Security & Identity Modernization Services

Compliance gaps during the migration window

When migrating from legacy authentication (LDAP, legacy RADIUS) to modern IAM, there is typically a 2–4 week window where both systems run simultaneously. This dual-running period is the highest compliance risk — audit trails may be split across systems, making it impossible to produce a clean access log for a given time range.

Prevention: Define the compliance continuity plan before migration begins. Auditors must approve the dual-running approach in writing before the migration window opens.

Identity sprawl from incomplete zero-trust rollout

Zero-trust requires every access path to be governed. Projects that modernize Tier 1 applications but leave legacy applications on the old perimeter create a false sense of security. One financial services firm discovered 40% of their critical applications were still using legacy authentication 18 months after declaring zero-trust "complete."

Prevention: Project scope must include a full application inventory and classification — not just platform replacement. Every application must be categorized before the engagement begins.

Legacy authentication left in place alongside new systems

NTLM, basic auth, and legacy RADIUS frequently remain active "temporarily" and become permanent. The new IdP runs alongside the legacy authentication stack indefinitely, doubling the attack surface rather than reducing it.

Prevention: The decommission plan for legacy authentication protocols must be a contract deliverable with hard dates — not a best-effort objective left to the client after the engagement closes.

"We'll bolt security on after migration"

Security architecture must be first, not last. Any vendor who proposes migrating the platform first and addressing security architecture afterward is proposing a sequence that creates compliance exposure during the most vulnerable period.

No identity governance plan

How will orphaned accounts, privileged access, and lifecycle management work after go-live? A proposal without an identity governance framework is delivering a platform installation, not an IAM program.

Zero-trust claim without microsegmentation roadmap or application inventory

Zero-trust without a complete application inventory is incomplete by definition. Ask for the application classification methodology before trusting the zero-trust claim.

No compliance continuity plan for the migration window

If the vendor has not addressed how audit trails will be maintained during the dual-running period, they have not planned the migration properly.

Platform expertise only, no architecture expertise

Okta or Azure AD implementation skills are not the same as zero-trust architecture design. Ask specifically: who designs the trust boundaries and microsegmentation model before any platform is selected?

How much does security and identity modernization cost?

IAM modernization projects run $200K–$2M+ depending on application count, identity provider count, and regulatory requirements. A single-IdP consolidation (migrating to Okta or Azure AD) for a 500-user organisation runs $150K–$300K. Zero-trust architecture for an enterprise with 50+ applications runs $600K–$2M. Ongoing IAM platform licensing is $10–$50/user/year.

Zero-trust vs perimeter security — what's the difference?

Perimeter security assumes anything inside the network is trusted. Zero-trust assumes breach — every request is verified regardless of origin. Zero-trust requires: identity verification for every access request, device health validation, least-privilege access, and microsegmentation. The shift from perimeter to zero-trust is primarily an identity architecture project, not a firewall replacement.

How long does zero-trust implementation take?

3–9 months for foundational zero-trust (IdP modernization, MFA enforcement, privileged access management). Full zero-trust maturity (microsegmentation, continuous device trust, data-centric security) takes 18–36 months. Projects that promise zero-trust in 6 weeks are delivering a platform installation, not an architecture transformation.

What is identity governance and why do we need it?

Identity governance manages who has access to what, and ensures that access is appropriate, current, and auditable. Without it: orphaned accounts (departed employees with active access), privilege creep (access accumulates over time), and compliance exposure (you can't prove who had access to what during an audit). Identity governance platforms (SailPoint, Saviynt) run $100K–$500K/year for enterprise deployments.

What compliance frameworks require zero-trust?

SOC 2 Type II requires evidence of access controls and monitoring that aligns with zero-trust principles. FedRAMP Moderate/High explicitly requires zero-trust architecture as of 2024. ISO 27001:2022 includes zero-trust-aligned controls. NIST 800-207 is the reference architecture for federal zero-trust requirements. Most cyber insurance policies now require MFA and privileged access management as minimum standards.

Should we consolidate to a single IdP or maintain multiple?

Single IdP is strongly preferred — it simplifies governance, reduces attack surface, and lowers licensing costs. Multiple IdPs are justified when regulatory requirements prohibit data commingling (e.g., separate directory for highly regulated data), or when M&A leaves legacy systems on separate authentication infrastructure temporarily. Target state should always be single IdP with federated trust for edge cases.

What is identity modernization?

Identity modernization moves identity management from fragmented on-premises directories and identity providers to cloud-based, orchestrated controls. It consolidates authentication, access policy, governance, privileged access, and lifecycle management so workforce, customer, machine, and service identities receive consistent security across applications and environments.

What are the 4 pillars of IAM?

The four IAM pillars are Identity Governance and Administration (IGA), Access Management (AM), Privileged Access Management (PAM), and directory management. Together they govern identity lifecycles, authenticate and authorize access, protect elevated privileges, and maintain the authoritative identity stores on which policy depends.