The Identity Chapter of a Security Program, in Plain Budget Terms
Identity is usually the biggest line in a security budget and the one a CFO understands least. Four cost centres, what each one actually buys, and how to defend the total.
For
New CISO
You have taken a security leadership seat and inherited a stack, a budget, and a set of commitments you did not make. The first decisions are about what to keep, what to fund, and what to stop.
These pieces are the decision mechanics rather than a maturity model: how evaluations reach a conclusion, what actually creates a budget line, how to sequence identity spend, and how to retire something without leaving a hole.
11 pieces
IGA, PAM, or ITDR First?
Three identity categories compete for the same budget line and vendors in each will tell you theirs comes first. The sequence is decided by which failure you can already evidence.
Killing a Tool: The Murder Board Nobody Runs
Security teams buy well and retire badly, which is how a stack reaches thirty tools. A murder board is the two-hour structure that makes a retirement decision defensible before it happens.
Non-Human Identity Is a Governance Problem Before It Is a Tooling Problem
Buy a non-human identity tool first and you get a list of eleven thousand identities nobody owns. The ownership decision has to come before the discovery, and it is unglamorous policy work.
Should You Run a POC or Trust the Reference Call?
A proof of concept costs weeks of engineering time you are not accounting for. Two good reference calls cost ninety minutes. The choice turns on one question: is the failure you care about visible from outside?
Product Security and Corporate Security Are Different Jobs
A software company runs two security programs and funds them as one line. They have different customers, different failure modes, and different people, and merging them starves one of them.
How to Run a Security Evaluation That Actually Decides
Most security evaluations do not end in a bad purchase. They end in no purchase, six months later, with nobody able to say what happened. The failure is procedural, and it is fixable in the first two weeks.
The Cost of Identity Debt at Scale
Identity debt never arrives as a security incident. It arrives as onboarding that takes nine days, an audit finding that recurs, and a migration estimated at one quarter that takes three.
The 30-Day Security Tool Rationalization Playbook
58% of organizations run more than 25 security tools. This is the four-week program for finding the overlap, deciding what goes, and freeing budget without creating a hole.
What Auditors Actually Test in Identity
Auditors do not evaluate your identity architecture. They pick names off a list and ask you to prove what happened. Elegant design earns nothing if the record is missing.
What Actually Triggers a Security Budget Line
New security spend is almost never caused by a persuasive case. It is caused by an event with a date on it. Knowing which five events do it changes when you ask, not how.