IAM Consolidation

One of the most compelling talks I’ve seen was at BSides Las Vegas where they were describing malware techniques and adoption rates. They pointed out that there’s a wide variety of experimentation until they find something that works, and then there is a fast adoption period, followed by process maturity, and then a decrease in the process that works as they move on to something new. Professor Aswath Damodaran pointed out a similar phenomenon with maturity of stocks/companies going through a similar cycle where it plateaus into managing rather than growing (e.g. Nike, Bayer, GE, etc…).

Examining that thesis I’d argue that AI is hitting growth limits, which isn’t a revelation given the RAM, SDD, HDD, and GPU shortages (among other component shortages). However the thing that should be examined is once the companies start to shift from rapid adoption to maturity is what are the downstream impacts as processes/companies become more standardized and matured? In today’s environment consolidation is where things usually move to when companies begin to mature after rapid adoption, which is something that we’ve definitely seen in the AI space as of late. What I’m further curious about though is the second order impacts, because I think those are just beginning to be understood and wrestled with.

We’re starting to see consolidation in the IAM space as it relates to IAM in that management and tool based companies are being acquired such as Crowdstrike acquiring SGNL. As there is already tool, data, and asset sprawl, so too shall there be AI and agent sprawl. Dealing with the agent sprawl challenge will require a substantial amount of time, effort, and energy.

As it relates to IAM, budgets are already stretched thin for companies in a number of sectors as David Llorens points out on the latest Identity at the Center podcast. A lot of companies have aspirations of what they want to achieve with IAM (having good telemetry, regularly rotated keys, etc…). Llorens points out that there’s got to be a baseline (MFA), and then configuration and process maturity can come from there (e.g. tracking impossible travel, conditional access, risk signals, etc…).

IAM is definitely riding the AI wave at this point and is growing as a result. Some of the growth is good, others will take more time to figure out, but at the very least IAM will continue to be a core part of cybersecurity and the way things operate.