Welcome to the KuppingerCole Analyst Chat. I'm your host. My name is Matthias Reinwarth. I'm the director of the Practice Identity and Access Management here at KuppingerCole Analysts. My guest today is Alejandro Leal. He is a Research Analyst with KuppingerCole Analysts and he is covering Identity and Access Management. Hi, Alejandro. Good to see you.
Hi Matthias, thank you for having me.
Great to have you. As a research analyst, you have been covering Access Management in the recent times. So you looked at that market. If we think about the overall picture of the identity fabric and where the individual capabilities are, is there really something going on in access management? Are things changing or is this something that we can just take for granted that it's working? How is the market evolving here?
Well, Access Management plays a crucial role in our increasingly interconnected digital society. It ensures that the right people have the appropriate access to the right resources when needed. And over the past few years, we know that COVID-19 and also the digital transformation of organizations have not only accelerated remote work, but have also heightened the awareness of cybersecurity concerns. Access Management once was confined to traditional web access management and identity federation solutions, But now it has become a multifaceted space. It encompasses authentication, authorization, single sign-on, identity federation, among other things. And all of these elements are crucial components of identity and access management with businesses and organizations incorporating their partners, their employees, their customers into their IT ecosystems. And as a result, Access management continues to gain prominence and at the same time as organizations continue to adopt cloud native on-prem and hybrid infrastructures. The need for a comprehensive and adaptable access management strategy is essential. We see that there is a clear trend to move access management solutions from on-prem delivery models to cloud delivery models. And even though some of these vendors are trying to facilitate and help their customers transition to a cloud delivery model, some organizations, they will still need to maintain on-prem presence. Sometimes that's because they continue to rely on legacy systems and sometimes because they have in-house developed custom systems, among other reasons. But because of this, I'd say that it's safe to assume that hybrid delivery models will be a viable option for the foreseeable future. This dynamic demands solutions to seamlessly bridge the gap between traditional on prem systems and the diverse array of cloud based applications, while accommodating emerging technologies such as decentralized identities, fraud detection capabilities, and passwordless authentication solutions. I'd say that identity and access management professionals, they are tasked with crafting and coming up with a strategy that not only safeguards their sensitive data, but it also empowers their users with a frictionless and context aware access. So in this market, what we see is we see both established players and small but innovative startups, and both actors are revolutionizing the access management space. What I see based on my latest research, is that we are witnessing simplified user journeys. We're also observing enhanced authentication methods and contact free onboarding processes. This latter point is important and that's a topic that I covered at the EIC last May with a session entitled Access Management Trends in a Connect Anywhere World. And something I talked about back then was the need for, contact free onboarding processes as we see this shift to remote work. As a person who happens to be in a different country, wants to access their bank app or they want to access some resources related to their work, then there are some challenges that arise because of this new trend. And something that I talked about back then was also the need for passwordless authentication solutions to facilitate this shift. And speaking of passwordless, something that we also observed in the latest research is that in the Access Management segment, passwordless authentication is becoming the new norm. We also see that decentralized identities are emerging as a very, uh, let's say, user friendly way to handle identities and also a secure way of doing that. We also see that policies are at the center stage, especially PBAC, policy based access controls, and we also see some aspects of IGA converging into the access management space, which is making this landscape even more rich and innovative.
Right. So that was quite a lot to chew on. So that really shows the full picture of access management as it is right now. And you said that identity professionals or identity and access professionals are tasked with creating architectures. We as advisors are as well. And of all of the above that you mentioned, these are the challenges that our customers are currently working at and looking for solutions. So these technologies, all of the above is now making its way into, yeah, available products that vendors really provide from a policy based access to passwordless, from adaptive authentication up until the integration of authentication and authorization. So you see that in the market as well, right?
That's correct. Yes. And I know maybe I said a lot it was a lot of things to digest, but that shows the richness of this market. And what I observe in the latest research, we published our Leadership Compass last week on Access Management. We had 28 vendors participating in the report. And what I observed was a lot of competition, a lot of vendors making interesting acquisitions to strengthen their, let's say, consumer identity side or maybe to strengthen their fraud detection capabilities. So we see a lot of movement. It's a very dynamic field. And in this report, we provide evaluation of all of these vendors, highlighting their strengths and room for improvement. So readers, they will gain a deeper understanding of this market segment. They will also be able to check out the vendors, their main features and some of the deployment options they offer. And hopefully our analysis of this market will help organizations align their access management strategy with their future requirements. However, we also noticed some challenges that still exist in this market. For example, many vendors are struggling to integrate diverse authenticators. Some of them struggle to leverage existing technologies, and some of them are also struggling to support hybrid scenarios. Many vendors, especially those who appeal to the highly regulated industries like government, defense and finance, they told me that they sometimes struggle to convince their customers to adopt certain solutions, such as passwordless authentication, for example, because they may lack the technical aspect of how the technology works. And sometimes they don't really see the benefits of adopting such technology. So I think organizations are also struggling to, let's say, convey the message and convince their customers that access management is a field that is constantly changing. And the only way to succeed is to adapt. And yeah, some of the things that we expect to see in the future is something that you mentioned. We expect to have finer grained policy based access controls and streamlined onboarding processes.
Right. And when I talk to customers, they always have the notion that with the advent of Microsoft Entra ID or Azure AD, as it has been called earlier, that problem is more or less solved. But having 28 vendors and in the Leadership Compass around Access management, that clearly tells a different story that so there's choice, there is alternatives and there are, as you've mentioned, hybrid infrastructures to create from these building blocks. And there's more than just Entra ID, right?
Absolutely. Yeah. I encourage people to check out the report. We have vendors that are small, but they specialize in certain areas. Some of them are stronger in, let's say, fraud detection than others. And many of these vendors are from different geographical regions. So that also appeals to, let's say, organizations that are maybe in Latin America or in the Asia-Pacific region. So we have multiple options, many vendors that provide similar but maybe unique capabilities. So it's important to know the field to make the best decision for your organization's needs and requirements.
Right. And we usually say that at that point. I think especially with that market, it's really important to say: just because a vendor is noted on the upper right corner of your diagrams, that does not mean that it's necessarily the right solution for each and every use case and for each and every end user organization. So it's really required to take that Leadership Compass to read it thoroughly, to understand the capabilities which are there and to map that to the requirements within organizations. Maybe a different vendor that is just in the middle field is much more appropriate. So this is the basis that you provide with the Leadership Compass that such decisions can be made upon, right?
Absolutely. And maybe the key takeaway for this podcast would be to become more familiar with the market and to see that it's not stagnant, it's constantly changing. And what I see is that many of the vendors know it. They're making the right acquisitions to evolve and adapt and provide their customers with a better user experience and better security at the same time. So, yes, you're right. I think this market is changing and I'm looking forward to see next year how different it's going to be like.
Right. So thank you very much, Alejandro, for sharing your insight. Your Leadership Compass is already out. It can be accessed at our website kuppingercole.com and everybody who's interested can get a test subscription or a full subscription, which is really affordable. So building your decision making processes on a proper, solid basis based on facts that you created and collected alone. I think that is the right way to move forward. So thanks again. Like all the times that we do these podcasts, if you have any questions, if you're watching this on YouTube, just leave your questions, your comments in the comments section here at YouTube. And if you watch this or listen to that somewhere else in some other podcast platform, just reach out to us. We are available and our email addresses are really simple to find and just ask us questions. If you are interested in other topics, let us know. We are happy to pick that up and cover that in some upcoming episodes. And if there are specific questions towards Alejandro, reach out to him or to me and maybe we will cover it in the later episode. Until that. Thank you very much, Alejandro, for being my guest today, and I will read that because it's part of my core business. Thank you very much.
Thank you, Matthias.
