IAM (Identity and Access Management)

IAM covers the full lifecycle of a digital identity: provisioning an account when someone joins, adjusting its access as their role changes, and — the step that gets skipped most often — deprovisioning it promptly when they leave or a vendor relationship ends. Authentication (verifying who's logging in) and authorization (deciding what they can then do) are the two halves of the same problem, usually handled by related but distinct systems.

A stale account is one of the most common, and most preventable, paths into an environment — an ex-employee's login that was never disabled, or a vendor's access that outlived the contract, doesn't need a sophisticated exploit, just someone who still remembers the password.

For an organization working across many separate SaaS tools, IAM sprawl becomes an operational problem on its own — the same person might need an account provisioned and later deprovisioned in a dozen different systems, each with its own process, which is exactly the gap SSO and centralized identity providers are built to close.