Topic starter
12/06/2026 10:14 pm
TL;DR: RSA 2024 showed three clear shifts: AI hype remained loud, identity drew roughly a third of vendor attention, and GRC moved closer to cybersecurity as regulation and risk pressures intensified, according to Axiad. Platform sprawl, not platform promises, is now the governance problem identity teams must solve.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “Three Key Takeaways from the 2024 RSA Conference”.
Key questions
Q: How should security teams handle identity tool sprawl across multiple platforms?
A: They should treat tool sprawl as a control-design problem, not a licensing problem.
Q: Why does platform consolidation often fail to simplify identity governance?
A: Because a larger platform does not automatically preserve the specialised controls that made the original tools useful.
Q: What are the signs that identity controls are too fragmented to trust?
A: Look for repeated manual onboarding, inconsistent offboarding timing, duplicate identity records, and different authentication rules in different systems.
Practitioner guidance
- Assess identity control fragmentation Map where identity, risk, proofing, and detection decisions are made today, then identify where those decisions stop propagating to other platforms.
- Define the identity fabric layer Specify the integration layer that will carry identity context and enforcement signals across tools, rather than assuming a single suite can replace the stack.
- Test cross-platform risk propagation Validate that a risk signal raised in one IAM or ITDR control actually reaches other systems that can change access or trigger review.
Bottom line: Identity governance is becoming a coordination problem across fragmented control surfaces, not a single-platform procurement problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
13/06/2026 12:51 am
Identity convergence is no longer optional when the control plane is fragmented. RSA 2024 exposed a market where identity controls are spread across IDPs, proofing, ITDR, and IAM suites, yet many organisations still expect those tools to behave like one system. That assumption fails because risk does not stay inside one platform boundary. The implication is that identity governance must shift from product ownership to coordinated enforcement across the stack.
A question worth separating out:
Q: What should teams do when GRC and cybersecurity requirements start converging?
A: Bring identity governance, risk reporting, and response ownership into the same operating model so access decisions can be judged against regulatory and operational impact together. The point is not to merge teams for its own sake, but to make sure identity events are visible to the people responsible for risk acceptance and evidence.
👉 Read our full editorial: Identity convergence and platform sprawl reshaped RSA 2024
This post was modified 6 days ago by NHI Mgmt Group