When we started Centrify more than 10 years ago, Identity and Access Management (“IAM”) was a big but rather static market. In 2008 — a few years after we formed Centrify — the analyst group IDC reported that the IAM market was $3.1 billion.
But in looking at the analyst reports then, it was clear that the IAM market was quite fragmented. The big debate at the time was whether Identity point solutions could hold their own versus “suites” that were being put together by larger vendors who primarily created these suites through a series of acquisitions.
In 2008, the top three vendors in the space — IBM, CA, and EMC— together held only 32 percent of the market. One analyst group at the time even said there were more than 100 vendors in the market.
So why all the fragmentation? It’s all because the original IAM market is a rollup of distinct and diverse sub-segments that are not entirely synergistic with each other. As Forrester noted: “The IAM market landscape reflects its history. Each of the product areas started as separate markets, in many cases created to solve quite different needs and often sold to different people in the enterprise.”
IDC itself identifies six major market sub-segments of the IAM market, which is projected to grow from $4.9 billion in 2013 to $6.9 billion in 2017.
Here are how the IAM market sub-segments break out:
- Web / Federated SSO — projected to be the largest segment at more than $2 billion in 2017
- Advanced authentication — projected to be more than $1.5 billion in 2017
- User provisioning — projected to be $1.5 billion in 2017
- Enterprise (host) SSO
- Legacy authorization
- Personal Portable Security Devices (i.e. the traditional token market)
Given the distinct market sub-segments and different buyers, it was hard for one IAM vendor to successfully span all six segments, and attempts by suite vendors to buy various solutions in each segment/category did not really work as promised, as no one vendor today has more than 15 percent market share.
But the world is changing. First off, cloud and mobile are making identity even more important. This, in turn, is making the world of IT more “de-perimeterized.” One result of this is that IT organizations no longer own the user’s end point — because of Bring Your Own Device (“BYOD”) — and no longer own the back-end resource — because of Bring Your Own Application (“BYOA”) — and growing deployments of both Software- and Infrastructure-as-a-Service.
As a result, securing user identities is now dramatically rising in importance. Traditional IT security products such as anti-virus and firewalls are not really relevant in a world in which users are no longer inside the firewall and are now using their iPads at Starbucks to access Salesforce, Concur, Google Apps, etc. Therefore, in this world, making sure the user’s identity is secure and that users can get secure anywhere access on any device is now a top priority.
This means that not only are identity management solutions becoming more important because of cloud and mobile, but they have to address the very cloud and mobile technologies that are driving demand for them. It is interesting that not all vendors in the IAM space have realized that, and many of today’s identity solutions only half-heartedly support the cloud.
But equally important is the fact that customers are also looking for more nimble cloud-based identity solutions as an alternative to cumbersome on-premises identity management suites. In fact, Gartner noted that the rapid growth of mobile and cloud-based security is propelling the cloud-based identity market (aka IDaaS market) to more than $1 billion by 2017.
So if you take the $1.2 billion of the IDaaS market and divide it into the $6.9 billion of the overall IAM market, that means about 20 percent of the market will be cloud-based. That’s disruption happening.
The other key thing to note is that the CAGR for the overall IAM market is growing 9 percent, and that CAGR for cloud-based IAM is growing 25 percent, which means that while the overall IAM pie is growing, the IDaaS slice of the pie is growing faster, so therefore IDaaS is now eating traditional IAM revenue.
So disruption is occurring, but what about de-fragmentation? Because cloud-based architectures make it easier to add functionality via agile development, what we are now finding is that cloud-based vendors can more easily offer multiple features from the multiple segments of identity in a single solution. So what were multiple “swim lanes” before in the identity market are now being collapsed into a single integrated solution.
A solution like Centrify User Suite allows for a single integrated offering that gives you four of the six segments of the IAM market listed above. Features are added every month at a very affordable price — as opposed to legacy suite vendors offering four or five distinct, expensive products as on-premises offerings that get updated only once every year or two.
We believe the compelling nature of what a multi-feature cloud-based solution can offer will cause a consolidation to occur, as customers over time look to abandon pre-existing point solutions. In other words, who wants six distinct, overly priced, and loosely integrated solutions, when you can have a single elegant and affordable solution?
A cloud offering can go beyond traditional Identity and Access Management and offer adjacent features through a single solution, making a move to a product such as the Centrify User Suite even more compelling.
That’s the power of the cloud. And leveraging the cloud is how next-generation vendors will disrupt and de-fragment the Identity market.