Episode 232: Navigating IAM Market Evolution

Identity and access management has quietly become critical enterprise infrastructure. Yet organizations still buy IAM capabilities from a fragmented market that introduces and promotes new categories every year. This session focuses on shifting the IAM leader’s role from chasing market categories to navigating the market with a stable, practical framework. Together, we will map the organization’s IAM coverage surface; prioritize it by risk, gaps, and ownership; examine how each capability is delivered and operated; assess vendors based on the coverage they actually provide; and translate the resulting picture into terms that boards and executive stakeholders can understand and support. The session is designed for IAM program leaders and the architects who work alongside them.

#Speakers

• Host: Mike Schwartz, Founder/CEO Gluu
• Guest: Homan Farahmand, Founder and Principal Advisor, Control Architecture Institute

#Homework

• https://research.controlarch.org/navigating-iam-market-evolution
• Book Play Bigger

#Takeaways

• IAM needs a stable operating model. Many programs are reactive--built after successive audit findings and tool purchases. Managing critical infrastructure requires accountability that survives changes in projects, products, and teams.
• Build a control coverage matrix. Map governance, runtime, and observability controls across workforce, customers, devices, workloads, and partners. Prioritize each area by risk, control gaps, and whether a specific person owns it.
• Explain IAM needs through operational risk. Showing executives a red, yellow, and green coverage matrix. Make missing controls, missing owners, and improvement work visible in terms they understand.
• Assess vendors by breadth, depth, and architectural fit. A single vendor score can conceal uneven capabilities. Map products to your coverage needs, then identify where specialist vendors must fill the gaps.
• Move toward programmable controls and managed policies. Store code and policies in repositories so they can be reviewed, tested, and deployed programmatically. Define policies—even in plain English.