KuppingerCole Analysts

As OT systems go online, controlling access becomes more critical than enabling it. In this episode of the Analyst Chat, KuppingerCole analysts Matthias Reinwarth and Warwick Ashford dive into one of cybersecurity’s most overlooked domains: OT (Operational Technology) security. As industrial systems become increasingly connected, the traditional boundaries between IT and OT are dissolving, bringing new risks and new security imperatives. Key Topics ✅ The rise of Secure Remote Access (SRA) in OT environments✅ Why VPN-based access falls short for industrial systems✅ Zero Trust and identity as the new security control plane✅ Regulatory drivers (e.g., NIS2) and auditability requirements✅ Convergence of PAM, SRA, and third-party access governance✅ The growing role of non-human identities in Industry 4.0 Identity is no longer just part of security, it is the control plane for modern cybersecurity.

In today's episode of the Analyst Chat, Matthias Reinwarth welcomes John Tolbert to take a deep dive into the rapidly evolving world of Consumer Identity and Access Management (CIAM). As organizations manage millions, or even billions, of identities, CIAM is shifting from a standalone capability to a core component of broader digital ecosystems. Key topics: ✅ Consumer vs. B2B IAM segmentation✅ Passkeys adoption and UX gaps✅ Identity lifecycle and account recovery✅ CIAM integrations and platform ecosystems✅ AI agents and identity governance Increasing scale, regulatory pressure, and user expectations are reshaping CIAM requirements. AI agents begin to act on behalf of users, introducing new risks, but also new opportunities for automation and innovation.

In the age of AI-generated content, the real challenge isn’t just detecting falsehood, it’s knowing what to trust at all. As deepfakes and disinformation scale, perception itself becomes a new attack surface. This week, Matthias Reinwarth and Jonathan Care explore how misinformation and disinformation are reshaping cybersecurity and enterprise risk. They clarify the difference between the two, examine how AI is accelerating the creation of deceptive content, and discuss why traditional trust models are breaking down. Key Topics ✅ Misinformation vs. disinformation: definitions and impact✅ Deepfakes, voice cloning, and synthetic identity risks✅ The “liar’s dividend” and erosion of trust✅ Emotional manipulation vs. factual accuracy✅ Enterprise attack vectors and real-world fraud cases✅ Pre-bunking, awareness training, and process-based defenses AI has industrialized deception: are your security controls keeping up? In a world of perfect fakes, trust is no longer a given, it’s a security problem.

The future SOC won’t replace humans with AI, it will empower us with AI-driven automation, accelerating detection and response while keeping humans in control of critical decisions. This week Matthias Reinwarth and Matthew Gardiner discuss the evolution of security automation with the introduction of AI SOC (Security Operations Center). They explore the challenges of alert fatigue, the importance of human oversight, and the cautious optimism surrounding AI's role in cybersecurity. The conversation delves into the balance between automation and human intervention, the trust issues associated with AI systems, and the current landscape of vendors in the AI SOC market. They conclude with insights on the future of AI in security and the potential impact on managed detection and response services. Key Topics:✅ Evolution from SOAR to AI-powered SOC✅ Using AI agents as junior security analysts✅ Managing alert fatigue and SOC analyst burnout✅ Balancing automation with human oversight✅ Explainability and trust in AI security systems✅ Impact of AI SOC on MDR and security service providers AI is reshaping SOC operations—but fully autonomous security is still far away. Discover why AI agents may become the “junior analysts” of the modern SOC, handling repetitive tasks while humans focus on complex decisions.

AI is everywhere, but are we using it the right way? In this Analyst Chat, Matthias Reinwarth speaks with CTO Alexei Balaganski about responsible AI usage, prompt engineering myths, data risks, and building a sustainable AI culture. From hallucinations to zero trust, this episode is your practical guide to using generative AI safely and effectively in business. Key Topics:✅ AI is mathematics — not intelligence✅ The biggest AI usage mistakes in companies✅ Data leakage & third-party risks✅ Prompt engineering made simple✅ Context limits & hallucinations✅ Building a responsible AI culture 💡Practice “Zero trust for AI”, skepticism is your strongest security control!💡AI can boost productivity, but only if you stay responsible, transparent, and in control.

Identity is no longer just about provisioning and single sign-on. Today’s organizations face fragmented IAM architectures, API sprawl, non-human identity growth, AI agents, and increasing Zero Trust demands. In this episode, Matthew Gardiner speaks with Binod Singh, Founder and Chairman of Cross Identity, about what the Identity Fabric really means and why it has become essential for modern enterprises. They discuss how legacy IAM environments evolved into siloed systems, why integration “tax” is becoming unsustainable, and how a federated, API-driven identity fabric architecture enables scalability, orchestration, and Zero Trust. You’ll learn:✅ What the Identity Fabric architecture actually is (and what it is not)✅ Why IAM silos and legacy systems create integration and security risks✅ How federated, API-based architectures improve interoperability✅ The rise of non-human identities and AI agents — and how to manage them✅ Why convergence and orchestration are critical for Zero Trust✅ How organizations can transition from fragmented IAM to a fabric model Whether you are a CISO, IAM architect, or security leader, understanding how to evolve toward an Identity Fabric approach is critical to reducing complexity, enabling Zero Trust, and future-proofing your identity strategy.

Access recertification is one of the most disliked processes in Identity & Access Management, and for good reason. In this episode, Matthias Reinwarth and Martin Kuppinger challenge the way organizations approach access reviews. Instead of endlessly optimizing broken campaigns, they ask a more fundamental question: What if we eliminated most of recertification altogether? Key topics:✅ Why traditional access certification campaigns fail✅ How overengineered role models create complexity and “rubber stamping”✅ Why 80–90% of entitlements can be automated via policy✅ How time-limited access dramatically reduces review effort✅ Where AI and usage analytics can safely remove unused permissions✅ Why static entitlements and standing privileges are the real root cause✅ How modern authorization (e.g., externalized policy models) changes the game The discussion also touches on the 50-year legacy of IBM RACF and why we still haven’t fully embraced externalized authorization — despite knowing better since 1976. If you struggle with 70-page access review PDFs, role explosion, or endless recertification campaigns, this episode offers practical, implementable guidance — much of it possible with capabilities you already have in place.

Shadow IT has evolved. Now it’s Shadow SaaS. Shadow AI. And it’s everywhere. In this week's episode of the KuppingerCole Analyst Chat, Matthias welcomes Matthew Gardiner for his first appearance to unpack one of the fastest-growing security domains: SaaS Security Posture Management (SSPM) and why that name may already be too narrow. Today’s organizations run on hundreds of SaaS applications. Many are sanctioned. Many aren’t. Some are connected via OAuth. Others are quietly leaking data through AI tools. And most security teams don’t have full visibility. In this conversation, we explore:✅ What SSPM actually means (and why the “PM” might be limiting)✅ How Shadow IT evolved into Shadow SaaS and Shadow AI✅ The intersection of identity and cybersecurity in SaaS environments✅ Misconfiguration risks, MFA bypass, OAuth sprawl & SaaS drift✅ Why continuous monitoring beats periodic audits✅ CASB vs SSPM vs CNAPP — where the lines blur✅ The growing governance challenge in AI-powered SaaS✅ Why SaaS security can’t be ignored anymore If your organization uses SaaS (spoiler: it does), this discussion is not optional.

Decentralized identity is moving from concept to reality, driven by the upcoming EU Digital Identity (EUDI) Wallet! But can digital identity truly become something we trust? Join us in this Road to EIC episode of the KuppingerCole Analyst Chat where Matthias speaks with Martin Kuppinger about what decentralized identity actually means, how EUDI Wallets work, and why their success depends on real business value. Tune in to learn how verifiable credentials, issuer-holder-verifier models, and privacy-preserving architectures could fundamentally reshape authentication, onboarding, and digital transactions across Europe. You’ll learn:✅ What decentralized identity and verifiable credentials actually are✅ How the EUDI Wallet changes control over personal data✅ Why trust depends on implementation, not just technology✅ The difference between mandatory use cases and real adoption✅ How businesses can reduce costs and streamline processes✅ Why success requires compelling everyday use scenarios✅ What organizations should do now to prepare Beyond government interactions, the real potential lies in transforming complex business processes, from onboarding and compliance to loans, contracts, and digital transactions using trusted, reusable identity data. The EUDI Wallet isn’t just a new login method, it’s foundational infrastructure for Europe’s digital economy. Watch now to understand what decentralized identity means for enterprises, citizens, and the future of trust online.

Authorization is changing, moving from static roles and provisioning to dynamic, real-time, policy-based decisions. But without standardization, modern authorization quickly becomes fragmented and unmanageable. In this episode of the Analyst Chat, Matthias Reinwarth is joined by David Brossard, contributor and co-chair of the OpenID AuthZEN Working Group, and Phillip Messerschmidt, Lead Advisor at KuppingerCole, to discuss how authorization is evolving — and why AuthZEN is a critical missing standard. You’ll learn:✅ Why RBAC is still relevant, but no longer sufficient on its own✅ How ABAC and PBAC address scalability, context, and dynamic access✅ Why role explosion and authorization silos limit visibility and governance✅ How runtime, continuous authorization supports Zero Trust architectures✅ What AuthZEN standardizes — and what it deliberately does not✅ How externalized authorization improves auditability and compliance✅ Why CISOs and architects should start asking vendors for AuthZEN support✅ How AuthZEN fits into the Identity Fabric and Road to EIC vision Authentication has been standardized for years — authorization is finally catching up. Watch now to understand how AuthZEN enables scalable, future-proof authorization for modern applications, APIs, and identity fabrics.

Quantum computing isn’t just a future threat to encryption, it’s a direct risk to identity and authentication. In this week's episode, Matthias is joined by Jonathan Care to explore why identity is the quantum bullseye and what organizations must do now to prepare for a post-quantum world. You’ll learn: ✅ Why authentication protocols depend entirely on cryptography✅ How “harvest now, decrypt later” (HNDL) already puts identity data at risk✅ Why identity, not data encryption, is the weakest point in a quantum future✅ What post-quantum cryptography standards (FIPS 203, 204, 205) change — and what they don’t✅ How Passkeys and FIDO2 are quietly becoming post-quantum ready✅ Why PKI, certificates, federation, and non-human identities face massive scale challenges✅ What crypto agility really means for IAM and Zero Trust✅ A practical 4-phase roadmap for CISOs to start preparing today  The biggest risk isn’t a future quantum computer — it’s the long-lived certificates and identity data issued today.

Zero Trust isn’t dead, it’s evolving. In this week's episode, Matthias Reinwarth joins Alexei Balaganski to explore why Zero Trust Network Access (ZTNA) is no longer enough and how Zero Trust Platforms are emerging as the next evolution of modern security architecture. In this episode, we explore: ✅ Why Zero Trust is a strategy, not a product✅ The limitations of ZTNA in modern hybrid and cloud environments✅ What defines a Zero Trust Platform✅ Universal access enforcement across human and non-human identities✅ Continuous trust evaluation and intelligent segmentation✅ Unified visibility, analytics, and policy enforcement✅ How vendors and organizations should think about Zero Trust moving forward 🚀 If you care about identity, cybersecurity, AI risk, or future-proof security architectures, this conversation is for you.

AM and cybersecurity programs are under increasing pressure — not just from new threats, but from operational complexity, regulation, and organizational reality. This episode of the KuppingerCole Analyst Chat shifts the focus from analyst predictions to the perspective of end-user organizations and their real-world challenges in IAM and cybersecurity. Matthias Reinwarth speaks with Reiner Mertens and Charlene Spasic, KC Advisors with a focus on identity strategy, governance, and enterprise programs, specializing in IAM transformation and advisory practice. The discussion goes beyond technology to cover organizational aspects such as governance, compliance, processes, and policies, as well as the implications of modern Target Operating Models. You’ll learn:✅ Why operability is the biggest IAM challenge for many organizations✅ How unclear ownership and overlapping responsibilities undermine IAM success✅ Why IGA modernization is rarely a one-off project — but a long-term program✅ How Privileged Access Management (PAM) is evolving beyond password vaulting✅ The growing importance of non-human identities (NHIs) and automation✅ How regulation (NIS2, DORA) increases urgency — but doesn’t replace good architecture✅ Why data quality, governance, and business alignment are foundational to IAM Rather than making abstract predictions, this episode focuses on real patterns, structural issues, and practical improvements advisors see across industries. Watch now to understand how IAM, PAM, governance, and identity architecture must evolve in 2026 and beyond.

Cybersecurity and AI are evolving faster than ever, and 2026 is already proving that traditional predictions may no longer be enough. In this year's first episode of the Analyst Chat, Matthias Reinwarth is joined by Jonathan Care and Alexei Balaganski to attempt looking into some predictions for the coming year. Join to find out what organizations should realistically prepare for in cybersecurity and AI in 2026! You’ll learn:✅ Why traditional cybersecurity predictions are becoming less reliable✅ How geopolitical, economic, and societal shifts are shaping cyber risk✅ Whether cybersecurity can exist without AI — and where AI actually fits✅ Why governance, accountability, and responsibility matter more than tools✅ What’s flying under the radar in AI and cybersecurity today✅ The risks of AI hype, long-lived permissions, and autonomous agents✅ Why agility and resilience should be your cybersecurity mantra for 2026 📌 This discussion focuses on patterns, risks, and preparation strategies security leaders should consider as AI and cyber threats continue to accelerate.🔒 Watch now to understand how to think critically about AI, cybersecurity, governance, and resilience in 2026.

Every so often, the digital world gets a reminder that “The Cloud” is not a magical, omnipresent entity but just another complex socio-technical system operated by humans. Electricity usually comes from the socket, networks usually work, and cloud services are marketed as being always on… Until they are not. Recent outages expose inherent vulnerabilities, threatening global digital infrastructure. Learn why resilience and diversification are critical. Read the original blog post here: https://www.kuppingercole.com/blog/balaganski/platform-dependence-growing-fragility

Web scraping has entered a new era and AI is changing everything. In this videocast, Osman Celik speaks with Dmitriy Loshakov from QRator Labs to explore how automated data collection has evolved from simple crawling into highly adaptive, human-like scraping attacks that operate invisibly. You’ll learn: ✅ What web scraping actually is (and why not all scraping is malicious)✅ How AI-powered scrapers mimic real user behavior with mouse movements, delays & clicks✅ Why classic defenses like CAPTCHAs and JS challenges no longer stop modern bots✅ The industries hit hardest — from e-commerce and travel to betting, finance, and media✅ How organizations can defend themselves using behavioral analysis & intent detection✅ Why the future of cybersecurity is officially AI vs. AI 📉 With intelligent scrapers bypassing most legacy defenses and blending in with real users, organizations must rethink how they detect and mitigate automated threats. 🔒 Watch now to understand how to protect your data, your users, and your business from today’s invisible AI-driven bots.

What happens when a single platform outage impacts half the internet? This week, Matthias Reinwarth is joined by Martin Kuppinger and Alexei Balaganski to analyze the recent Cloudflare disruption and what it means for modern digital infrastructure. 🔑 Key Topics Covered: ✅ What happened during the Cloudflare outage and why it was so disruptive✅ How platformization and consolidation increased systemic risk✅ The shift from decentralized internet ideals to dependency on global platforms✅ Lock-in challenges: hyperscalers, CDNs, and cloud services✅ Understanding the hidden risks of convenience and integration✅ Why organizations neglect risk management and how to correct it✅ Business impact analysis: mapping critical services and dependencies✅ How to architect for resilience, failover, and exit strategies 💡 Your Next Step: Evaluate your digital supply chain, map your dependencies, and identify where platform concentration creates unacceptable business risk. Small architectural decisions today can dramatically reduce the impact of tomorrow’s outages.

What will Identity and Access Management (IAM) look like in 2026? In this episode of the KuppingerCole Analyst Chat, Matthias Reinwarth, Jonathan Care, and Martin Kuppinger discuss the key trends, challenges, and innovations shaping the future of IAM. Key Topics Covered: ✅ Emerging IAM threats: AI agents with broad system access✅ Managing the IAM tool zoo and avoiding integration chaos✅ Identity Fabric: building a flexible, future-proof IAM architecture✅ Continuous and passwordless authentication: improving security and user experience✅ Automation and orchestration: reducing human intervention in IAM processes✅ Shared signals, data-driven decisions, and overcoming alert fatigue✅ Preparing for non-human and agentic AI identities 💡 Stay ahead in IAM by evaluating your organization’s readiness for AI-driven identities, passwordless authentication, and automated governance. Use these insights to plan your 2026 IAM strategy and ensure your tools, processes, and policies are prepared for the next wave of innovation.

Web application threats are evolving — and modern WAAP solutions must do far more than traditional WAFs ever could. In this video, Osman Celik speaks again with Andrey Leskin from QRator Labs to explore the capabilities organizations need to protect their web applications, APIs, and users from today’s most advanced threats. You’ll learn: ✅ The three core threat vectors: DDoS attacks, web application attacks, and malicious bots✅ Why traditional WAFs are no longer enough to protect modern applications✅ How WAAP solutions combine WAF, bot mitigation, API protection, and DDoS defense✅ How attackers use low-and-slow techniques, scraping, and AI-driven bots to mimic real users✅ Why half of all internet traffic is bots — and how to distinguish good bots from malicious ones✅ How QRator Labs unifies Anti-DDoS, WAF, and Anti-Bot into a single platform and single point of truth 📈 With automated attacks, scraping, and bot-driven abuse increasing across every industry, organizations need a holistic approach to defending their web applications. 🔒 Watch now to learn how WAAP, WAF, Anti-Bot, and DDoS mitigation come together in one platform to protect your business.

Is Apple's Digital ID Wallet truly a game changer, or are we missing the bigger picture? In this episode of the KuppingerCole Analyst Chat, Matthias Reinwarth and Martin Kuppinger talk about Apple's announcement of digital IDs in Apple Wallet and what it means for the future of digital identity. 🔑 Key Topics Covered: Apple's Digital ID implementation in selected US states The fundamental difference between ID cards and verifiable credentials Why current wallet solutions fall short of their potential Real-world use cases: employee onboarding and bank loan automation The device-bound limitation problem Standards and interoperability (mDoc, ISO, FIDO) How enterprises should prepare for multiple wallet ecosystems Comparison with EUDI Wallet and other digital identity initiatives 💡 Expert Insights: Martin Kuppinger explains why the real value of digital identity wallets lies far beyond simple ID verification, exploring complex scenarios involving hundreds or thousands of verifiable credentials for business process automation.

In this week's episode, Matthias Reinwarth and Alexei Balaganski discuss the growing importance of AI Data Provenance. The conversation explores why provenance is distinct from traditional logging, the operational gaps between ML engineering practices and regulatory expectations, and the regulatory context driving these requirements. They get into the risks of attempting to retrofit governance after AI systems are already deployed and explain why provenance must be built directly into data and model workflows.  Key Topics Covered:✅ AI data provenance is a new and urgent issue.✅ Low-quality data leads to poor AI outcomes.✅ Auditing and compliance are essential for AI systems.✅ Organizations must establish governance for AI data.✅ Data catalogs and traceability are foundational.✅ Prepare for AI regulations like GDPR.✅ Start small and apply a risk-based approach.✅ Never trust, always verify your data sources.

IT governance isn’t just paperwork anymore, it’s becoming a critical foundation for how modern organizations operate, stay secure, and stay compliant. This week, Matthias Reinwarth is joined by advisors Kai Boschert and Patrick Teichmann to break down what effective IT governance actually looks like in 2025. Together, they unpack: ✅ What IT governance really is — and how it bridges strategy and operations✅ The differences (and overlaps) between strategy, governance, and compliance✅ Why the “1.5 line of defense” model helps close crucial gaps✅ The role of target operating models in making governance work at scale✅ How to bring stakeholders, processes, and tools together effectively✅ Practical steps to start improving governance today — without boiling the ocean Whether you’re shaping governance for a large enterprise or just beginning to formalize your processes, this conversation delivers real-world insights from active advisory work with end-user organizations.

The holiday season might be the most wonderful time of the year—but it’s also prime time for cybercriminals. In this Videocast episode, Warwick Ashford talks with Danny Jenkins, CEO and co-founder of ThreatLocker, about why attacks spike between November and December and what companies can do to stay protected. They unpack: ✅ Why cyberattacks surge during holidays✅ How to close your organization’s biggest security gaps✅ The importance of automated responses and real-time monitoring✅ Why good backups (and tested restores!) still matter✅ How a “cyber health check” can save your business from disaster 📈 Whether you’re a security professional or a business leader, these insights will help you strengthen your defenses during the holidays and beyond.

The fragmentation of enterprise identity systems is creating real security risks but IPSIE is here to simplify and standardize. In this episode, Matthias Reinwarth and Warwick Ashford explore IPSIE (Interoperability Profiling for Secure Identity in the Enterprise), how it improves interoperability, enforces secure defaults, and provides measurable maturity levels for enterprise identity management. 🔹 Key Topics Covered: ✅ What IPSIE is and why it matters for enterprise identity 🧠✅ How fragmentation of SaaS and cloud identity systems increases risk✅ Opinionated profiles and secure, consistent standard implementation✅ Maturity levels for session lifecycle, account lifecycle, and entitlements✅ How IPSIE fits into the broader Identity Fabric strategy✅ Current limitations: focus on human identities and next steps for non-human accounts 💡 IPSIE doesn’t reinvent identity standards, it helps organizations implement what they already have consistently and securely, creating a foundation for stronger enterprise security.

The future of Identity and Access Management (IAM) is already being built — but are we preparing for 2040? In this episode, Matthias Reinwarth and Martin Kuppinger explore how organizations can design future-ready identity fabrics, avoid tool sprawl, and build the platformized IAM architectures needed to thrive in a fast-changing digital landscape. Key Topics Covered: ✅ What the “Identity Fabric 2040” means for IAM strategies 🧠✅ The rise of orchestration, signals & API-first design✅ Avoiding IAM tool sprawl and capability duplication✅ Platformization vs. best-of-breed: what really works?✅ Why outcome-driven IAM is the only sustainable approach✅ How signals redefine authentication, authorization & user experience 💡 Your IAM decisions today shape the next 15 years. Are you building for 2040—or already falling behind?