IAM (Identity and Access Management) is the set of processes, policies, and technologies organisations use to manage digital identities and control access to systems, applications, and data. The classic definition: ensure that the right people have the right access to the right resources at the right time, for the right reasons. Modern IAM covers employees, contractors, customers, partners, and machine identities (services, APIs, IoT devices). IAM is the foundation of Zero Trust — without strong identity, network controls alone can't enforce security. Mature IAM combines authentication (login + MFA), authorisation (role/policy-based), provisioning (joiner-mover-leaver), governance (access reviews, certifications), and privileged access management (admin accounts).

Six core components: (1) **Authentication** — proves who the user is (password + MFA, FIDO2, passkeys, biometric), (2) **Authorisation** — decides what they can do (RBAC, ABAC, conditional access), (3) **Identity Governance and Administration (IGA)** — lifecycle: provisioning, modifications, de-provisioning, access reviews, certifications, segregation of duties, (4) **Privileged Access Management (PAM)** — specialised for admin/root accounts: vaulting, just-in-time access, session recording, (5) **Single Sign-On (SSO) and Federation** — SAML/OIDC enabling one login across many apps, (6) **Customer Identity and Access Management (CIAM)** — different requirements: scale, social login, B2B/B2C, marketing integration. Modern IAM platforms unify these or specialise in one.

Five market leaders: (1) **Microsoft Entra ID** (formerly Azure AD) — built into M365, broadest enterprise reach, strong conditional access, integrated with Defender, (2) **Okta** — independent identity leader, broadest pre-integrated app catalogue (8000+), strong B2B + Workforce Identity Cloud, (3) **Ping Identity** — strong in financial services and large enterprise, customer + workforce, (4) **ForgeRock** — enterprise-grade, particularly strong in CIAM, (5) **Auth0** (now part of Okta) — developer-first, popular for SaaS apps. For PAM: CyberArk, BeyondTrust, Delinea. For IGA: Saviynt, SailPoint. For CIAM: Auth0, Microsoft Entra External ID, Curity. Open-source: Keycloak (Red Hat), Authentik, ZITADEL. Cloud-specific IAM: AWS IAM, Azure RBAC, Google Cloud IAM (separate from Workforce IAM). Selection depends on existing stack and scale.

Zero Trust principle 'never trust, always verify' relies entirely on IAM to verify *who* the user is and *what* they should access. Five ways IAM enables Zero Trust: (1) **Strong identity** — phishing-resistant MFA, passkeys, conditional access, (2) **Continuous verification** — risk-based authentication, session monitoring, re-prompt for sensitive actions, (3) **Least privilege** — fine-grained permissions per user/group/role; PAM for elevated access, (4) **Policy-based access** — attribute-based rules (ABAC) considering user, device, location, time, behaviour, (5) **Comprehensive audit** — every access decision logged for SIEM/XDR. Without strong IAM, network segmentation and EDR can't enforce Zero Trust. Mature Zero Trust roadmaps prioritise IAM first — it delivers the highest immediate security improvement.

Three related but distinct identity categories: (1) **IAM (Identity and Access Management)** — broadest umbrella; manages all identities and their access; covers authentication and authorisation. Vendors: Microsoft Entra ID, Okta, (2) **IGA (Identity Governance and Administration)** — focused on the *lifecycle* of identities: provisioning, de-provisioning, access reviews, certifications, segregation of duties, role mining. Vendors: Saviynt, SailPoint, Microsoft Entra ID Governance, (3) **PAM (Privileged Access Management)** — specialised for accounts with elevated permissions; vaulting, JIT access, session recording. Vendors: CyberArk, BeyondTrust. Mature programmes use all three; mid-market often combines IAM + IGA in a single platform. PAM is usually procured separately due to depth requirements.

Eight-phase roadmap (typical 18-36 months for enterprise): (1) **Inventory** — every application, every user type, current authentication mechanisms, (2) **IdP foundation** — choose Microsoft Entra ID, Okta, or Ping; federate everything possible via SAML/OIDC, (3) **MFA enforcement** — phishing-resistant MFA (FIDO2, passkeys) on every account, (4) **Joiner-Mover-Leaver (JML)** automation — HR-driven provisioning and de-provisioning via SCIM, (5) **Access reviews and certifications** — periodic recertification, (6) **PAM rollout** — vault privileged credentials, JIT access for admins, (7) **CIAM** if applicable — separate platform for customer identities, (8) **Zero Trust integration** — conditional access, device posture, continuous verification. Don't try to do everything at once; prioritise MFA + IdP foundation + PAM in the first 12 months.

Six trends shaping IAM: (1) **Passwordless** — passkeys, FIDO2 going mainstream; Google, Microsoft, Apple all support; major B2B apps adding support, (2) **Identity Threat Detection and Response (ITDR)** — new category detecting identity-based attacks (Microsoft Defender for Identity, Crowdstrike Falcon Identity Protection, Silverfort), (3) **AI/ML in identity** — anomaly detection, automated access reviews, intelligent provisioning, (4) **Decentralised Identity (DID) / Verifiable Credentials** — emerging W3C standards for self-sovereign identity, (5) **Machine identities** — exploding with cloud-native, microservices, AI agents; outnumber human identities 50:1+, (6) **Identity orchestration** — platforms like Strata bridging legacy + modern IdPs, enabling gradual migration. Cyber insurance carriers and regulators (NIS2, DORA) increasingly require ITDR-class capabilities.