Welcome to the KuppingerCole Analyst Chat. I'm your host. My name is Matthias Reinwarth, I'm the director of the Practice Identity and Access Management here at KuppingerCole Analysts. My guest today is again, it has been quite some time, is Dr. Phillip Messerschmidt. He is Lead Advisor at KuppingerCole. Hi, Phillip, good to see you.
Hi Matthias. Thank you for your invitation.
It's great to have you. And usually at that point in an episode, I introduce the topic, but this time we change. I hand this description of the topic over to you. What will you share with us today? What will you talk about? What is your brief insight? What do you want to talk about?
Yeah, Today I would like to share my experience regarding the five most common problems, misunderstandings or expectations when selecting a new software or a new tool. As you and hopefully also our audience know, KuppingerCole supports its customers in selecting tools in different areas. And one of those areas is IAM, where we regularly support our clients and we do that with our proven methodology.
That sounds great and you highlight the methodology. Of course we are using that methodology. We have developed it and we use that for what we call tools choices. So to give the audience a bit of an insight into what we are doing, can you briefly explain the methodology?
Yes, sure. No problem. So I think one of the most important aspects of any tools choice is a good preparation. So before you get in touch with a vendor or a solution, you should build a solid foundation and create some kind of playbook where you ensure that all topics that are important to you as a company are covered. And to do this, you need to answer a series of questions that can be divided into two sections. So the first one to start with is the enterprise side. And the most important questions with that side are, What is important to me as a company?, and, What are my expectations of a new solution? So the second is the market side, and here you need to make sure that you contact all relevant vendors, but not too many. So therefore it is important which types of vendors are relevant and which vendors should be contacted with the details. And on the enterprise side, we perform workshops with our customers to assess the status quo. In the workshops, we use the KuppingerCole Identity Fabrics and the IAM Reference Architecture as a solid and proven structure. And based on this structure we identify and discuss all areas relevant to the customer and ensure that future trends are also covered. So this approach leads us from observations about challenges and expectations to requirements that we can confront vendors with in a questionnaire. However, this questionnaire is only the first half of what you will need at this stage. So the second objective is to create some kind of shortlist with vendors you want to contact. And therefore for the market side, you need to assess with which market segment you need to look for potential vendors and create a longlist of candidates. And in the next step, you want to reduce that longlist to a shortlist based on the key elements from the business side. Examples for those key elements could be, How is the solution implemented?, so on-premise or a software as a service, Who will operate the service? Will it be operated in-house or through a managed service provider?, or Where is the focus of the service or vendor? So this could be in America and Europe, Asia, or even more specifically on country level. And as a analyst house, we are in close contact with these vendors and also have a good overview of the market. So with our research portfolio of Leadership Compasses, we already have predefined market segments and vendor assessments for these segments. And of course our clients can rely on this research, which makes it much easier for us as KuppingerCole to support on the market side and to create a long and shortlist. With both sides being covered at this point, you have to deliverables in your hand, a questionnaire with the requirements and a shortlist of vendors to contact. In then next step, you want to bring both sides together by sending out the questionnaire. So as a result of this, the vendors will obviously answer the questions that need to be evaluated at a later point of time. In addition to the questionnaire, you have the vendor presentations that are another good source of information. At these presentations, the vendor has the opportunity to present himself and the solution to the potential customer. On the other hand, this live demonstration also gives the audience a better insight into how the solution looks and works. And together, the vendor presentation and the evaluated questionnaires form a good basis for a decision. So in addition to that, in case there is a more in-depth demonstration of technical knowledge required, a proof of concept phase can be carried out. In such a phase, the vendor installs a solution as some kind of light version in the customer's environment and prepares predefined use case to demonstrate how the solution works and solves potential problems the customer may have. But in my personal experience, the POC phase is considered optional by customers and is therefore often skipped.
Wow, that is really the full process as you've just described it. And that sounds like quite a complex process to find such a suitable solution. And with this approach, what are your experiences? How long does this really take to go through the full process with the customer?
So we usually plan around 4 to 6 months from the kickoff to the final decision. This gives us enough time so that delays due to vacation times, illness or delivery problems from the vendors do not jeopardize the communicated milestones of our customers.
Right. So this this long time period, which is almost half a year, if you do it correctly, that leaves plenty of time to make assumptions and to make incorrect assumptions. Which leads me to the actual topic of this podcast episode. Phillip, what do you think are the five most common problems when selecting tools when this is executed? What from your experience can go wrong and lead to wrong decisions?
Yeah, just let's start with the first one, which is the following statement: “A tool selection can be done within a week”. As always, there's a little bit of truth in every statement. In this case, while it is true that you can choose a tool within a week such a decision would certainly not have a solid foundation. So, for example, you cannot perform any kind of requirements analysis, no vendor communications, no vendor presentations. Within a week you might be able to review websites and do some best research.
Well, but that's quite obvious. So one week without proper examining what your environment and what your specific requirements are, that is obvious. Why is this still a problem? Or to put it differently, why do the responsible managers still do this?
Yeah, in my personal opinion, the only reason can be that they try to save money and time, but for sure they pay much more money and invest much more time than they can save by their behavior, if the decision is bad and the solution does not meet their company's expectations.
Absolutely not. I think we cannot go without this requirements engineering phase. We might talk later about a quick start towards this approach, nevertheless, to get at least to a shortlist or something like that. But in general, yes, that is really an issue because just picking from the paper form of what you can see on websites can just not be the solution. I fully agree with that next problem. What would be your second guess? What are typical five problems when it comes to making mistakes on that way.
Yeah. Two other problems I often encounter on the requirements analysis phase. So when we ask experts from operations to describe their daily problems and how these can be translated into requirements, we often get answers such as “The approval process is bad”, “Tool XY can do it much better”, something like that. And as an advisor, I have two problems with these responses. The first is that the expert is pointing to a specific solution at a time when no one is talking about a technical solution yet. So that means that he is highlighting a very specific situation or process where a possible solution could help without looking at other people's requirements. So it is always important to gather all the requirements first before you make a hasty decision here. And the second problem with the statement is a bit more high level, so business experts often take care of the day-to-day business and therefore have a very strong focus on operational challenges. However, these challenges may change in the future and may not be a problem in two, five or maybe ten years. When I would have to decide for a new solution that will be used for years, I would want to make sure that it will be able to handle those future challenges. And therefore it is not enough to focus on the status quo. I also need to consider strategic development and activities in advance.
Understood. But I wonder if people are really ignoring future trends that impact the business at all. Usually, if there is a new shiny tool with a new shiny functionality that is a selling proposition, that is something that highlights even the role of such a product. When choosing such an appropriate tool, you have to be at least a little bit forward thinking and look at these new features, especially when they promise to solve a future issue.
Yeah sure, sure you are right, and maybe it's not as bad as I'm describing it now. Usually there are a few requirements that are focused on the next two or three years maybe, but that often doesn't cover all the upcoming trends you should look at.
Okay, then that is three. What would be problem number four out of this top five.
So problem number four, this about self reflection. So many of our customers strongly believe that they are different from other competitors, or the market itself. And therefore earlier or later, they try to adapt the tool to their specific needs such as processes or reporting lines. And usually they end up spending a lot of money without improving their situation. So my end would be: Vendors watch the market and develop their tool to meet best practices and regulatory requirements. If you want to design your own process or whatever, make sure you have a good reason to step away from standard and best practices.
Yeah, or at least have enough money to do so by extending the product while it might not be necessary.
Yeah, true.
So last problem, number five. What would be the final thing that you experienced or have noticed when doing such and consulting situations.
The last problem I want to highlight is along the same lines. So these particular customers also believe that a new tool will solve all their problems. So from my experience, I can tell you that this is not the case. Bad processes remain bad even with a new technical solution. If you really want to change and improve your situation, you must also address organizational and functional challenges while implementing the new solution.
I understand. So we have five problems, so that might also need five recommendations. If you summarize that, what would be the sum of these problems fixed or solved?
Yeah, I will briefly summarize that as recommendations instead of problems. So first one would be: Take your time to choose a new tool. One week is not enough. Second: don't talk about tools while collecting requirements. Third: Consider trends and future challenges to decide on a future proof solution. Fourth: You, your processes and your requirements are not special. Review established market solutions and identify best practices to follow. And last but not least: A new technical solution will not solve all your problems, especially not the organizational and not functional challenges.
Great. Thanks, that is a great summary of what you just highlighted when it comes to executing such tools choices. So we as KuppingerCole have just come up with a new digital service that might help or should help in that context as well. And I think many of the of the recommendations that you've just given apply here just the same. So we are offering KC Open Select, a platform where you can, online as a digital service, can select in different market segments starting out with Passwordless Authentication. Have a look at the products that are around and you specify your requirements and then you drill down into the market, ending up very quickly in a longlist to shortlist approach. But all this can only work if you have done your homework, if you have executed your requirements analysis and that is still valid at that point. So just because you move over to a tool which really can speed up the shortlisting process, you always have to build upon your own requirements, would you agree here?
Yeah, absolutely. As I mentioned, the process remains. A requirements analysis is very important to understand the business side.
Right. And you've mentioned the trends and future challenges. Of course, when we look at vendors inside this KC Open Select platform, we always will also highlight their specific selling propositions. Where are they better, where do they differ, where do they excel? And so that will be something that really can help. And I think all the five recommendations that you've mentioned really help in also using such a tool that will take over one part of the selection process, of course, the other steps, as you've mentioned, not just within a week, need to be executed properly as well. So do the homework before, have a look at KC Open Select and get to a shortlist that really helps you in moving forward towards a new solution. But additional steps, including talking to the vendors, having them present the solution, having a demo or even a POC are still required. But I think nevertheless this digital service that we offer really can speed up parts of that process very easily and I really recommend the audience to have a look at that, starting mid of February. Thank you, Phillip, for sharing your insights. Any final thoughts that you want to add when it comes to extending, for example, such a traditional advisory approach to tools choice with such automated support?
I fully agree. Such an automated solution will not replace the approach itself. It can speed it up, it can help you. But you still need all the other phases as well to come to a good decision.
Right. What you can do is the scenario testing and say, okay, I changed this requirement. What does that mean for the resulting list? So you have more a scenario technique in place and available. But that really can also help in getting a better understanding of the market. And if you need more information about the market and maybe you need advisory support, we are still here to help and to support you in these phases that are not well covered in such a digital tool. Thank you again, Phillip, for sharing your knowledge, your insight and your experience with the audience. Thank you for helping me also having a quick hint at this new service. It's free. Have a look at it and start with looking at Passwordless Authentication solutions. Looking forward to having you Phillip in one upcoming episode very soon again. And yeah, that's it for today.
Thank you very much for listening and bye bye.
