KuppingerCole Analysts

DDoS attacks are evolving and becoming more dangerous than ever. In this video, Osman Celik speaks with Andrey Leskin from QRator Labs about the current DDoS attack landscape and how organizations can defend themselves.

You’ll learn:

• What DDoS attacks are and how they work across layers 3, 4, and 7
• Why Layer 7 (application-layer) attacks are the fastest-growing and hardest to detect
• How attackers are building massive botnets (millions of compromised devices)
• Real-world DDoS incidents hitting FinTech, e-commerce, and media sectors
• The differences between scrubbing capacity and PoP proximity in mitigation
• How QRator Labs approaches DDoS protection with scrubbing, anti-bot, and WAF solutions

With Layer 7 attacks rising by 74% year-over-year and record-breaking volumetric attacks now lasting weeks, no industry can afford to ignore this threat.

Watch now to understand how to protect your business from DDoS, botnets, and evolving cyber threats.

In this episode of the KuppingerCole Analyst Chat, Matthias Reinwarth is joined by Martin Kuppinger and special guest Felix Gaehtgens to explore two of the hottest (and most debated) topics in identity today: Identity Threat Detection & Response (ITDR) and Non-Human / Machine Identities (NHI).

Together, they gothrough the buzzwords to reveal what’s real, what’s hype, and how organizations should approach these fast-evolving areas of IAM. From visibility vs. observability, to governance challenges and the future of machine identity management, this episode delivers sharp insights and practical recommendations from three IAM veterans.

So tell us — are ITDR and NHI just marketing buzzwords, or essential must-haves for modern identity security?

Key topics covered:

• ITDR explained: buzzword or meaningful evolution in IAM?
• Why visibility and observability are not the same
• The missing “R” in detection & response
• IAM vs. SOC responsibilities for ITDR
• Machine identities: terminology, challenges, and governance
• Ephemeral vs. static machine identities
• How IAM teams can prepare for the future of identity security

In this episode of the KuppingerCole Analyst Chat, Matthias is joined by Charlene Spasic and Kai Boschert to break down what real IAM maturity means. They explain why structured frameworks like the KuppingerCole Identity Fabric and Reference Architecture are critical, and how organizations can move beyond tools to focus on capabilities, governance, and business alignment.

So tell us, is your IAM program truly mature—or just a checklist of tools?

Key Topics Covered:

• Why IAM maturity starts with capabilities, not tools
• How to assess your current IAM status quo
• The role of identity lifecycle management & governance
• Common IAM challenges and gaps organizations face
• Why step-by-step progress beats “big bang” projects

πŸ’‘ If you’re looking to strengthen your IAM foundation and align it with business priorities, this episode is for you.

The fraud landscape has been rocked by a seismic shift—obsolete security systems no longer stand a chance. Enter FRIPs, the revolutionary platforms transforming identity verification and transaction security. As fraudsters evolve, only enterprises leveraging these advanced defenses will thrive. Can your business afford to lag behind in this high-stakes IT arms race?

Read the original blog post here: https://www.kuppingercole.com/events/ifid2025/blog/how-frip-weaponizes-identity-fabrics-the-security-revolution-hiding-in-plain-sight

In this practical episode of the KuppingerCole Analyst Chat, Patrick Teichmann joins Matthias Reinwarth to address a surprisingly common organizational issue: IAM teams being tasked with solving everything.

From HR data gaps to legacy tool cleanup and cross-department handovers — IAM teams often inherit work that isn’t truly their responsibility. This episode is a call to realign IAM strategy with clear ownership, realistic boundaries, and strong service delivery.

In this conversation:

• Why not everything is an IAM problem
• Common traps: onboarding issues, ownership gaps, tool clutter
• How to set boundaries without damaging collaboration
• Using operating models and RACI matrices to define IAM’s real scope
• Why focusing your IAM team improves service quality and security
• How to justify saying “no” — with strategy to back it up
• Preparing for IAM scalability, sustainability, and new regulations

Key takeaway: Sharpening your focus as an IAM team isn't about doing less — it’s about doing what matters most, better.

In this episode of the KuppingerCole Analyst Chat, Martin Kuppinger joins Matthias Reinwarth to dive deep into one of the most overlooked but critical areas in identity and security: non-human identities (NHI) and workload secrets. As cloud-native development and AI-driven workloads grow, so does the complexity of managing machine identities. With AWS now supporting long-lived API keys for generative AI, this episode explores why that's a risky move — and what a modern, secure, and developer-friendly alternative looks like.

In this episode, you'll learn:

• Why workload identities must be treated as privileged
• How long-lived secrets expand your attack surface
• Why “balancing convenience vs. security” is a false choice
• How to apply ephemeral secrets and ITDR signals
• The role of SPIFFE/SPIRE, policy-as-code (OPA), and automation
• Why developers shouldn’t own security — and what IAM must do instead
• How attackers use AI to hunt your leaked secrets
• What organizations must do to secure NHI at scale

Key takeaway: Security must be built around short-lived secrets, automation, and clear separation between identity, secrets, and entitlements — especially for workloads and AI agents.

In this episode of the KuppingerCole Analyst Chat, Warwick Ashford joins Matthias Reinwarth to explore a hidden but growing risk: third-party access to your systems.

Third-party contractors, suppliers, and partners often have access to internal systems — but lack the same governance, oversight, and security controls as employees. This episode explores why Third-Party Access Governance (TPAG) is now a strategic security priority, not just a technical integration.

What we cover:
βœ…Why third-party identities now outnumber employees in many orgs
βœ…The governance gap: no HR triggers, lifecycle oversight, or certifications
βœ…How traditional IAM systems fail to manage external access
βœ…The role of the Identity & Security Fabric in enabling TPAG
βœ…Regulatory drivers (DORA, NIS2, CMMC) making this a board-level issue
βœ…Core capabilities of modern TPAG solutions
βœ…Practical first steps for building a third-party access governance strategy

Explore how the Oracle Database@AWS collaboration eliminates multi-cloud compromises, integrating Oracle's capabilities within AWS to enhance security, performance, and compliance. Learn how this partnership enables businesses to lift and shift existing workloads easily, leverage AI automation, and achieve rapid data integration, all while maintaining enterprise-grade security and scalability.

Read the original blog post here: https://www.kuppingercole.com/blog/balaganski/oracle-databaseaws-combining-the-best-of-both-clouds

In a groundbreaking move, Palo Alto targets a $25 billion acquisition of CyberArk, poised to reshape identity security landscapes. As two cybersecurity giants converge, explore this narrative of strategic synergy versus the challenge of seamless integration. With potential market upheaval at stake, the acquisition promises to redefine the rules of identity security.

Read the original blog post here: https://www.kuppingercole.com/blog/leal/palo-alto-cyberark-a-strategic-expansion-into-identity-security-but-with-questions

In this episode of the KuppingerCole Analyst Chat, host Matthias Reinwarth welcomes Martin Kuppinger, Founder and Principal Analyst at KuppingerCole, to discuss the evolution of the Identity Fabric. Originally introduced as a visual tool in 2017–2018, the Identity Fabric has matured into a foundational framework for modern identity and access management.

The conversation covers the motivations behind its creation, its flexibility in addressing various identity types, and its role in simplifying complex IAM architectures. Martin also explains the rationale for a leaner version of the model, aimed at executive stakeholders, and offers a glimpse into the forward-looking Identity Fabric for the 2040s.

In this episode, you’ll learn:
βœ…Where the Identity Fabric concept began
βœ…Why a leaner version is needed — and who it’s for
βœ…How to pitch Identity Fabric to C-level decision makers
βœ…What the 2040s might look like for IAM
βœ…How organizations and vendors alike are using this model today

Whether you're deep in IAM or just starting to align your strategy, this episode breaks down how to communicate complex identity concepts more clearly.