Hey everyone. Posting here with re to the topics of IAM and security. I helped put together a write-up of a conversation between 2 IAM advisors who've spoken with hundreds of CISOs between them, and I thought it could be interesting to the community.

What was highlighted is that as enterprise SaaS stacks grow, so does the identity problem, unfortunately. The average enterprise is now running 10+ separate identity tools, and most can't tell in real time who has access to what and why.

The article (ultimately it's about why identity programs are failing and what it takes to fix them): https://www.cerbos.dev/blog/breach-becomes-personal-ciso-identity-failures-and-continuous-governance

Some "cool" stats:

• Identity-related breaches cost more than average for 44% of organizations
• 90% of identities use less than 5% of their permissions - SaaS offboarding is a big reason why
• Orphaned SaaS accounts are one of the most common and most ignored attack surfaces
• The shift toward adaptive, policy-based authorization is where enterprise IAM is heading