Q&A: How Protiviti’s Identropy Acquisition Meets Growing Identity and Access Management Demands

by Annie Kennedy, SAPinsider

In the past year, a global shift to remote working and transformations to digital environments have amplified business’ need for more efficient and secure access governance. SAPinsider spoke with management and technology consulting firm Protiviti about how their recent acquisition of Identropy, which specializes in identity and access management (IAM), can help organizations address those concerns. In this interview, Protiviti Technology Consulting Managing Directors Aric Quinones, SAP Practice Lead; Terry Jost, Security and Privacy Segment Lead; and Victor Barris, Digital Identity Lead (and co-founder of Identropy) share with SAPinsider how Identropy’s integration into Protiviti is helping organizations enable their IAM and cybersecurity services.

Q: What led to Protiviti making this acquisition?

A: IAM has been a key component for satisfying business needs and requirements. Protiviti was already familiar with Identropy’s technology and architectural depth. We saw an immediate opportunity to build upon and be able to combine the companies’ intellectual property and talent and launch more robust services for clients. The acquisition also expands Protiviti’s ecosystem with major alliance partners in the identity world. Digital identity is no longer optional if you’re constructing large digital apps — identity is emerging as a domain in and of itself. At the same time, Identropy was seeing these same trends moving at an unprecedented rate due to identity being at the center of digital transformation initiatives. Identropy had been viewed as a mid-sized boutique and knew that scale would be a constraint, so they found the opportunity to join Protiviti a natural fit.

Q: How will Identropy’s identity and access management expertise help Protiviti better meet customer needs?

A: The pandemic redefined the future of work, and accelerating digital transformations are amplifying a need for systems that are not siloed. These factors, along with enterprise workflows recharting what industry ecosystems look like, were tremendous drivers for Protiviti to help clients understand the importance of identity and access management. It all started with questions about data: What can we do with someone’s data? Why is it there? What identity is associated with it? These questions drove Protiviti to start supplying smart technology for digital identity management and contributing to the construction and value of digital apps. If you think about how the past 9-12 months have created fragmentation, the complexity of security is magnified in a more virtual world going forward. It is more important than ever to manage identities quickly and efficiently, whether at the app layer, network layer, or database and operating system layers. Having the skills to help clients using any platform has become important to managing risk appropriately.

Q: Can you share your thoughts on current trends and issues in identity and access management? Why is IAM so challenging for organizations?

A: In the past, larger organizations like Oracle and IBM had solutions which required heavy lifting, with a great deal of complexity and customization contributing to long and costly projects. Over the years, a fleet of mid-sized companies came to the marketplace with more efficient frameworks and made it easier for solutions to be consumed, presenting an opportunity for specialized firms like ours to deliver with better ROIs. Now, due to the contemporary nature of implementations, there is again complexity. Technology has become robust and scales well, but it requires expertise to deploy it efficiently and address business enablement and regulatory requirements. There is a tremendous shortage of qualified talent to be found, hired, and retrained. Combined with an increase in demand for IAM, that skilled labor shortage is putting a stress point on organizations across most industry segments.  Companies are realizing that they must make access changes very quickly — such as when hiring thousands of workers for an online distribution center or changing wholesale distribution to another country — and businesses need to manage risk and compliance efficiently with appropriate identity management to manage larger volumes of onboarding and offboarding.

Q: What does this acquisition mean for SAP customers? What will they better be able to achieve as a result?

A: The SAP ecosystem is complex. In the past, people thought of SAP as an ERP company, but if you really understand it, it can be anything — it has business intelligence products, the SAP S/4HANA solution for central finance, SAP Analytics Cloud, and all of the functions of products like SAP Ariba, SAP SuccessFactors, and SAP Concur. Then you combine those large ecosystems with the complexities of a security role management framework to govern them, and you have a daunting conversation for customers. This acquisition allows us to work with clients using both SAP and non-SAP software to understand and streamline IAM processes, choose the best tools, consider management approval process, set up multiple tiers across an organization, automate offboarding if needed, create a greater user experience, and meet ever-changing regulation requirements. These things are all incredibly important in this COVID-19 world, and an influx of Identropy talent from this acquisition will increase Protiviti’s ability to meet those needs for clients.

Q: How does this acquisition complement and extend SAP offerings?

A: SAP’s access management products are varied, from SAP Access Control in the GRC suite and SAP Cloud Identity and Access Governance to manage end-to-end and SAP HANA security, as well as SAP Enterprise Threat Detection and solution extensions such as SAP Access Violation Management by Greenlight. Pre-built integrations for identity access governance and cloud identity and privileged access management can deliver an end-to-end service to any organization, whether they are seeking databases, cross-application operating systems, cloud versus on premise, or national or global regulatory compliance. The extension of SAP in the IAM space and the work we can offer in digital identity management is going to create interesting opportunities for mining data, specifically entitlement data. When you think of it, large banks could have literally billions of entitlements making up the population of identities for all of their constituents accessing financial data. SAP will probably always be the workhorse managing the internal operations of an arm of an organization, but we have questions on the front end to ask about identity, considering how many households now have products like Alexa or Echo. Should a refrigerator have an identity? A car? What if they had multiple identities? These home and consumer devices represent a fraction of the various units within plants and offices that businesses are working with. We have incredible data management resources with tools like SAP HANA, and after acquiring Identropy’s expertise, we are well positioned to answer a lot of these questions and help companies manage security going forward.