It’s truly universal: if you require your workforce, customers, patients, citizens, constituents, students, teachers… anyone, to register before digitally accessing information or buying goods or services, you are enabling that interaction with identity and access management (IAM).

Many IAM vendors talk about how IAM solutions can be an enabler for productivity, about the return on investment (ROI) that can be achieved after successfully rolling out an identity strategy. They all talk about reduction in friction, improving users’ perception of the value of the IAM platform. But how do you measure the business enablement of IAM? Is the cost of a Service Desk call really the $75? And how do you measure customer satisfaction during an authentication journey?

IAM programs tend to penetrate the entire organization resulting in many business-side stakeholders bringing disparate requirements to the table. Talking to those stakeholders in technical terms is a sure-fire way of getting them to switch off and disengage. Statements like “OIDC SSO followed by FIDO2 auth will revolutionize your user journeys” will be returned with a blank expression (at best). A re-framing of the message such as “re-use of existing credentials in order to reduce the footprint of passwords combined with a simple fingerprint swipe will remove user frustration and improve your security standpoint” may be more meaningful. But can the value of these capabilities be measured? Yes, they can.

What should you measure?

Like everything in life, doing a good job is not enough. The evidence of your doing a good job has to be visible, tangible. Capturing the reduction in number of password reset calls received by the Help Desk is a good start, but there are other simple and powerful metrics for measuring the value of an IAM platform, including:

  • Timeliness of identity life-cycle activities (particularly Joiner & Leaver actions)
  • Speed of onboarding applications into both IGA and AM integration patterns
  • Number of successful automated provisioning/deprovisioning actions based on policy rather than manual requests
  • Certification/Attestation campaign effectiveness including speed of reviewer responses, number of deprovisioning actions executed, and the overall reduction in security exposure as a result of entitlements being removed
  • Number of failed registration attempts (or put more positively, the increased effectiveness of onboarding and registering new users)
  • The overall number of entitlements assigned before and after rollout of the IAM service (with the hope that there is a reduction in entitlement drag because policies, mover processes, and certification campaigns are effective)
  • Risks identified, categorized by mitigating controls assigned, and the speed of remediation

These metrics, combined with basic measurements, can provide real insight into the effectiveness of the IAM platform and can provide a visual representation that will be meaningful to all stakeholders.

Note that there are other basic measurements for providing both IAM scope and output, including (A) total number of accounts, (B) accounts split by owner type, (C) accounts split by active/inactive state, (D) account dormancy levels, (E) logins, (F) logoffs, (G) number of visits, (H) number of pages visited per session, and (I) number of journey abandonments, etc.

And of course, there is always room for non-tangible measurements such as user satisfaction across the various user communities, whether that is end-user, stakeholder, administrator, or application developer.

Know what you’ll measure, before you invest

Modernizing and consolidating IAM platforms doesn’t come cheap (although it’s definitely cheaper than it used to be). The ROI might be quantifiable for certain user actions, but the likelihood is that the benefit of any IAM platform may be more difficult to quantify in monetary terms.

Determining the measurements that will be critical for your business and your stakeholders should be done prior to any investment in technology — how else will you know that you have achieved your aims?

Learn more about IBM Security Verify here.

More from Identity & Access

From federation to fabric: IAM’s evolution

15 min read - In the modern day, we’ve come to expect that our various applications can share our identity information with one another. Most of our core systems federate seamlessly and bi-directionally. This means that you can quite easily register and log in to a given service with the user account from another service or even invert that process (technically possible, not always advisable). But what is the next step in our evolution towards greater interoperability between our applications, services and systems?Identity and…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Web injections are back on the rise: 40+ banks affected by new malware campaign

8 min read - Web injections, a favored technique employed by various banking trojans, have been a persistent threat in the realm of cyberattacks. These malicious injections enable cyber criminals to manipulate data exchanges between users and web browsers, potentially compromising sensitive information. In March 2023, security researchers at IBM Security Trusteer uncovered a new malware campaign using JavaScript web injections. This new campaign is widespread and particularly evasive, with historical indicators of compromise (IOCs) suggesting a possible connection to DanaBot — although we…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today