RSA 2024 exposed the limits of platform-led identity consolidation

At a glance

What this is: This is an analyst view of RSA 2024 arguing that AI hype, rising GRC presence, and identity tool sprawl exposed the limits of platform-led consolidation.

Why it matters: It matters because IAM teams need governance models that move risk signals across tools, not consolidation stories that add complexity while leaving identity decisions siloed.

Context

RSA 2024 surfaced a familiar identity governance problem: enterprise teams are still expected to reason across multiple IAM platforms, separate risk tools, and uneven integrations. The article frames this as a consolidation problem, not a shortage of capability, because the core issue is whether identity risk can move between systems fast enough to affect decisions.

The underlying message for IAM and identity security programmes is that platform breadth does not solve fragmented governance. When one tool can identify risk but cannot reliably communicate it to others, recertification, threat response, and policy enforcement remain disconnected, which weakens the practical value of any single stack.

Key questions

Q: How should IAM teams justify consolidation of identity security tools?

A: IAM teams should justify consolidation by showing whether fewer tools reduce manual work, improve policy consistency, and improve detection or response outcomes. The business case should separate governance value from licence reduction. If consolidation does not narrow visibility gaps or shorten remediation cycles, it is only stack simplification, not risk reduction.

Q: When should organisations prefer a fabric model over a single identity platform?

A: They should prefer a fabric model when they need specialised tools to remain effective but still want shared policy and telemetry across them. A fabric is the better fit when control quality depends on interoperability rather than on replacing every component with one suite.

Q: What do IAM teams get wrong about AI-driven identity security?

A: They often treat AI-driven features as a tooling upgrade rather than a governance shift. The real issue is whether policy, lifecycle control, and telemetry can work together across human and non-human identities when access patterns are more dynamic than traditional review cycles.

Q: Why does fragmented IAM increase operational and security risk?

A: Fragmented IAM increases risk because access data, review states, and revocation actions diverge across tools. That creates blind spots, slows response, and makes it harder to prove that access was removed correctly. In practice, the organisation inherits multiple partial truths instead of one defensible record of entitlement.

Technical breakdown

Why platform-led identity consolidation stalls

Platform-led consolidation promises simpler operations, but identity is not a single control plane in most enterprises. IAM, proofing, CBA, and ITDR products often solve different problems and hold different context, so replacing them with one suite can remove useful depth while leaving cross-tool visibility unresolved. The technical issue is not just product overlap. It is that identity risk lives in multiple layers: authentication events, privilege assignments, device or session context, and response workflows. If those layers do not exchange state cleanly, the organisation still cannot turn a risk signal into an action across the estate.

Practical implication: Map where identity risk is created, enriched, and consumed before any platform consolidation decision.

Identity fabric vs identity stack

An identity fabric is an integration pattern, not a single product category. It aims to preserve best-of-breed capabilities while making identity context portable across tools so risk, entitlement, and response data can move without forcing one platform to own everything. That differs from stack consolidation, which assumes one vendor can absorb all identity functions with minimal loss. In practice, the fabric model becomes more relevant as organisations accumulate overlapping IAM platforms, ITDR tools, and access governance systems. The goal is coordination across control points, not uniformity for its own sake.

Practical implication: Use fabric-style interoperability requirements when evaluating identity architecture and vendor roadmaps.

Why AI messaging did not solve the identity problem

The article suggests that AI was omnipresent at RSA, but mostly as messaging rather than a control response to identity fragmentation. AI features do not automatically resolve governance problems if the underlying identity data remains isolated or incomplete. In identity security, the hard part is still trustworthy context, policy enforcement, and response linkage across systems. If those dependencies are missing, adding AI layers can increase noise without changing the decision path. The practical limit is that intelligence without integration still leaves identity risk stranded inside individual tools.

Practical implication: Treat AI features as secondary until identity context can actually flow between your core platforms.

NHI Mgmt Group analysis

Platform consolidation is the wrong primary metric for identity security maturity. The article shows that organisations are still measuring success by how many capabilities can be absorbed into a single suite, even though identity risk is distributed across authentication, authorisation, detection, and response. That creates an illusion of simplification while preserving operational blind spots. The practitioner conclusion is to judge architecture by how well it moves identity context, not by how few vendors remain.

Identity fabric is the more defensible governance model because it preserves specialised controls. Identity programmes need proofing, access governance, and threat response to remain strong in their own domains while sharing context where needed. A fabric approach recognises that no single platform usually excels at every identity function, especially when risk must be propagated across tools. The implication is that integration quality becomes a governance requirement, not just an engineering preference.

AI only matters when it improves identity decision quality, not when it decorates the stack. RSA’s AI saturation exposed a common failure mode: automation narratives are often easier to market than cross-platform identity control. In governance terms, AI that cannot consume or emit reliable identity state does not change the underlying security model. Practitioners should treat AI claims as secondary to evidence of actual decision integration.

Cross-tool signal transfer is now the core identity governance problem. A platform may detect that a person, session, or entitlement is risky, but the enterprise still needs that signal to alter enforcement elsewhere. That makes interoperable context sharing a field-level requirement for modern IAM, IGA, PAM, and ITDR programmes. The practical conclusion is to invest in the connective layer that lets one control inform another.

Identity and data remain the two durable security subjects, but identity is still earlier in its maturity curve. The article correctly separates the long-established data-security conversation from the still-maturing work of governing identities at scale. That means identity teams cannot rely on generic security consolidation narratives borrowed from other domains. The practitioner conclusion is to treat identity governance as a distinct architecture problem with its own control boundaries.

What this signals

Identity fabric is becoming a governance requirement, not a technical preference. The RSA takeaway is that enterprises cannot rely on isolated identity platforms to manage modern risk flows. As identity data, entitlement decisions, and threat response spread across more tools, the connective layer becomes the control surface practitioners need to design intentionally.

Platform-led simplification often hides control loss. Replacing multiple identity systems with a single suite can reduce visible complexity while erasing the specialised context that made the original controls effective. Teams should watch for architecture decisions that improve procurement narratives but degrade signal transfer, response quality, or recertification accuracy.

For practitioners

• Define an identity fabric target state Document which identity functions must remain specialised and which signals must be shared across platforms, then set interoperability requirements for each connection point.
• Inventory cross-platform risk signals List the identity events, risk scores, and entitlement changes that should propagate between IAM, ITDR, and access governance systems.
• Challenge platform consolidation assumptions Test any consolidation proposal against migration loss, feature regression, and the inability to carry risk context between tools.
• Separate AI features from control outcomes Require evidence that AI-driven identity features improve enforcement, response, or recertification rather than simply adding another dashboard.

Key takeaways

• RSA 2024 reinforced that identity security is still fragmented even as vendors pitch broader platforms and more AI functionality.
• The practical weakness is not a lack of tools, but the inability to move identity risk signals cleanly across those tools.
• Identity programmes should favour interoperable governance over consolidation that strips out specialised control and response capability.

Key terms

• Identity Fabric: An identity fabric is a connected control model that shares context across governance, privileged access, and access management. It is not a product category. The aim is to make identity decisions coherent across the full lifecycle so ownership, privilege, and enforcement reinforce each other.
• Cross-Platform Risk Propagation: Cross-platform risk propagation is the ability for one identity control to pass risk or state changes to another control so enforcement can change elsewhere in the environment. Without it, detection stays local and the rest of the stack remains unaware of the risk.
• Platform Consolidation Risk: Platform consolidation risk is the chance that moving identity functions into a broader security platform weakens specialist controls or obscures important signals. The challenge is not consolidation itself, but whether the new operating model preserves lifecycle accuracy, integration depth, and usable evidence.
• Identity signal network: The set of practitioners, researchers and standards voices a team follows to understand where identity security is heading. In practice, it is a governance input that helps leaders spot changes in access, privilege, lifecycle and emerging trust patterns before those shifts become control failures.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.