Identity convergence and platform sprawl reshaped RSA 2024

At a glance

What this is: This is Axiad’s take on RSA 2024, arguing that identity became a central conference theme while platform sprawl and poor integration remained the governance problem underneath the noise.

Why it matters: For IAM, IGA, PAM, and NHI programmes, the practical issue is not whether identity tools exist, but whether their signals, controls, and risk decisions can be coordinated across fragmented platforms.

Context

RSA 2024 surfaced a familiar security pattern in a more visible form: identity was everywhere, but so was fragmentation. The article argues that the real issue is not another isolated capability, but the lack of coordination across identity and access platforms.

The piece also frames governance, risk, and compliance as moving closer to cybersecurity because regulation and risk now carry direct operational and financial consequences. For identity teams, that convergence raises the stakes of how identity signals are shared, acted on, and reviewed across tools.

Key questions

Q: How should security teams handle identity tool sprawl across multiple platforms?

A: They should treat tool sprawl as a control-design problem, not a licensing problem. The priority is to define which identity signals must travel between systems, which workflows must stay local, and where enforcement breaks when products do not share state. Without that mapping, teams end up with overlapping visibility but inconsistent decisions across the identity estate.

Q: Why does platform consolidation often fail to simplify identity governance?

A: Because a larger platform does not automatically preserve the specialised controls that made the original tools useful. Identity governance depends on accurate lifecycle states, consistent enforcement, and shared risk context. If those functions become weaker after consolidation, the environment may look simpler while actual control quality declines.

Q: What are the signs that identity controls are too fragmented to trust?

A: Look for repeated manual onboarding, inconsistent offboarding timing, duplicate identity records, and different authentication rules in different systems. Those are strong indicators that the control plane is not coherent. When teams must reconcile access by hand, the programme is relying on effort rather than governance.

Q: What should teams do when GRC and cybersecurity requirements start converging?

A: Bring identity governance, risk reporting, and response ownership into the same operating model so access decisions can be judged against regulatory and operational impact together. The point is not to merge teams for its own sake, but to make sure identity events are visible to the people responsible for risk acceptance and evidence.

Technical breakdown

Why identity fabrics emerged as the response to platform sprawl

The article describes an identity market split across IDPs, proofing, behavioural controls, and ITDR, with each tool solving only part of the problem. A fabric is the coordination layer that sits above those tools and lets organisations combine best-of-breed capabilities without pretending every platform can do everything. The architectural point is that identity risk is distributed, so governance has to be distributed too. Practical implication: evaluate whether your identity stack can share risk signals and enforcement actions across platforms instead of trapping decisions inside one product boundary.

Practical implication: evaluate whether your identity stack can share risk signals and enforcement actions across platforms instead of trapping decisions inside one product boundary.

Why platform consolidation can increase identity governance blind spots

The article argues that multiple IAM platforms create complexity, but replacing them with a single consolidated suite can be equally problematic if it forces teams to give up differentiated strengths. Migration cost, feature loss, and integration gaps all shape whether consolidation actually improves control. In identity governance terms, the issue is that risk assessment in one platform does not automatically propagate to the others. Practical implication: inventory where identity decisions are made today, then test whether those decisions are visible across the rest of the stack.

Practical implication: inventory where identity decisions are made today, then test whether those decisions are visible across the rest of the stack.

Why identity is becoming the control plane for security priorities

The article treats identity as one of the two core things security teams must protect, alongside data. That framing matters because it moves identity away from a supporting function and into the centre of security design, especially as XDR vendors add ITDR-style capabilities. The technical shift is not just more identity tooling, but tighter coupling between identity context, threat detection, and response. Practical implication: treat identity telemetry as an operational input to security decisions, not as an isolated administrative record.

Practical implication: treat identity telemetry as an operational input to security decisions, not as an isolated administrative record.

NHI Mgmt Group analysis

Identity convergence is no longer optional when the control plane is fragmented. RSA 2024 exposed a market where identity controls are spread across IDPs, proofing, ITDR, and IAM suites, yet many organisations still expect those tools to behave like one system. That assumption fails because risk does not stay inside one platform boundary. The implication is that identity governance must shift from product ownership to coordinated enforcement across the stack.

Platform sprawl creates governance debt, not just operational overhead. The article is right to call out the fallacy that one platform can absorb all identity use cases without trade-offs. Every platform that is isolated from the others creates a separate decision surface, a separate risk vocabulary, and a separate place where accountability can break down. Practitioners should read this as a warning that fragmented identity architecture weakens auditability as much as it weakens efficiency.

Identity fabric is the more accurate model for modern IAM than suite consolidation. The strongest message in the article is not that consolidation is bad, but that coordination matters more than ownership. Best-of-breed identity controls can still be governed if the architecture shares signals and enforcement logic across products. That is the direction identity programmes should favour when they need coverage without sacrificing specialised capability.

GRC and cybersecurity are converging through identity because regulatory pressure now follows identity risk. The article links rising regulation to the growing presence of GRC vendors at RSA, which is the right lens for identity teams to adopt. Identity events are increasingly compliance events, especially where access decisions can create financial or operational exposure. Practitioners should expect identity governance to be judged less by tool count and more by how consistently it supports risk accountability.

Identity threat detection only works when the rest of the stack can act on it. The article notes that every XDR vendor was talking about ITDR, which reflects a broader truth: identity signals are only useful if they can influence downstream controls. That makes integration a governance requirement, not a nice-to-have. Teams should measure whether suspicious identity behaviour can trigger response across platforms instead of remaining trapped in the originating tool.

What this signals

Identity fabric is becoming the more useful design pattern than suite consolidation. The article’s core insight is that fragmented identity tools can still be governed if the architecture lets signals and enforcement move across them. That changes the programme question from “which platform should win?” to “how do we keep identity decisions coherent across multiple control surfaces?”

Platform sprawl now behaves like governance debt. When identity, risk, and response data cannot travel cleanly between systems, teams spend more time reconciling control surfaces than improving them. The practical response is to reduce decision drift between platforms, not just reduce the number of logos in the environment.

For practitioners

• Assess identity control fragmentation Map where identity, risk, proofing, and detection decisions are made today, then identify where those decisions stop propagating to other platforms.
• Define the identity fabric layer Specify the integration layer that will carry identity context and enforcement signals across tools, rather than assuming a single suite can replace the stack.
• Test cross-platform risk propagation Validate that a risk signal raised in one IAM or ITDR control actually reaches other systems that can change access or trigger review.
• Separate consolidation from governance Treat platform reduction as a migration decision, not a governance objective, and require evidence that visibility and control improve after any change.

Key takeaways

• Identity governance is becoming a coordination problem across fragmented control surfaces, not a single-platform procurement problem.
• The article’s central warning is that platform consolidation can hide control loss if risk signals do not propagate across the stack.
• Identity teams should judge architecture by how well it preserves specialized controls while keeping risk decisions visible end to end.

Key terms

• Identity Fabric: An identity fabric is a connected control model that shares context across governance, privileged access, and access management. It is not a product category. The aim is to make identity decisions coherent across the full lifecycle so ownership, privilege, and enforcement reinforce each other.
• Software Sprawl: Software sprawl is the accumulation of overlapping, redundant, or underused applications across an organisation. It becomes a governance problem when the volume of apps outpaces the ability to assign ownership, review access, and retire software cleanly.
• ITDR: Identity Threat Detection and Response is the set of detection and response capabilities focused on identity misuse, abnormal authentication, and suspicious access behaviour. For identity programmes, its value depends on whether its signals can trigger action across the wider security stack.
• Governance Convergence: Governance convergence is the operational merging of security and compliance decision-making around the same control evidence. In identity programmes, it means the records used to prove control effectiveness must also help drive enforcement and response.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.