Hello, everyone. Good evening. So before I start my presentation, I would like to ask a very simple question to you. When was the last time that you tried to convince your management of a very, very simple idea? And how was the response in the end? I have one response for you that I encountered a couple times in my career so far. And this is a very, very frustrating response for several reasons. But it's not the end of the discussion. That is actually the beginning of the discussion. Or you have missed something earlier.
So let's talk about what can you do to get your management buy-in and what you need to be aware of. So first thing, of course, is you need to know why IAM is important. You need to know what the motivation for IAM is. And that's what you can then use to convince your management. So start with the first question. Why is IAM important?
Well, we could talk hours about that, I'm sure. And we have enough experts in the room that can add content to that. But let me bring it down to a very simple statement. IAM is a foundation for everyone's daily business. Everyone of us is using IAM every couple of minutes. This is why IAM is important. As an individual, I should be aware of my access every time I use it. And as an organization, I should be aware of my people's access. And the access to my secrets, the access to my applications, the access to my buildings. Every kind of access. I should be aware. That is our task as IAM experts.
So what is then the overall driver for IAM? In my career, I came across three main drivers for IAM. Efficiency and value. That basically means every kind of improvements in speed and time to market. In usability or maybe even cost reductions. The second one is risk and security. So that means mitigating controls. Better resilience. Everything that improves your overall security. And the last one is compliance. And compliance is all about regulations and meeting the requirements that your organization has.
So we have taken these three drivers and asked in our webinars and on our events a couple of surveys. I have five in total for you. And these are the first three. So the question was, what are the primary factors impacting your organization's IAM budget? So basically, what is the major driver for that? And you can map the first three answer options exactly to the drivers. What you can see that is survey one and survey three are more focused on the operational efficiency. While the second survey is more on the risk side. The compliance answer is pretty stable across all of the surveys.
And this is the same for the fourth and the fifth survey. We have again one of the surveys that is focusing more on the risk side. And one that is more focused on efficiency. So what is our takeaway from that?
Obviously, it highly depends on whom you ask what the primary driver is. And the context behind that. So let's think about the context. When we think about the three drivers, they can either be intrinsic or extrinsic. When we think about the extrinsic drivers, then we very quickly think about compliance. External auditors that have findings that we need to resolve. Very easy example for an extrinsic driver. On the other hand, we have efficiency that is more of an intrinsic driver. So I want to improve, I want to become faster, I want to become more cost efficient.
And when I do that for myself and not against the competition, then this is clearly an intrinsic motivation. So how about risk, the third driver? Is that intrinsic? Is that extrinsic? I would say that highly depends on how you see it. When I try to secure my secrets, that's clearly an intrinsic motivation. On the other hand, when I think about the bad guys that are attacking my organization all the time, that is most likely an extrinsic motivation.
When we now take the surveys and the motivation, so the intrinsic and extrinsic part, together and think about what that means for us, you could basically think about the industries and what the main drivers for the industries are. From my experience, I have listed some industries on the left side and put them in the diagram on the right side. That basically displays the main drivers and how I would map these organizations to the different main drivers. And as you can see, I have two examples for you here that are more or less the extremes for the drivers.
The first one is a retail company that is most likely more focused on the efficiency side than it is on the risk and compliance side. For a retail company, they focus on business success, the time to market, the speed, the business enablement. And when you think about your projects or your initiatives that you try to sell to your managers, this often becomes a sales pitch or even a crowdfunding. So when you think of big governance projects, you need to convince your business of your idea. You need somebody to fund your idea.
And if you don't have enough business support, your project is simply not launched. This is why efficiency-driven organizations often tend to have this crowdfunding. If you don't convince the business, you don't get the budget. If you don't get the budget, there won't be a project. Very easy. On the other hand here, when you take a closer look at the compliance side, you have the financial institutions. So they act based on external pressure. External regulatory pressure. Sorry. So they act on audit findings.
So if they have an audit finding, they will find the money to remove that audit finding. But how often did we hear, we just need to remove that audit finding? We won't do more than that. I've heard that sentence often enough. So that shows that the major motivation behind the compliance part often is to reduce the regulatory pressure and to not be the next headline in the newspapers. Good. Then what does that mean for us? So when we think about what I just told, that some are influenced by efficiency, some are influenced by compliance, some are influenced by risk.
That does not mean the individual, but the whole organization. So that means that sponsors of whatever level within the organization are influenced by the main driver of that industry.
Again, take the retail example. The managers are influenced by efficiency. Every level. The executive, the middle management, even the operational experts. Same for financial institutions. Take a bank. The executives are focused on compliance. The middle management is focused on compliance. Operational experts are. Question is, is that the right perspective? To focus on just one of the three drivers? I personally don't think so. Why? Because extremes are never healthy. Let me make an example. Take passwords.
Even though we are living in a passwordless world and nobody of us is ever using any kind of password. This is a very good example here to show how extremes are not healthy. When we think about an efficient password, what could that look like? It is short and it's easy to remember, right? That is an efficient password. But is that secure? Is that compliant? I don't think so. This is where you focus on just one of the drivers and deprioritize the others. To some point that might be possible, but definitely not often.
Second, most real-world cases are reactive. When we think about initiatives, they are often started after something happened. Either there is an attack, an audit finding, or whatever else you can come up with. We are thinking in a reactive model. This is a paradigm that needs to change. In security, you cannot be reactive. If you are reactive, the bad guys are stealing your information.
Third, and most important for my presentation here, IAM is a diverse topic and offers more than just one dimension. Be aware that IAM has three drivers.
Not one, not two. It has three drivers. If you focus just on one, you miss two other drivers. That means you miss a lot of benefits and you miss a lot of opportunities at the same time. This is what you want to have in mind when you start your communication with your executives and your sponsors. What does that mean? That means that the perspective that we have on our topics is critical for how I engage my sponsors. You have basically two options to talk to your sponsors. The first one is speak their language. Imagine you have a sponsor that is very focused on just one of the dimensions.
What would you do? You would try to support his vision. You want to give him something that he can identify with. You give him the advantages of exactly that main driver. This is most likely the strategy that is successful if you want to have an initiative on a project that is supported by this sponsor.
Of course, that is a risk because, I just mentioned it, if you focus on just one of the drivers, you miss out two others. And this is also a project or initiative risk. On the other hand, the second option here on the slide is raise their awareness. When you have a sponsor that is more open to both other directions, meaning that he is not just focused on one of the drivers, but is most likely also listening to other dimensions, then you can explain these dimensions to him or her. In other words, I could also say raise their awareness. I could also say educate them.
Let them know that there are other drivers as well that you can use, that have advantages, that he can sell to the organization. And this is the way you find a balanced approach when you engage your sponsor. So these are more or less black and white approaches, and I'm aware of that. So in reality, you will most likely encounter your management or your sponsor with both options at the same time. And you will try to figure out what kind of manager or what kind of sponsor your sponsor is.
Is that sponsor listening more to and focusing more on one driver, or is the sponsor open to the others as well? This is what you need to figure out before you get the support. What is also important? So IAM is an important topic. We will discuss IAM often. You will have a lot of initiatives, you will have a lot of projects, and you need a sponsor that understands how important IAM is. So I have this quote for you. IAM must finally be understood as a strategic backbone of digitalization. It is really important that management understands what IAM really is. It is a very critical infrastructure.
Without being an infrastructure topic, it is a security topic. And organizations often underestimate the value that IAM has for the organization. It is your job to highlight that. Show the value, show the benefits of IAM, and make sure your sponsor understands them. So what are the key takeaways of my presentation? The key to success and to successful communication with your sponsor is to know your sponsor. What we have learned is that there are three drivers, and you need to be aware of these drivers. You need to understand what your organization is motivated by.
And how this main driver for your organization, for your industry, is shaping the executives and the managers that you are talking to. And if you have understood that, you can approach them with the two different approaches, either speak their language or raise their awareness. And you need to figure out what kind of individual that sponsor is to position your interests, your initiatives, and make that happen. And I hope I was able to enrich your communication skills to make your next initiative a success. Thank you. Brilliant presentation, Philip. Really good.
You made some excellent points, and so much so that we haven't got any questions yet. But just make sure you guys are awake out there. You do know you can ask questions. Please try and make this as interactive as possible. But one of the things that I like that you said very much is the importance of executive buy-in. We know how important that is. And you said it was really important for them to understand IAM. But the question I have for you is, in your experience, what are the common blind spots in that executive understanding of IAM that hinder investment? Yeah.
So, when you think about the three main drivers, most of the executives focus on exactly one of the three drivers. So, either it is compliance or efficiency or maybe risk. That highly depends on the position that manager or that sponsor has in the organization. Even though the organization as a whole is driven by one of the main drivers, most of the sponsors have the other two drivers as blind spots, more or less.
As said, this is not black and white. It's colorful. It's gray. And the focus on just one of the drivers means that the other two are more or less their blind spots. Okay. Great. Thanks. Dr. Philipp Neschenschmidt.
