KuppingerCole Analysts

The future of Identity and Access Management (IAM) is already being built — but are we preparing for 2040?

In this episode, Matthias Reinwarth and Martin Kuppinger explore how organizations can design future-ready identity fabrics, avoid tool sprawl, and build the platformized IAM architectures needed to thrive in a fast-changing digital landscape.

Key Topics Covered:

βœ… What the “Identity Fabric 2040” means for IAM strategies 🧠
βœ… The rise of orchestration, signals & API-first design
βœ… Avoiding IAM tool sprawl and capability duplication
βœ… Platformization vs. best-of-breed: what really works?
βœ… Why outcome-driven IAM is the only sustainable approach
βœ… How signals redefine authentication, authorization & user experience

πŸ’‘ Your IAM decisions today shape the next 15 years. Are you building for 2040—or already falling behind?

In this special Halloween edition of the KuppingerCole Analyst Chat, Matthias Reinwarth is joined by Jonathan Care, Lead Analyst at KuppingerCole Analysts, to explore one of the most talked-about cybersecurity stories of the year — the F5 supply chain incident.

The discussion highlights how even well-established organizations can become targets of sophisticated, long-term attacks — and what this means for the future of software supply chain security.

Together, Matthias and Jonathan examine how incidents like this can happen, what lessons can be learned across the industry, and how companies can strengthen resilience, transparency, and response capabilities in their own environments.

Key topics covered:

βœ… Understanding the dynamics of modern supply chain attacks ⚠️
βœ… Why detection and dwell time remain a major industry challenge
βœ… The growing importance of vendor risk and software transparency
βœ… Lessons learned for CISOs and IT leaders
βœ… Practical measures to improve visibility and response
βœ… Why collaboration and information sharing are key to resilience

πŸ•ΈοΈ Even trusted systems can hide a few ghosts — are you ready to uncover yours?

Unlock invaluable insights into cyber resilience by exploring real-world examples of organizations rebounding from cyber incidents. Gain strategies to safeguard operations, enhance data resilience, and leverage clean rooms and cloud solutions for recovery. Learn how to transform cyber threats into opportunities for improvement and fortify your organization's digital landscape with adaptive resilience strategies.

Read the original blog post here: https://www.kuppingercole.com/blog/small/cyber-resilience

Is your IAM strategy focused too much on tools? In this episode of the KuppingerCole Analyst Chat, Matthias Reinwarth and Patrick Teichmann, Lead Advisor at KuppingerCole, dive into one of the most common pitfalls organizations face: starting IAM projects with the wrong priorities.

They explore how a Target Operating Model (TOM) helps define why and how your IAM should work before deciding on technology. Patrick shares insights from real projects, explaining how to align business goals, processes, and governance to achieve long-term success.

Key Topics Covered:

βœ… Why IAM projects often fail due to tool-first thinking
βœ… How a Target Operating Model sets the foundation for IAM success
βœ… The role of governance, people, and processes in effective IAM
βœ… Real-world examples of aligning strategy and technology
βœ… How to evaluate tools after defining your IAM capabilities

Are AI agents the future of cybersecurity or a threat to human expertise? In this episode of the KuppingerCole Analyst Chat, Matthias Reinwarth talks with Alexei Balaganski, Lead Analyst and CTO at KuppingerCole, about the rise of AI agents and their potential to reshape the cybersecurity landscape.

They explore how autonomous AI systems could fill the cyber skills gap, automate incident response, and even act as digital coworkers in SOC environments. But how far can we trust them—and will humans still have a place in the loop?

Key topics covered:

βœ… What AI agents really are—and how they differ from traditional automation
βœ… The role of AI in SOCs, incident response, and threat detection
βœ… Can AI agents help close the cybersecurity skills gap?
βœ… Risks of rogue or “hallucinating” AI systems
βœ… Why access governance and identity management are critical for AI agents
βœ… The future of cybersecurity jobs in the age of automation

Are we already living in a post-data privacy world?

Breaches are everywhere, data is constantly being leaked, and GDPR fines haven’t stopped surveillance capitalism or shady data brokers. In this episode of the Analyst Chat, Matthias Reinwarth is joined by Mike Small and Jonathan Care to explore whether privacy still has meaning — or if resilience and risk management are the only ways forward.

They debate:

βœ… Is privacy truly dead, or just evolving?
βœ…Why regulations like GDPR often miss the mark βš–οΈ
βœ…How cyber resilience is becoming more critical than “traditional” privacy
βœ…The personal, societal, and legal dimensions of privacy
βœ…What organizations (and individuals) can still do to protect data

Ghost tapping is shaking up the payment security landscape, turning stolen card data into quick profit through NFC relay fraud. This emerging threat exploits digital vulnerabilities, making unauthorized taps at retail points seamless and undetected. Businesses and regulators must urgently rethink their defenses against this global attack vector that crosses digital and physical boundaries.

Read the original blog post here: https://www.kuppingercole.com/blog/ashford/ghost-tapping-a-new-front-in-identity-security-risk

Are KPIs and KRIs just compliance checkboxes, or can they truly prove the value of Identity and Access Management (IAM)? In this episode, Matthias Reinwarth and senior advisor Shikha Porwal explore how Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) can transform IAM from a technical function into a business enabler. They unpack the differences, the overlap, and how to make metrics relevant to both security and strategy. Expect real-world examples—from onboarding to MFA adoption—that show how measurement drives maturity and risk reduction.

Key Topics Covered:

βœ… KPIs vs KRIs in IAM: what they are and how they differ
βœ… Aligning IAM metrics with business goals and governance
βœ… Onboarding & offboarding metrics for efficiency and risk reduction
βœ… MFA adoption and help desk tickets as signals of IAM maturity
βœ… Developer enablement and API adoption as success factors
βœ… Mapping IAM indicators to risk frameworks and security posture
βœ… Adapting KPIs/KRIs for non-human identities (NHI)

πŸ’‘ If you’re working in IAM, identity governance, MFA strategy, or security architecture, this discussion will help you build meaningful metrics that prove value and strengthen your identity program.

Are IVIPs truly a new platform that organizations must adopt, or are they just old capabilities rebranded with fresh marketing spin? Today, Matthias Reinwarth and Martin Kuppinger dig into the latest acronym shaking up the IAM world: IVIP (Identity Visibility & Intelligence Platforms). We unpack the promises, the risks, and what IVIP really means for the Identity Fabric concept. Expect a critical take on buzzwords, vendor strategies, and what enterprises actually need to strengthen IAM maturity.

Key Topics Covered:

βœ… What IVIP actually is and how it fits into IAM
βœ… The connection between IVIP and the Identity Fabric approach
βœ… Risks of marketing buzzwords in identity management
βœ… When a new platform really brings value—and when it doesn’t
βœ… What organizations should focus on instead of chasing hype

πŸ’‘ If you’re working in identity, access governance, ITDR, IGA, or security architecture, this conversation will help you decide whether IVIP deserves a place in your roadmap—or if it’s just hype.

Identity and Access Management (IAM) is no longer a one-off project—it’s an ongoing journey. In this episode of the KuppingerCole Analyst Chat, Matthias Reinwarth is joined by Christopher (CISO & Lead Advisor) and Deniz Algin (Advisor) to explore how organizations can successfully apply the Identity Fabric concept.

How to evolve from legacy systems to a future-proof IAM strategy without breaking existing operations? Why interoperability matters? What are the most common pitfalls organizations face when trying to modernize IAM? Find the answer to these questions and more in this episode!

Key Topics Covered:

• Identity Fabric explained through a powerful “airport” analogy ✈️
• How to design IAM programs in brownfield environments (no rip & replace)
• Capability-driven approach vs. tool-driven decisions
• Risk-based prioritization: quick wins, big wins & roadmaps
• Common pitfalls to avoid when modernizing IAM

πŸ’‘ Whether you’re just starting your IAM journey or looking to operationalize interoperability at scale, this episode is packed with practical strategies and lessons learned.