Hello and welcome everybody. I'll start off by introducing myself. My name is Lisa Zimmermann. I work for Fressnapf, better known as Maxizoo, outside of Germany. We are Europe's biggest pet retailer.
And no, I didn't bring my dogs. Unfortunately, I'm still not allowed to do that here. I didn't bring any dog photos as well for this presentation. Sometimes I like to do this, but not today. And just as a short top off, why are we here today? So why are Thomas and I talking?
First off, which might seem a bit weird at the beginning, Fressnapf is actually not a customer of Omada. I've heard that a couple of people might think this. We are not. But why are we talking today?
Well, we know each other and in the situation that Fressnapf is in, and I will talk a bit more about this after the introduction, I came up with like three challenges that actually really run with me these days. I'm also the delegate speaker for the German SAP user group for the topic identity management. And some of the room might already know where this actually might lead and where these challenges might go. But more to that later. Yes.
Thank you, Lisa. So from my perspective as well, it was super interesting to now have the opportunity to talk together with you because you're now in this kind of a selection phase. And when we see organizations in this phase, we see many stakeholders with lots of, let's say, ideas about what they want to see in a product going forward in a solution for the enterprise. Lots of legacy where you have to discuss whether we want to take it or whether we see an opportunity in doing something new on purpose and getting away off of a heavy backpack and now think forward.
So you're in this situation at the moment, and as you have condensed things down to three essential elements that we're going through next, I thought that's exactly what is a good recommendation for lots of people in the room. So what to focus on in all the mists of opportunities to think about and people that come in with ideas and recommendations for doing next. Exactly. So let me explain a bit more where we are today and where we come from.
I think the topic transformation is something that comes up in my talks a lot, and they're normally for everyone in the room, even though I have something later. For everyone in this room, it's normally that we know that a transformation is coming, that we have technical things that will actually change, that IAM goes beyond workforce, that we're talking about agents, NHI, all those things, just-in-time provisioning, that modern authentication is becoming more and more important, pass keys and everything like that, more integration with ITSM tools, standards instead of customizations.
Those are just a couple of topics from the technical side that most of our IAM teams start thinking about and maybe looking at where are we today and how are we going to tackle this in the future. Then, of course, for a lot of us, also the regulatory side, especially with topics like NIST 2, a lot of more companies facing regulatory things that we have to talk about, that we have to be ready for.
Of course, some with DORA and stuff, like banks, already have this, but this is a big topic which drives our topics as well. And last but not least, security, something that lies very close to my heart and I like to talk about that a lot, because the sentence, IAM identity is the new perimeter, it seems kind of old, but honestly, it's not. I just leave it at there, because we really have to keep this in mind all the time.
And then there's something that, if I want to speak a bit about where Fresnov is coming from, that transformation has always been part of identity and access management, because companies aren't static, right? Companies are dynamic things. For Fresnov, that's very obvious, starting in the 1990s with the first store that our founder built up, and then building this empire throughout Europe, starting with franchise partners. It's a very, very important topic, if you talk about identity and access management.
Franchise partners are really, really interesting, that suddenly come up, and then an expansion beyond Germany and European countries, with Fresnov's own stores. And now, in the last years, more and more into omni-channels, with more online pickup from stores, a lot of logistics, there's so much stuff going on in identity and access management. It's in there, everywhere, and it's changing all along the way. And this is really what Fresnov is about, so happier pets and happier people, that's really what this company is about.
And I put this up here, because it's the basis for why does Fresnov look like this. Well, because this company is mainly built on stores. Online is great, and as a pet owner, I have two dogs, I shop a lot online, but I also like to go into stores, because there I have people, and that's our incentive as well, people that actually know things. They can't just tell you a price, but they can really tell you if you have a senior dog, or a certain breed, what are their needs, and that's what we stand for, that we educate those people to actually do this.
And if you look at around more than 2,000 markets, Europe-wide, that's identity and access management, completely, because all those users and all those countries in those markets, and I know there are other retailers here as well, and they know the same problems and challenges that we have as well. And I would say, just where you present it like that, it's similar with identity management, right? You don't just buy a tool and then it's living there.
It's about the integration, it's about understanding your situation as a company, making sure that you use right parts of the solution that propel you forward, instead of holding you back and opening unnecessary discussions, which is one of the very big causes of delay in many cases. So it's not about selling software, it's about ensuring that those companies can then be successful according to their needs, and their individual requirements.
Exactly, because identity and access management is never about itself, it's always about enabling the customer, it's always enabling the business and the users to really, well, use their IT as efficient and as secure as possible. Absolutely, thanks. And from there, we start into where do those challenges come from that I talked about in the beginning, and that Thomas has to answer for here, is that IAM transformation can also be started when your tool retires.
Also, for people who know me, a topic that I talk about a lot, because Professor, this drives us, and it is a very clear thing, because SAP IDM is end of life in 2027, with an extended maintenance until 2030, and this is pretty singular, because people do change their IAM, a vendor, from time to time, but let's say it's not a common thing to do, because we all know that's very tricky, and it takes a long time, and it takes resources, and honestly, if you got something there, you're happy, and you just normally stick with that, you don't really want to change it, but if you have to, like in our case, then certain things come up, things that trouble you all through, and not only Fresnov, but like I said, as the delegate speaker for the DSAG, we see those things with customers a lot, that there are a couple of problems that stick out, and that I wanted to discuss with Thomas, because I think the perspective from a vendor, not necessarily depending on what vendor, but really seeing this vendor perspective, because you build tools, right, you are in a lot of transformations involved, you see customers, and I was really just interested on getting those answers from your view, and understanding what your take is on that, what you see throughout your journey, because it's something that's important for us, but also something that I take out into the community, who are all facing these challenges these days, and I hope, of course, it's interesting for you as well, and those are the biggest challenges from my point of view at this moment, who heard, who listened to my talk yesterday about the assessment that we did of our IAM with Copenhagen Coal, and it was pretty clear that actually the IAM organization is a huge topic, underlying everywhere, that's something that we struggle with a lot, because we are not only just an IAM team, our topic is everywhere in the company, but well, we don't really get everyone to acknowledge that, and then there's something, it's not because I wanted to have AI in here, but I wanted to tackle this topic from another side, because I'm in the middle of the transformation, I'm trying to sell to my management that I need to spend a lot of money and a lot of time to do something, and the biggest question that I don't want to get, I want to answer it before, is I don't want my management to tell me, it's really expensive, a couple of millions, two to three years, but honestly, we have AI, can't you just at least cut it in half or something?
How can AI really help? Expectation management is so important, and I want to tackle this before I'm there saying, yeah, maybe some things, but yeah, I don't know, it's more complex than that, and that's always the answer I have, IAM is more complex than everyone thinks, I need something better than that. And the second thing is, I then need to make my management aware beforehand what we are running into if we're talking about AI.
This is everywhere, and I want to make this clear, that we have an opportunity, that we need the transformation, and that if we do it right, it will really help to get this topic right as well. And from there, I give it to you.
Yeah, the beautiful thing is that those were super easy questions that I can answer with just a sentence, and it's valid for everybody in the room, but of course it's not. But I try to get some general advice or some general positioning that I think is key for identity management and many vendors in parallel, and organizations on the other side as well.
So, I think that we should acknowledge that invisibility as an IAM team is not a superpower. Identity management is not seen. We're doing a lot, we're struggling a lot, we're taking lots of fights, but we're not talking to our stakeholders, people that decide on budgets, on money, on the stability of the project, on the next step. They don't see us as part of the transformation that the organization is going through.
And in the worst case, we're really the component that says, oh no, you can't change that fast because the idea is so slow, and identity management is just expensive and hard to maintain, and we don't know what you're doing, and why is everything just a big thing, and we need to go out of this corner. So, invisibility should not be seen as a superpower. Don't go down that trap. And what we've seen is that many C-levels are looking at the wrong indicators, KPIs, or even ignoring anything about identity management.
So, they don't see what we're doing, so they're not able to understand what journey we're on, and what's the benefit of us doing our job. And of course, we can go very, very deep and very elaborate on that, but I've reduced everything to one slide, right?
So, we could look at orphaned accounts and see that there is a risk for enterprise if we have too many of them. Where are we? Where do we want to be? What is our target? What do we need to do to achieve that? Which systems are we onboarding and that are causing this uptick in orphaned accounts because now we're managing more? Discuss that. What does identity management bring to the security posture? You can do the same with efficiency. You can do the same with governance and many other aspects.
They're highly relevant for your management, but they are not able to discuss it with you because we don't have the metrics. We don't show the numbers. We don't take the dialogues. We don't talk to the right people. And that's actually really, really important.
Honestly, I hate talking about KPIs when it comes to IAM because it's always, sorry, a pain in the ass depending on where you stand, how to do this, how to find something that makes sense and in the end doesn't like reduce the whole problem to something that, sorry, doesn't really reflect anything. But it doesn't help. I have the same challenge and we need to do it. We need to find better ways to talk in this language because otherwise we will always be left with, Lisa, make things easier.
Lisa, try to fit things into better numbers. This is not enough. Where do we start? It can't just everything be complex. You have to find some way. So we need it and that's where we really need the help of everyone who sees more of those challenges to give us an idea for each other company what could make sense, especially if you're in the transformation phase, if you don't have all the numbers, if you don't see everything, how to start with that.
So, yes. And at the same time, it's not something where I say, oh, we have a cool feature for that, right, or just buy this extra license and you get the management talk show. I don't know. But everybody has to chip in, right? So they need the product that has that on their list, right? They need to develop the product that makes you capable of having this dialogue.
You need an integrator that is trustworthy, that doesn't say cool, somebody is willing to pay 50,000 euro for a cool feature and it's distracting them, but giving them some good advice that brings you forward and supports your dialogue in the organization. So it's not a tool thing, but heavily supported by your thought process on how you position yourself and then, of course, tool selection is in some form relevant because you go in with a mindset of how good identity management works. So put that on your radar. Then I come to your second question that was about, can AI support?
And the thing is that we're now on a very interesting point. We're talking about AI for three years here at Kupinger Coal, the Ike, but now things really start to matter. And we see that something new is happening and is going to cause additional effort. So we can continue in the way that we've done things for 10 years or 15 years or whatever, but this is rather going to lead into chaos. So we have no good data, no good processes, no real ownership. People don't know, they're just frustrated with more and more tasks that they have to do, emails flying from here to there.
Identity management is just a burden. So now is the opportunity where we know that everything around AI is coming and I'm sure somebody has talked about AI this Ike already. But the idea now is make sure that you sharpen your processes, make sure that your organization is ready, especially your IM team, to take care of these additional challenges that are going to hit you. And you can't continue in the way as we did in the past and then have additional stuff. You don't get additional budget, you don't get additional people, you don't get additional time in your calendar.
So streamline, use AI to ensure that you're ready for the next step. And now is the time, Martin Kupinger said in his keynote in the beginning, if we don't fix things now, we're going to see the impact in the next years because something big is going to hit. But what does it mean beyond this just picture?
And again, this is not one thing, but I think that AI produced tons of different ways of solving things, making things easier. And that can be role mining, it can be policy mining, where you have roles that are automatically assigned to your people. It may be as well something like boring, like description text, which is super, super valuable because you have 100 access rights and nobody knows what's the active directory group of the printer in the fourth floor. And what is this good about? And have you seen these SAP entitlements?
They're super hard to understand for outsiders, but people are in recertifications and have to take decisions. And same goes for recertification or for risk scoring or changing the way you interact with identity management by using chat assistants that say, hey, you have an approval task. Do you want to approve it now? You do that and you increase the speed of approval by the factor 100 or more. And this is just a subset, right? So more and more AI capabilities are coming in, supporting your organization.
And the ability that is increasing there is you're much better now in adapting more things. So don't sit on the basics of identity management and identity governance, but go deep, do more, do the things that are very crucial for your enterprise, and support people by taking better decisions. If you have to decide for in a recertification what is the appropriate access for this and that person and have to take 100 decisions for one individual, and then somebody says, like, the factor identity or non-human identity to human identity is 1 to 100, nobody will look at what is approving.
So we need to support people. There needs to be a better way and AI can slim down the things that are painful for your organization. And that allows you to share the workload in the large organization. More ownership, more knowledge about what people are actually related to, what ownership means, allows them to take more accountability for things. And that allows your IAM team to care for other things than just always the basics. Nobody can take the decision. Whenever it gets hard, the IAM team needs to fix it.
And they're super stretched and now the AI, agentic AI, non-human identities are kicking in. Nobody can cope with that. So manage this team relief, and as well, when it goes to supporting your solution, take AI support. Why is the import failing? What can we do? Do you have eventually predictive support abilities that allow your system to run smoothly over time instead of supporting can't do it? Identity management is a special snowflake. We go to the identity management core team. We don't want you to keep in this loop.
So you look at solutions that support you with many small items that have a massive impact and allow your team the headspace for transforming. And that's what I was talking about with expectation management, because it's not like, why don't you just upload the architecture to ChetGBT and see if afterwards it just runs your whole IAM, like in a basic nutshell. Just to make sure that this gap between this possible thinking and what makes sense at this moment that we should start to use is really managed in a good way. Yes.
Okay, thanks. So now's the time where I talk about AI, but I really, really want to keep it short because there are so many sessions about that. But it's going to hit us, of course, right? So there's the managers see or directors, leadership sees that there's up to 100 times as many non-human identities as human identities, while your employees see the factor two to five somewhere in effort. So there is a big gap in realization and of course in how to execute things. And this is going to be a problem, right? There's lack of ownership, lack of understanding what is going to hit.
And now we're getting into a situation where we need to start to govern and control. Although I would actually say if management sees so much more, they would actually should come to us and say, we get so many agents, you have to manage them. But I think there's so much business opportunity that is necessary, that they are also artificial identities and the same as humans. Security doesn't come naturally always to everybody, but yeah.
So what you need to look at is make sure that you have ownership, make sure that you are able to analyze things, that you have the input from many, many signals out of the organizations that is allowing you to not guess the risk, but get the risk right. Look at the behavioral drift. So if there's something going out of normal, out of the expected, is that a good or bad sign? How should we tackle that? And those are things that are evolving over time.
So no vendor is going, maybe some are going to tell you that they have found the golden bullet and everything is good, but we have a dynamic scenario and lots of different use cases are coming along as we're speaking every month, something new and cool. So we need to catch up and stay close to how reality works. And that's going to be a challenge for all the identity management vendors across the next month and years. But what we always see is you say like management should know, but management always says like, we have AI, it's so cool, it's going to change the world and we are part of it.
Let's invest in that. And it's mainly like looking at the sky and saying, wow, there's an airplane. I want to fly as well. And that's where we came up with the idea of like every journey or every flight starts on the ground. And that's where we are and that's our responsibility now to shape and to direct the organization and get somewhere. I really like this picture because it summons up what we should go, you know, I'm being afraid that people want to pop champagne in the first class in an airplane that's not fully built and where you don't really have the airport where it can take off.
So it's probably going to stand on like a, I don't know, 30 meter runway or something, not taking off. But it's like, yeah, we were using AI or something. We're doing all those things and you're forgetting everything that's below that. And that's a message that for me is always so important and that's why I like this picture truly. And Martin Coping, I used it in his keynote as well. You referenced it, if we didn't get the basics right until now, we need to do it. We need to build those airports and we need to build them right. We need to build runways that make sense.
And then we can start or in parallel start building airplanes. But please, before they are set on the runway and take off, make sure they're finished. And then afterwards, yeah, pop your champagne in the first class. Great thing. But get this right and not starting at the top and really getting the people who need to make those decisions to acknowledge that, that we start here. And that's the invisibility part from the beginning, which is so important.
And yeah, so I'm going to take this with me on the slide before, because that's something I can use very, very well. And yeah, well, thank you very much, Thomas, because that was a very fruitful discussion. We are at the time of that and maybe you have time for one or two questions.
Well, thank you very much. It was really thought provoking, I would say. Probably the fourth point I would add to this slide. Also make sure that your airport sticks to the schedule all the time. Thank you very much. Where we are today, yeah, that totally makes sense.
Well, thank you very much. I'm pretty sure that people will have tons of questions, could have burning in their heads, slowly brewing. So they should probably reach out to you later and ask those questions. But for the interest of scheduling, again, let's give you guys a round of applause and continue to our next presentation. Thank you very much. Thank you.
Thanks, everybody.
