Editor’s note: Jane Wright is Engagement Manager and Senior Analyst with Technology Business Research.

HAMPTON, N.H. – IBM (NYSE: IBM) last week acquired privately held CrossIdeas, a provider of identity and access management (IAM) solutions. Previously, CrossIdeas’ core technology was integrated with IBM Security Identity Manager (ISIM). With this acquisition, CrossIdeas becomes an IBM company, helping accelerate time to market for delivering identity intelligence to IBM security customers.

TBR believes IBM’s acquisition of CrossIdeas will drive more customers to evaluate ISIM and other IBM IAM products. Based on IBM’s Security Systems group’s history of acquisition and integration activity, TBR expects IBM will eventually extend CrossIdeas’ technologies into other products in its security portfolio. But alternative developments and alliance and acquisition activities by competing vendors and service providers, combined with customers’ heightened expectations for streamlined IAM and analytics solutions, will challenge IBM’s ability to grow substantially in the IAM market in the coming year.

  • CrossIdeas extends IBM Security Identity Manager capabilities with identity analytics

Organizations leverage analytics technologies to improve IAM implementations, but IAM analytics projects are typically complex, sophisticated undertakings best suited for large organizations with mature security models. By acquiring CrossIdeas, IBM has made it easier for organizations to leverage the benefits of data analytics to improve their ISIM implementations.

IBM and CrossIdeas formed a technology alliance one year prior to this acquisition, but TBR observes that the integration between ISIM and CrossIdeas was not seamless. IT administrators typically use ISIM to set entitlements, and then IT or LOB managers use CrossIdeas to confirm roles and rights. Finally, IT administrators return to ISIM to perform a write-back to the asset, thus closing the loop on the IAM policy. TBR believes customers will expect a more seamless approach as they evaluate analytics-enhanced IAM solutions in the future.

  • Data analytics technologies are entering the IAM market

The IAM market has been undergoing an important shift in recent years as organizations apply big data analytics techniques to improve their analysis of security data. In many cases, organizations began with network security data, invoking analytics to derive more insightful and actionable insights from the data collected by network security devices. Now organizations are focusing their analytics lenses on their IAM data, including directory information, user roles and access activity data.

Historically, IAM implementations have been time-consuming projects, occasionally fraught with errors that required a great deal of manual intervention. The goal of applying analytics technologies to IAM data is to make the IAM process more effective, providing more appropriate and faster access decisions. Moreover, applying analytics can help organizations move from periodic, audit-driven IAM corrections to ongoing IAM refinements that are more effective in reducing organizations’ risks from unauthorized access to IT assets. CrossIdeas’ Access Analytics solution evolved to meet customer requirements to apply analytics techniques to IAM data. For example, Access Analytics uses heuristics algorithms to assign risk scores to access requests.

  • Other vendors are developing solutions and forming alliances that will pressure the IBM-CrossIdeas solution

Demand for identity analytics is still nascent, with primarily large organizations interested in adopting these technologies in a phased approach. But vendors are positioning themselves to serve this market demand, which TBR expects will become more pronounced over the next two years.

Security vendors, application vendors and service providers are developing or acquiring identity analytics technologies to extend the capabilities of their IAM products and services. CA Technologies has implemented analytics in its Identity Suite to help customers more effectively perform tasks such as privilege cleanup and role discovery. RSA acquired Aveksa for its identity management technologies one year ago, and RSA continues to enhance Aveksa through integration with its own Security Analytics solution. These initiatives will exert competitive pressure on IBM to quickly differentiate the benefits of its CrossIdeas acquisition.

Business application vendors provide identity analytics capabilities specifically designed for their application platforms. While CrossIdeas provides a risk control module for SAP users, Oracle offers its own Identity Analytics module for Oracle customers. IBM, with CrossIdeas, and other vendors will be challenged to further their integrations with key business applications and demonstrate the value of supporting multiple business application environments with a single IAM and analytics solution.

Cloud-based identity management providers have also formed alliances with security vendors to add analytics features to IAM tools. For example, SailPoint’s Identity as a Service offering is integrated with nine vendors’ security platforms. Among these, TBR believes there is a possibility that Symantec or HP will consider acquiring SailPoint to quickly accelerate their respective IAM portfolios. However, such an acquisition would be less likely than the IBM-CrossIdeas acquisition. Prior to the IBM acquisition, CrossIdeas was integrated with just one other technology partner (MetricStream, a provider of governance, risk and compliance solutions). This made CrossIdeas a relatively straightforward acquisition for IBM because there was only one other multivendor relationship that needed to be addressed. Because SailPoint maintains technology alliances with many major vendors, merger or acquisition activity around SailPoint could be more difficult to achieve.

  • With a variety of approaches to identity analytics, customers will seek guidance to achieve the benefits of stronger identity insights

IBM’s acquisition of CrossIdeas creates a simpler model for IBM customers to benefit from more meaningful insights into their identity and access data. By providing analytics technologies integrated with IAM products and services, IBM and other vendors have extended the benefits of analytics to more organizations, although TBR expects these integrated solutions will remain in the purview of large organizations for the near future.

With so many different approaches to identity analytics, including software and services from security and application vendors and managed service providers, it will be difficult for customers to determine the appropriate evaluation criteria for comparing the available solutions. To emerge as a leader in the identity analytics market, IBM with CrossIdeas and other vendors and service providers must educate the market on the relevant and realistic use cases, features and costs for an effective identity analytics project.

IBM completed its acquisition of CrossIdeas on July 31, 2014. Financial terms of the deal were not disclosed.

(C) Technology Business Research