Analyst Chat #172: Trends and Predictions for 2023 - The Business Case for Decentralized Identity

Welcome to the KuppingerCole Analyst Chat. I'm your host. My name is Matthias Reinwarth, I'm the director of the Practice Identity and Access Management here at KuppingerCole Analysts. This is another episode of our sub series of trends and predictions running up to EIC, our conference in Berlin. Today, my guest is Martin Kuppinger. He is the principal analyst and one of the founders of KuppingerCole Analysts. Hi, Martin. Good to see you.

Hi, Matthias, pleasure to be with you again here in this podcast.

Great to have you.

I don't know, how many did we together? Ten at least. More.

More, I would assume.

Yeah, 15 to 20 at least.

At least, at least . We should add that. But we are quickly approaching EIC and this topic and this episode will also be interesting after EIC, we are looking at a topic that is really a trend and it is not really difficult to make this prediction that this will be an important topic for the next years. We want to talk about decentralized identities and especially in the area of business usage of decentralized identity. Why is this a trend and why is this important, Martin?

Yeah. So I think decentralized identities is one of these things that are around for long, but still in a very emerging state, so to speak. So people, a lot of people I know feel that there's something big coming up, but they don't know exactly what it is and what to do with it. And I think it's very important to understand the business case because everything you do new depends on a business case and winning case, which is really compelling. And I think we need to talk right now more about what is this business case. By the way, I think this podcast will go online early next week and there should be still on my LinkedIn account a poll running about where do you see the biggest potential for decentralized identity. So everyone who listens to this podcast is invited to vote here. I'm curious what the results are. And basically I think, when you go back to the history of decentralized identity, all it started was a very heavy privacy perspective. So around how can I give control back to the user? But there's more in that than privacy, I believe. Most people I know today are looking at this more from a reusable identity for individuals that are accessing different services from different companies, so more a customer, consumer use case. What I believe is that there is also a huge potential within the enterprise, that might be even the one that is easiest to leverage.

Right. And I think when it comes to onboarding processes, trusting users within your organization, then really a decentralized identity can play an important role when properly done. Because you're moving, you're moving trust to a different party, to a different issuing party that says, Yes, this is Matthias. He has not gone through the HR department, he has not been there, has not shown his passport to the ladies and people at the HR department. But we trust another service provider of decentralized identities, of verifiable credentials, and this needs to be done properly. So what would be the business case and the processes behind that to make sure that this really works?

I think you already started talking about a business case. There is someone going to an office where someone looks at some documents, etc. Two problems here. The one is we are living in a world of remote work, work from anywhere. So when I go back a couple of years and I did some advisory work at KuppingerCole Analysts. We usually traveled to the customer, did workshops at the customer site, traveled back. Nowadays we have even very large engagements where the customer says, So we don't expect you to be here, ever. You will usually always work remotely. Sometimes, it’s even difficult to convince a customer, to say, Hey let’s do a on-site workshop first in the beginning, so that we really get to know each other better before we move to remote work. So this has changed and this is the one change. And the other point you've raised is, there is someone sitting, people need to go over there. They, I have experienced this a couple of times, they sometimes need to queue for quite a while. So you have people that are involved in a lengthy and costly process and we are talking here about process costs and this is an incredible amount of cost for both workforce and business partners, contractors, other types of business partners. And so what we are talking about is a potential for cost savings.

Absolutely. And I think increasing the efficiency of that process is really an important factor to look at and also enabling use cases that would otherwise not be possible. Onboarding people to the organization where there even is no office work. That could be an onboarding process, that also can be enabled, and post-COVID, we know what we're talking about, right?

Yeah. So, so it's sort of a latter part. So we are working in a world of work from anywhere, and there, it's also about risk mitigation. If you do that process right, if you have strong proofs based on national eID cards, based on proven issuers, etc., a lot of background information that is rather difficult to forge. So Microsoft just announced that integration of LinkedIn to their Entra Verified ID. So bringing information in from sources that are building on years of sort of tracking a user or following a user, years of content someone has produced, that is also something which helps mitigating risk and so that is definitely one part. We can do things better and mitigate risk. But the other thing is I wouldn't talk about even process efficiency. It's about process, business process re-engineering, the good old term here, because we can create better processes. And, you know, when you're in IT and you learn about how do I convince the business regarding spending money, then what is the most compelling argument? It's process cost reduction, doing processes better because this is something you can measure. If you don't need that many people, if you don't have contractors queuing during the paid time there are here, if you make employees productive, way faster, etc., etc. then this is about cost. This is a business case. And this is a business case which is about a lot of money when you look at larger organizations. So this is one of the potentials. And when I look at many of the organizations we are working with that have a huge turnover, a huge change amongst, for instance, their externals. Just take, for instance, a simple but relevant to everyone case, people who do physical security at the site of a company, the offices, the factories, etc. Most of them are contractors and the people who are sitting there in their uniforms usually are not there forever. So there's a lot of change amongst these people. And most organizations don't handle it well. They just more or less trust the contractor for security to bring in people that they can trust. You could add way more trust, way more ability to track who is actually there based on decentralized identity. So you can do processes better, more securely and way more efficient and that saves money and increases security. So I believe around all this onboarding, there is an incredible business case for enterprises. So I see a huge value of decentralized identity for enterprise. And by the way, beyond that, if you then couple this with authentication, with authorization, etc., we have even more potential.

Absolutely. So we have already, or only been talking about the onboarding process, but the complete lifecycle also can benefit from decentralized identities. Once somebody is off-boarded at the trusted partner who initially confirmed that this is Matthias and he works for this and that company and that he can be securely and safely onboarded, They also know when he leaves, that he should be off-boarded within the consuming organization and that also increases security and really makes sure that the termination of accounts, of access really is done properly.

Yeah, I think there's really a big potential and what also I think is very important, and I think this is one of the concerns a lot of organizations have, the understanding that decentralized identity is a totally different way of doing identity management. No, it is something that can be added to it. It is a different way. It's an additional way for onboarding. It's an additional way for receiving context data that can be used for syndication decisions. But if we do it right, it's not disruptive. It's adding to what we’re doing in identity management and so that is the way I think we should look at decentralized identity for the enterprise use cases. Not saying that the other use cases are relevant, but for these use cases, I think this is a, there's way more potential than a lot of people currently see.

Absolutely. We will cover that topic at EIC in Berlin. And for those who watch that early enough, please register for this event. There's still time to do so. And even if you're watching this episode, after May 9th and the week of May 9th, you can still register for this event and rewatch the interesting parts. And I think the tracks that we do on decentralized identity will be one of the most interesting, although everything's interesting anyways, at our events. So you can rewatch that and you can have a follow up on this topic with the recordings and our speakers that we have there. If you are early enough, head over to Martin's poll at LinkedIn I assume, so that you can leave your input there as well and influence also our next trends and predictions, maybe. So looking forward to meeting you, Martin in Berlin in two weeks time as of the recording of this episode. And for those who are interested, please head over to EIC 2023, either virtually or in person, and join us and join the discussion around that. Any final words regarding EIC, Martin?

No, just looking forward to meet many, many, many people there. It will be the biggest EIC ever. It will be a super, super interesting event and don't miss to attend EIC. Ideally on site in Berlin and meet with the KuppingerCole team and all your peers.

Absolutely. So it will be the identity class reunion as always. And it will be lots of interesting talks to hear and lots of interesting panels. So thank you very much, Martin, for joining me today for talking about business use cases of decentralized identity and looking forward to having you soon again for yet another episode. Thank you.

Thank you.