Latest news with #accessmanagement
Forbes
09-07-2025
- Business
- Forbes
Why Securing SaaS Apps Needs An AI Makeover
Nidhi Jain is the CEO & Founder of with 20+ years of experience. Modern enterprises now depend on hundreds—sometimes thousands—of SaaS tools. With each new hire, role change or departure, traditional static roles and permission models quickly become outdated and unmanageable. To make things even more complex, AI tools are entering the workplace at an accelerating pace, and access requirements are changing daily. IT teams need an always-on AI engine—one that continuously monitors activity, dynamically adjusts roles and permissions, and ensures the right people have access to the right tools, exactly when they need them. What's Going Wrong In Access Management Today When IT owned and controlled the entire tech stack, access management was straightforward: • Assign a few systems at onboarding. • Remove them at offboarding. • Maintain a centralized, static access matrix. But the rise of SaaS—and citizen IT, where departments buy their own tools—has changed everything. In today's reality, every SaaS application and AI tool comes with 20 to 30 granular permission settings. Departments often purchase and manage their own apps without informing IT. AI tools can spin up new instances automatically, outside traditional IT controls, while cross-functional roles demand access to multiple systems beyond what static job titles suggest. Take the example of onboarding a new sales development representative (SDR). It's no longer just about giving access to Salesforce. Over time, the SDR team has added tools like: • Messaging platforms • Intent data providers • Data enrichment services • Personalized video tools These tools are often managed at the departmental level, outside IT's purview. So now, when a new SDR joins, there's no standard "access template." Instead, IT has to figure out: • Which apps the SDR team most frequently use or log every day. • What permissions are needed inside each tool. • What old accounts still linger unused. • How to avoid giving too much or too little access. It's almost like you need to scan your environment daily just to keep up with what your teams are using to stay productive and continuously update both your list of applications and each user's access permissions. The shift to decentralized access has introduced new vulnerabilities. To start, department-owned apps and DIY access management fly under IT's radar. Tools are adopted and access is granted without oversight, creating hidden risks and unchecked sprawl. Risky behavior can also go undetected. If a departing SDR downloads mass customer data, it may go unnoticed until a quarterly audit, too late to prevent damage. Finally, approval fatigue sets in as managers overwhelmed by endless access requests tend to rubber-stamp approvals without careful review. IBM's 2024 Cost of a Data Breach Report found the average breach now costs $4.88 million, a risk most lean IT teams can no longer afford. AI: The Transformative Force In IGA More enterprises are turning to AI to address today's access management challenges. Rather than relying on manual reviews, static policies and human memory, AI can bring continuous, intelligent oversight that scales with the complexity of the modern enterprise. Here's how AI is reshaping access governance: Instead of periodic reviews, AI continuously monitors user access and behavior against established baselines. If an SDR suddenly gains access to tools they've never used or performs actions like large data downloads after hours, AI can detect these anomalous access permissions in real time and flag them for investigation. By learning usage patterns across roles and departments, AI helps identify risks early, minimize blind spots and ensure that access remains aligned with business intent. Since AI evaluates access requests across multiple dimensions—user role, historical behavior, peer access patterns and data sensitivity—AI can predict a likely "yes" for a manager who has previously been approved to access similar tools for similar roles, streamlining approvals. But when an access request deviates from the norm, such as unusually high privileges or tools outside the team's typical stack, it flags it for review and asks for explicit approval, reducing the risk of improper provisioning while accelerating access for legitimate needs. AI mitigates approval fatigue by proactively detecting compliance risks before they escalate. It identifies policy violations, dormant accounts and anomalous access accumulation in real time, reducing the burden on managers to catch every issue manually. Instead of reacting during audit season, organizations can rely on AI to surface potential risks early, enforce smarter access decisions and maintain continuous compliance. This marks a shift from reactive governance to intelligent, proactive access oversight—a level of scalability and precision previously out of reach. Humans And AI: A Smarter Team AI isn't here to replace people. It's here to support them with context, speed and intelligence. Imagine an access request system where: • AI recommends the best action based on real-world context. • The system explains why it made that recommendation. • Humans stay involved in high-risk decisions or sensitive approvals. This augmented model can help save time, reduce risk and keep humans firmly in control where it matters most. The key is thoughtful change management: • Start with low-risk tasks. Automate high-volume, routine access requests, such as standard business apps with basic license levels, to reduce manual workload and speed up provisioning. • Be transparent. Always show users why the AI made its recommendation. • Learn from human feedback. Fine-tune models based on overrides and corrections. • Reserve sensitive decisions for people. Keep critical high-privilege approvals under human control. Managing access safely in a decentralized, SaaS-first world requires more than scaling old models. It demands intelligence and the ability to govern dynamically, continuously and contextually. By 2028, AI-augmented identity governance will likely be table stakes for large enterprises. Organizations that begin laying the groundwork now will be better positioned to navigate this shift thoughtfully. Early adoption allows time to refine policies, adapt processes and align teams—ultimately enabling faster onboarding, more intelligent access decisions and stronger compliance, all without significantly increasing operational overhead. As AI becomes more deeply embedded in enterprise infrastructure, the question is no longer whether to automate access management—but how to do it responsibly. Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
Forbes
28-05-2025
- Business
- Forbes
Making Identity Governance Accessible
Clear, transparent pricing models can reshape how organizations adopt identity governance—making ... More critical security tools more accessible than ever. Identity is the frontline of today's cybersecurity battles. Whether it's stolen credentials, over-provisioned access, or dormant accounts, attackers have found that the easiest way in is often through the front door—by posing as someone who already belongs. And yet, for many organizations, the systems meant to manage identity and access are either too costly, too complex, or simply out of reach. This tension is pushing the Identity Governance and Administration market to evolve. Even small and mid-sized organizations need identity tools they can deploy quickly, manage easily, and afford without budgetary gymnastics. The cybersecurity community agrees: identity is the new perimeter. I talk to executives from technology and cybersecurity vendors across the spectrum. Regardless of the area of focus of the company or the solutions they provide, the discussion frequently comes back to the importance of identity security. But that awareness hasn't necessarily translated into action, particularly among resource-constrained companies. While Fortune 500 enterprises deploy full-fledged IGA platforms with lifecycle management, access reviews, and privileged access monitoring, smaller firms often make do with spreadsheets, email approvals, and best guesses. The result? A growing identity gap where bad actors have more opportunities to exploit excessive access or outdated entitlements in environments with fewer safeguards. I spoke with Subbu Rama, CEO of BalkanID, about these challenges. He explained, 'If somebody gets into Tony's account, acts as Tony, and Tony is not least privileged, now you actually have exposed too much in your company—and now that's the keys to the whole kingdom.' Many IGA solutions were built in a different era—one where long implementation cycles, high-touch professional services, and six-figure price tags were the norm. They assumed companies had security teams to spare and the patience to customize workflows for months before realizing value. The environment looks very different today. Organizations are leaner, faster, and operating in a digital landscape that changes daily. They need tools that can adapt just as quickly, not platforms that require a project manager just to get started. In response to growing demand from lean security teams, a new generation of IGA platforms is emerging. These solutions are built for speed, simplicity, and scalability. They can often be deployed in under an hour and are designed with modular features that organizations can enable as needed. But one of the most transformative aspects of this new model is how these platforms are priced.. Traditionally, IGA pricing has been a black box. Organizations are often required to sit through multiple sales calls before they get any sense of what the solution will cost—and even then, pricing is frequently bundled, inconsistent, or tied to long-term contracts. This lack of transparency creates friction and mistrust at a time when security teams need clarity and flexibility. BalkanID's new product, BalkanID Lite, challenges that approach. It's a self-service offering designed for mid-market companies that need essential identity governance features without the enterprise-level price tag or implementation burden. What sets it apart isn't just its features—it's the way it's priced. BalkanID publishes clear, modular pricing directly on its website. Organizations can see what each component costs, pick only what they need, and understand exactly what they're committing to. It's an approach borrowed from consumer experiences—simple, upfront, and predictable. 'We wanted to solve [the problem] by making the pricing completely transparent,' Rama explained. 'Just like you buy cars now—hey, do I want a low-end model? That's all I care about, like a Model 3? Sure. Here's the Model 3. Want a Model X? Here's the pricing for a Model X.' By removing the need for negotiations and eliminating hidden fees, this model empowers customers to make informed decisions based on their actual needs and budgets. It also reflects a broader trend in SaaS: transparency is becoming a feature, not just a nice-to-have. The evolution of tools is important, but so is the mindset shift. For years, identity governance was viewed primarily as a compliance necessity—something done quarterly to satisfy auditors. That's no longer enough. As threat actors grow more sophisticated, identity governance must become continuous and dynamic. Least privilege can't be a one-time review—it needs to be a living principle embedded into how access is granted, adjusted, and revoked. The challenge is balancing that level of control with the need for business agility. According to Rama, the future of identity governance is modular. It's accessible. It's aligned with how companies actually work today. For SMBs and mid-market players, that means having options that don't require tradeoffs between productivity and protection. It also means recognizing that the value of a security tool isn't just in its features—it's in how quickly and consistently it delivers results without becoming a burden to manage. As companies reassess their security priorities, identity governance is getting the long-overdue attention it deserves. And thanks to this wave of more agile, transparent, and user-friendly platforms, that attention might finally translate into action. Because identity risk isn't reserved for the Fortune 500—and neither should be the tools to manage it.
