Atos DirX Audit

Access Governance & Intelligence is an IAM-focused risk management discipline designed to involve the business in managing access rights across an organization’s IT environment. Access governance provides largely self-service capabilities to manage access workflows and entitlements, run reports, execute access certification campaigns, and perform segregation of duties (SoD) checks. Access intelligence sits above governance and adds business-oriented insight to improve decision-making and strengthen governance through analytics, pattern recognition, and (where available) advanced techniques supporting process optimization, role design, automated reviews, and anomaly detection.

The discipline targets core questions essential to compliance and risk control: who has access to what, who accessed what and why, and who granted that access. Key supporting functions include access warehouses, certification, analytics, risk-based scoring for access requests, access request management, SoD policy enforcement, and enterprise role management. Weak access governance is positioned as a major driver of modern security incidents, with risks such as data theft, loss of personally identifiable information (PII), privacy breaches, industrial espionage, ERP occupational fraud, and reputational damage; notable financial scandals are cited as preventable through stronger controls.

The report evaluates Atos DirX Audit as an Access Analytics and Intelligence solution complementing DirX Identity and DirX Access. DirX Audit consolidates audit data, enriches it with user context, and transforms raw events into structured information about application usage, access timing, user identities, and performed operations or accessed data, while correlating approvals and entitlement management. It supports historical analysis with timeline views for forensic tracing, risk scoring across multiple factors (including non-mitigated SoD violations), dashboards with drill-down, KPI generation with many pre-configured metrics, extensive reporting (70+ reports, multiple formats, GDPR-related templates), and centralized access certification tracking. Strengths include breadth, scalability, user behavior analytics, and flexible ingestion beyond DirX; challenges include limited visualization variety, lack of AI/ML features today, and no continuous event monitoring with alerting.

• Access Governance & Intelligence facilitates business involvement in managing access rights across an organization’s IT environment.
• Access governance capabilities include workflows, access entitlements management, reporting, certification campaigns, and SoD checks.
• Access governance aims to answer: who has access to what, who has accessed what and why, and who has granted that access.
• DirX Audit targets Access Analytics and Intelligence and complements DirX Identity and DirX Access.
• DirX Audit analyzes both static access entitlements and user behavior analytics on what data users accessed in the past.
• Data can be collected from applications via file transfer/imports or via JMS using an Enterprise Service Bus for continuous delivery.
• Historical audit data is displayed on a graphical timeline with drill-down reference links to related access and approval events.
• Risk assessment considers factors such as number of active accounts, accessible applications, and non-mitigated SoD violations.
• DirX Audit provides more than 70 pre-configured reports in formats including HTML, PDF, and Excel.
• DirX Audit does not support ongoing auditing, event monitoring, and alerting based on thresholds.

• “Access Governance & Intelligence is an IAM focused risk management discipline that facilitates business involvement in the overall management of access rights across an organization’s IT environment.”
• “Access intelligence refers to the layer above access governance that offers business-related insights to support effective decision making and potentially enhance access governance.”
• “Data analytics and machine learning techniques enable pattern recognition to deliver valuable intelligence for process optimization, role design, automated reviews, and anomaly detection.”
• “During the last few years, many prominent security incidents originated from poorly managed identities and proved the need to address these issues across all industry verticals.”
• “A key capability of such audit and analytical solutions is collecting historical data.”
• “This e.g. enables auditors to understand the cause of assignment, by mapping audit events to the related access requests, approval and provisioning events.”
• “As mentioned earlier, a specific strength is the KPI generator.”
• “Reporting anyway is a strong capability of DirX Audit, delivering more than 70 pre-configured reports and supporting a range of formats such as HTML, PDF, and Excel.”
• “Overall, DirX Audit is a very powerful solution that complements DirX Identity and DirX Access.”
• “DirX Audit, from our perspective, is a must-have add-on for customers using DirX Identity and/or DirX Access, by providing the required insight into the concrete access risks…”