed vendors (39 vs. 31 last year, which is more than double from the first guide which was 19), using the same number of authors (5), along with key findings and recommendations (4) as last year’s edition. The big difference is the tone of the findings, which is very concerning.  

The 39 showcase vendors are listed in alphabetical order with no exceptions. The list of newcomers includes Alcor Solutions, CyberArk, FastPath, Fischer International Identity, Netwrix, OpenIAM, Radiant Logic, Tools4ever and Zoho. Two vendors were dropped (Ilantus and Iteris) and three vendors have changed names for different reasons (Hitachi -> Bravura, Microfocus -> OpenText, Paraview -> Shanghai Paraview).  There is one alphabetical order change: E-Trust was listed last year as EmpowerID, which they switched places in 2023. It looks like someone at Gartner decided to ignore the dash in E-Trust, and treated it as “Etrust”, which contradicts the holy NISO (https://www.niso.org/sites/default/files/2017-08/tr03.pdf) guidance that – “3.2 The hyphen, dash (of any length), or slash is to be treated as a space” and, according to section 3.0 “order of characters”, spaces go before letters. So, based on NISO, the 2022 order is the correct one. Gartner should trust the vendor’s name, which is very trustworthy, especially with the dash, and restore the NISO order of things. Sorry, Patrick Parker, nothing personal; we know that your solution really empowers! 

General observations:

• This year, Gartner should change their “Key Finding” into “Key Cautions”, a blast from the past from MQ times. “Confusion” (the first word of the section!) about light IGA functionality, not supporting “continuous and context-aware controls”, machine identity inadequate handling (“tools have not kept up with demand”) are all directed at vendors who didn’t get the hint from the 2022 report. Only one “finding” is pointing to a client’s typical shortcoming: “analytics adoption… is slow and mostly based on descriptive (reporting) and some risk scoring”. There is no “strength” key finding in the report at all, which shows me the frustration by the authors towards both vendors and clients. My advice to all, especially vendors: pay attention to these findings, show some love to Gartner, and react to criticism by showing improvements in 2024. Otherwise, Gartner will go to the next step by adding names to the deficiencies and issues, and you do not want that! One more kudos to the authors: no more “legal language” in findings (see my 2022 analysis for the examples) – all should be clear and understandable, even for a non-native speaker like me.   

• The recommendations section starts with the following sentence about who it’s addressed to: “For security and risk management (SRM) leaders responsible for identity and access management (IAM)”. Henrique, thank you for reading my analysis last year and deciphering acronyms! Now the new mystery: if you compare this years’ statement with 2022’s first statement (“For SRM leaders responsible for IAM and fraud”), you will see that “fraud” is gone. I am not sure what kind of underlying message that is: either the SRM’s responsible for IAM are not in charge of fraud anymore, or whoever is still taking care of fraud should not read the recommendations. For non-fraud fighting crows, each recommendation is specifically addressing the “key cautions” (i.e. findings) to check if “light IGA solution” is not too light and “provide sufficient depth of functionality to remediate “confusion” (key finding 1), find solutions “with identity-first security principles to remediate lack of “continuous and context aware controls” (key finding 2), implement “AI/ML analytics capabilities” to fix “descriptive reporting” (key finding 3) and add “lifecycle management of machine identities” (key finding 4). This structure supports my idea of renaming “Key Findings” into “Key Cautions” for 2024 and confirms that Gartner is very serious this time: not fixing cautions means not following recommendations. That’s great news for IGA practitioners when it comes to building an IGA program and choosing an IGA solution: a clear list of what to look for and how to mitigate. This looks like another read-between-the-line message.

• The market guide authors continue stressing their points about the importance of analytics and machine identity data by making two corresponding strategic planning assumptions for 2026: “analytics functionally in IGA tools will advance” and “IGA … will include capabilities to… support machine identity data … in their capabilities”.  I hope that SRM leaders have the ability to discover IGA product capabilities which can match machine capabilities in their full capacities. In addition, Gartner provides a very important financial incentive prediction: adding “AI/ML-based IGA analytics” will see “governance costs 50% lower”. If you are thinking of adding this to an IGA presentation for C-level execs or board, be careful and investigate what your current governance cost structure looks like. If you spend most of the money on tools and services outside of your organization, you are fine. Otherwise, you know what is coming in 2026.
• The Market Definition was updated this year and it’s very interesting. In 2022, it was stated as “provides administrative control… across multiple systems for multiple user types”. However, in 2023, it’s an “enterprise solution to manage… across on-premises and cloud…”.  I think it’s a good change, especially for someone who needs to convince management to buy an IGA product, and “provide control” sounds vaguer than “solution”. As we continue the theme of machine identity, Gartner stresses that “to accomplish this, we need to enhance control over human and machine access”.  Another change from last year is that IGA tools don’t “orchestrate”, they aggregate and correlate. This led analysts to dropping “ensures appropriate access to resource”, which is logical due to removing “orchestration”. To me, it’s a clear message to vendors: spend more effort on analyzing features.
• In 2023, Gartner decided to categorize capabilities into three groups (compared to two last year): must-have, standard and optional.  The underlying message for vendors is: an IGA solution must provide identity lifecycle management, access request processing and basic analytics and reporting. If you are missing one of them, either add it to the product or do not call it IGA. Clear and simple.  
• Unlike previous editions, 2023’s market description starts with the size forecast that indicates it doubling over the next 4 years (estimated $31.99 billion market in 2027). Why not just round up the estimate instead of the number looking like a price tag? Well, Gartner is always selling, and between VCs, entrepreneurs and potential start-ups, there will be plenty of money available, so go for it. Analysts even hinted where you should put your money and efforts with “the need for governance of a growing number of IaaS and cloud-based applications… requires more types of workloads”.
• This year, the focus of Figure 1 changed from explaining what is within the complete IGA suite to layered tasks/modules grouped vertically (module type by administration) and horizontally (by functionality), which looks much closer to what vendors usually draw on their marketing/white paper materials. One big difference from 2022 is most of the blocks have business-like names, which tells more about what this module should do versus how to do it. No more techie acronyms, like PAM, MFA, SCIM, JIT, CIEM, etc. An “analytics and reporting” block in 2022 evolved to 4 analytics blocks this year: Descriptive, Diagnostic, Predictive and Prescriptive. There isn’t a “reporting” module. The message here is the same as in key findings: analytics are critical and sellable, especially for mature clientele.

In 2023, the market direction section is multi-directional. The “on-premises solutions being shunned in favor of SaaS solutions” is followed closely by a “significant number of customers … still favor on-premises solutions”. There “are more ways to consume IGA today…”, “functionality enabled as needed… at the same time…acquisition seeking to add functionality is missing”. These are examples of a lack of general trend followed by everyone. This is a reality and Gartner clearly does not provide a one size fits all solution, but rather pointing to a more customized approach. As a result, vendors and customers are becoming an important piece of the puzzle: “Geography… can be an important consideration for the selection of an IGA vendor … even when solution is SaaS-based”.

The last sentence of the market direction is very significant and should be put on the front page of every IGA professional services presentation: “Access to local professional service providers that have technical knowledge and experience… is a key consideration for selecting an IGA vendor”. Thank you, Gartner, and all the hard-working consultants for pointing this out, even in the era of remote work, being local to customers has a huge advantage from the human factor standpoint. It is much easier to build relationships with local folks than remote personnel, and due to the fact that “organizations continue to struggle with the complexity of their ecosystems”, being physically nearby is psychologically advantageous compared to being a face on a screen. So, if you are in the process of choosing an IGA vendor, check if there is a local partner who knows what to do and will be your guide in this complex world of IGA.

The Market Analysis section is traditionally the most informational part of the Market Guide. Here, analysts provide their vision of the current state of IGA and trends. In 2023, this chapter has more than 5 pages and the following subsections with direct relations to key findings:

• Light IGA Versus IGA Suites (almost two full pages) – Key Finding #1: “Confusion”
• What Good Looks Like: Identity-First Security (smallest section, less than one page) – Key Finding #2: “not supporting continuous and text-aware control”
• Improving AI/ML-Based Analytics (almost two full pages) – Key Finding #3: “slow analytics adoption”
• Improving Machine Identity Management Capabilities (One and a half pages) – Key Finding #4: “not kept with demands on machines identity management”

Note that the shortest subsection is “what good looks like”, which supports my comparison of this year’s Guide with a TripAdvisor’s 1-star travel review describing their journey around the IGA world.  Gartner analysts allowed themselves to write a very straightforward cautionary tale of the IGA state of affairs directed at both vendors and clients. 

Continuing our tradition from my 2020 analysis, we’ll use a table with 2023 quotes and their subsequent hidden messages in Market Analysis for vendors:

This year, there are much more quotes geared towards customers and clients:

This year, I’m introducing a new category in my analysis called the Most Valuable Quotes of the Guide (MVQs). You can vote for MVQ’s via LinkedIn by connecting with me and messaging the number of this year’s nominees:

1. . “Ask not if the IGA solution feels “complete” or “light” for you, ask how “complete” or “light” the IGA solution looks for your customers.”
2. Gartner predicts that the application of generative AI to IGA use cases will deliver additional value in the future, though neither the timeline nor the additional value for IGA specifically is clear yet.
3. For machines, ownership means the “responsible human”, not the actor who should be using the identity/account.

Lastly, the 4 market recommendations for SRM leaders. These recommendations are very similar to the first page’s recommendations, but with more details:

• Added note to “light IGA” discussion that “it is rare that those opting for IGA suites fully implement all of their capabilities”. My reading of the in-between-the-line message: do not be afraid of light IGA, most companies implement light version of IGA suite anyway.
• Added into the “identity-first” 1st sentence is “complement the rest of your identity fabric” followed by “enable decisions throughout the user journey, focus … on a consistent user experience”. 

At the same time, the third recommendation is about “business value from your IGA investments” which somehow lost all “AI/ML-based” words before analytics. Most likely, the authors realized that the reader is tired, and they should limit acronyms to just IGA (10 times across all four vs. only 5 times in the first page recommendation section)

In conclusion on recommendations: it does not matter if you are a person who just reads the first two pages or last two pages – you will see recommendations in both cases.

I would love to hear your opinion about the guide and my observations.

This is the second edition of the Market Guide for Identity Governance and Administration, circa 2022, the year of the comebacks. Thoma Bravo is back on a shopping spree, Tom Brady is back with the Buccaneers, conferences are mostly back to an in-person format (with the ever-present online option sticking around), while the bravest among us attended them despite an unpleasant comeback, a spike of COVID-19. Hail to the strong-willed, adventurous vaccinated folks!

In last year’s analysis, I compared the market guide with a traveler’s book. This year, that comparison wouldn’t work since the vendor details were omitted. So, the better analogy would be a traveler’s map as all the landmarks are there, but with non-descript locations. An odd thing I noticed was that every non-North American HQ is represented in cities like Shanghai, Sao Paulo and Melbourne while the North American ones are states or provinces like California, Texas, and Ontario. Perhaps Copenhagen is easier to spell than Cupertino?

Anyway, as a mathematician with heart, I pay attention to numbers and feelings. We know that the guide is missing those vendor details, so will Gartner write in-between the line messages directed at specific vendors, or will those wise thoughts only be for customers? Let’s investigate.

This year there are more authors (5 vs. 3), more listed vendors (31 vs. 19), more key findings (4 vs. 3), and more recommendations (4 vs. 3) using fewer pages (15 vs. 19) than last year’s edition.

The 31 showcase vendors are listed in alphabetical order with no exceptions, whereas last year there was a disturbance of alphabetical peace (see my 2020 report on that) and was excluded from the sample list, which immediately resulted in changing the Web front-page to Italian ( www.netstudio.it). I believe this is related to the subpar performance of Firenze in Serie A but I’m not certain, we need to ask Henrique.

General observations:

• Gartner did a great job on refreshing key findings as instead of focusing on famous corporate Bingo words such as “cloud” and “zero trust”, the authors found a new approach: discovering challenges. They hit on topics such as Asset Management, Operations Problems and Machine Identities, but it’s interesting that one of their key findings contains actual recommendations on how to deal with challenges, which before you’d only find in the recommendations section. They say to “look beyond technical capabilities and evaluate how, and how easily, they can be deployed, integrated and operated”. What is the message between the lines here? My take is that it’s all about the human factor. Each key finding is directed towards the specific needs of the specific group of individuals, like SRM and IGA managers, and giving them talking points for promoting their agenda within the organization (“It’s not me talking – it’s GARTNER!”). There is also a message to vendors: here are the real issues, please address them in the products. My question for Gartner is: did you consult with your lawyers before writing “underpinning identity fabric in which insights from identity and access management (IAM) tools are shared reciprocally with insights from adjacent tools”?  I understand that Halloween recently passed, but this is too spooky for even someone whose native tongue isn’t English. 

• As in 2020, the recommendations section starts with a shorter version of the same revealing sentence about who it’s addressed to: “SRM leaders responsible for IAM and fraud detection”.  However, unlike in 2020, there’s no decoding of both acronyms. The message to the readers is if you don’t know what this is by now, stop reading. This edition’s recommendations are definitely deeper and more multifaceted than in 2020. Instead of just “simplify the selection of

IGA vendors” and “ensure you have a long-term strategy “(2020), the authors recommend to “Evaluate not just traditional capabilities, but also meet upcoming cloud-related needs, security coverage, and support AI and ML” (2022). Instead of suggesting to “target a SaaS or cloud-based deployment first” (2020), the analysts proposed a different strategy that it’s “important to examine SaaS and platform solutions, estimates, and cost of using professional services or managed service.” (2022). In addition, there are two new recommendations: “Treat machine identities as distinct identity types that must be managed and governed similarly to human identities” and “Identify key use cases early in any review process”. What is the underlying message behind all of that? To me, it is a request for shifting from an architectural-project approach to a more practical business/financial one with a much wider view. Gartner hopes that users and vendors will follow these recommendations.

• The same shift is visible in changes related to strategic planning. In 2020 it was very architectural with “SaaS-delivered, converged IAM platforms like IGA, AM, PAM”, but in 2022 it’s about “using IGA analytics and insights as part of a wider identity fabric to reduce security risks across IAM estate”, which is clearly more of a business-like approach that appeals to a larger crowd than just IGA. Since strategic planning is addressed to business leaders, who understand and appreciate “security risk reduction”, this shift should help you to get better funding. Again, I did not say it, Gartner did.

• The market direction and market analysis sections showed us why Gartner decided to forego vendor details as it gives the reader’s a different perspective and hints which can be easily interpolated on a particular software maker. You just need to find the golden nuggets hidden in their messaging, and that’s exactly what we’ll do. 

Let’s get deeper into the market direction, or at least the Gartner analysts’ opinion of where we’re going. In 2020, we were going to expand on the “unaddressed market segment for large to global enterprises in emerging geographical markets”, and evaluate “IGA technology rapidly being adopted by midsize organizations with less demanding requirements”. In 2022, the direction changed as it started by getting “cloudy” for two paragraphs which then led to RPAs with a “significant number of machine identities …to the extent that nonhuman identities now outnumber humans” and the emergence of “identity fabric” which was mentioned 9 (!) times in the report overall. As a comparison, “identity governance” appeared 7 times.

Hint to vendors: you better start including “identity fabric” in your marketing materials as a new checkbox is coming into your RFI and RFPs! Especially since there is no official definition of what it is. KuppingerCole version is that it “stands for a paradigm of a comprehensive set of Identity Services, delivering the capabilities required for providing seamless and controlled access for everyone to every service”, while the Security Boulevard version is a “distributed, multi-cloud identity management framework integral to Identity Orchestration software”. Wikipedia has no idea as the page “Identity Fabric” does not exist as of October, 1^st 2022, but Wikitia has a version that states an “architecture design approach that serves as a foundation for defining or continually updating enterprise architectures for Identity and Access Management (IAM).”

If you Google it, the “People also ask” section has the following answer:

An Identity Fabric is an abstraction layer in a distributed identity management framework provided by Strata’s Maverics Platform. 

Bravo, Strata! Your money was not wasted on Google advertisements. Someone deserves a promotion!

The Authors dedicated 4 (!) paragraphs to vendor directions as “vendors are responding”, “vendors have relatively stable offerings”, “vendors have SaaS deployment options”, and “vendors are striving to improve.. support for nonhuman identities”. All of these research insights are hidden demands aimed at product management teams across the esteemed IGA space. Another hint for vendors: potential customers will read the market guide too! Look for more checkboxes! 

Continuing our tradition from my 2020 analysis, we’ll use a table with 2022 quotes and their subsequent hidden messages:

The next three paragraphs are for leaders, SRM and IAM. Interestingly the authors assume that leaders have more time to read, so the title “Gartner’s Buyer’s Guide for Identity Governance and Administration” is directed to them. It’s probably because IAM leaders are too busy with “assessing the capabilities and deployment and management implications of available solutions against the needs of their organization both now and for the lifetime of an IGA tool” for “five to eight years”. I’m not sure if these overwhelmed people can foresee needs for 5-8 years ahead, or prepare the next generation of IAM leaders to replace the solution in 5-8 years, perhaps both. Meanwhile both types of leaders should remember that “platform-based tools have technical deficiencies, they have attractions in terms of cost, ease of deployment and ongoing management of fewer solutions … reduces the overall IT overhead within an organization.” Here is my reading between the lines: choose your list of “must haves” and look at a platform-based solution. Maybe you do not need all these extra technical capabilities?

Now let’s talk about Market Analysis. As done previously, I’ll extract some interesting quotes and decode their messages.

The next two paragraphs within the market analysis are dedicated to two thoughts:

1.  Light, Platform-based IGA is a real thing and, in some cases, even preferable for fulfilling certain needs.
2. A machine Identity avalanche is coming and requires management strategy now. Due to the sheer number of such identities projected in the near future, governing them will become a necessity and part of regulatory requirements and compliance, so you’d better plan for what’s coming.

Similar to the previous report, the “Market Guide does not imply an exhaustive list. This section is intended to provide more understanding of the market and its offerings”. Again, there are two hidden messages here (like in 2020):

1. To potential customers: “An exhaustive list exists; it is long and dynamic (requires timestamp, almost like attestation), so we decided not to exhaust ourselves to assemble it. If you found a good match in terms of value/capabilities, you can tell your management that this vendor is on the list. We will confirm it as long as your organization is our client.”
2. To a vendor: “You are always on our exhaustive list. We care about you even if you are not a listed vendor. You are still important; just help the customers!”

Finally, 5 market recommendations for SRM leaders. Please note: they are not the same as the recommendations on page 2. Why are there two sections on recommendations? My answer is the following: it does not matter if you are a person who just reads the first two pages or last two pages – you cannot avoid direct recommendations! Smart! It allows busy people to save tons of time and get straight pointers on both ends.

I would love to hear your opinion about the guide and my observations.

Vladislav Shapiro, Costidity and Stan Hammer, WCU were invited to present at Gartner IAM Summit 2022 about the human factor in IGA. The presentation took place on August 22nd with more than 100 Summit participants. For the first time, NPR method and reports were revealed for the public to observe based on WCU real data. There were several questions asked by the attendees and many follow-ups conversations during and after the conference. If you would like to get the presentation in PDF format, please fill out contact form and request it.

2017 is a year of changes:  a new four-year cycle, a new US President, and a new Magic Quadrant. Congratulations to Gartner with breaking from previous trends shown the during second term of the Obama administration for releasing MQ later and later every year. This time, surprisingly, the report came one week earlier than in 2016, which corresponded to my prediction in last year’s analysis.

Read more GARTNER MAGIC QUADRANT ANALYSIS, IGA 2017

This time, Gartner was able to beat last year’s delay: the results of their 2015 research became available in… March 2016. The “Magic Quadrant for Identity, Governance and Administration” is dated February 29, which is some kind of a record: you cannot release it later if you want to stay with winter months. And the next three reports will be released earlier for sure, just because the next February 29 will be in 2020.

Read more Gartner Identity, Governance and Administration Magic Quadrant 2016 analysis

Two weeks ago, I attended an annual Gartner Identity and Access Management Summit in Las Vegas. For veteran attendees, the summit presents the possibility to compare it with the previous years—to see what has changed, what new ideas analysts present, what new vendors show up and what vendors did not. Read more Gartner IAM Summit: Surprises and Trends

Why Costidity is Important to C-Level Management

We are certain the subject of Costidity is of relevant interest to IT Security and Identity, Governance and Administration practitioners. But at the same time, we know that these practitioners need support from C-level management and executives to get anything done and manage Costidity. Support comes from personal interest though, so it’s important to know what each C-level manager can gain from implementing Costidity management. Read more C-Level Management and Costidity

Why Managing Risk in IT Security and IGA Isn’t Enough

When we started talking about the cost of the human factor, i.e. Costidity, people began asking me, “Why are we creating another dimension for assessing governance elements, like business policies and processes? Everybody is doing risk management. And risk already includes the human factor, in particular, the ability to lose the information by emailing it to the wrong person.” Read more Costidity & Risk in IT Security and IGA: A Comparison

Why do IT security and IGA policy makers and managers have different perceptions of reality than the policy constituents? In our opinions, it’s all about intentions and motivations. Read more Are Differences in Intentions and Motivations Increasing Policy Deviations?