IAM history: the four waves

Three layers in one console

On his first day as IAM lead at a manufacturer that has been around for thirty years, Daniel opens the admin consoles and finds three things living side by side. A provisioning tool nobody remembers installing, which “has always been there”. An access-review process that started after an external audit and that managers complain about every quarter. And a recent project to roll out MFA to everyone, which keeps stalling. At first it looks like clutter. A week later he sees it differently: each of those three things belongs to a different period in the history of IAM, and each one answered the question the industry was asking at the time.

That’s the reason to know the history. Without it, an organization’s IAM looks like noise. With it, you see layers, like rock strata, and you can predict with surprising accuracy which problems the organization has today and which it will have next.

This article walks through the four waves that took IAM from a modest IT cost-saving project in the 1990s to the identity security discipline of today. Each wave answered a crisis or a new pressure from outside, and each left behind practices, products and decisions that are still around us. One of the most revealing questions you can ask when you join a new organization is simply: “which wave is this place in?”

The four waves at a glance

IAM grew in four overlapping waves: IT optimization, to cut costs; governance, to pass audits; security, to stop breaches; and identity security, to treat identity as one control plane. None of them replaced the one before; each sat on top of it.

timeline
  accTitle: Four waves of IAM from 1990 to present
  accDescr: A timeline showing four successive waves of IAM. IT optimization from 1990 to 2005 with SSO and basic provisioning, governance from 2005 to 2015 with IGA and regulatory compliance, security from 2015 to 2022 with MFA, PAM and Zero Trust, and identity security from 2022 to the present with ITDR, non-human identities and AI agents.
  title The four waves of IAM (approximate dates)
  1990-2005 : Wave 1, IT optimization : SSO and basic provisioning
  2005-2015 : Wave 2, governance : IGA and regulatory compliance
  2015-2022 : Wave 3, security : MFA, PAM and Zero Trust
  2022-present : Wave 4, identity security : ITDR, NHI and AI agents

The tools of the first wave are still running. The tools of the second are the backbone of today’s compliance programs. The third wave’s tools are the daily work of a modern SOC. The fourth brings them together under a wider umbrella.

Seen from far enough away, every wave follows the same pattern. A crisis from outside puts pressure on organizations: costs, new laws, breaches, AI. New tools and practices appear to solve what the previous wave left open. Vendors emerge that become the symbol of the moment: Tivoli, SailPoint, Okta, CrowdStrike. And a few years later the answer becomes “normal”, while the next crisis starts to build. Keeping that pattern in mind helps you read industry headlines critically. When an analyst announces “the new wave of X”, they’re usually describing something that fits those four steps.

Wave 1: IT optimization (about 1990 to 2005)

In the late 1990s, medium and large companies had a simple but expensive daily problem: employees had too many usernames and passwords. Every business application, the ERP, email, the intranet, the HR system, the ticketing system, came with its own sign-in. A typical employee juggled five to fifteen accounts, with passwords they kept forgetting.

The help desk became a bottleneck. Studies at the time estimated that 30 to 40% of support tickets were password resets, and Gartner and Forrester put the cost of each reset at 25 to 70 dollars of staff time. A company of 5,000 people could be spending several million dollars a year on what was essentially a repetitive chore.

So the conversation was about IT optimization: lowering the cost of the help desk and making users more productive. Single sign-on let people sign in once to reach many applications, first through web SSO with cookies across domains and later through vendor connectors for business applications. Basic automated provisioning used scripts to create accounts in the main systems when someone joined and to disable them when they left. Self-service password reset let employees reset their own password without a ticket, by answering security questions such as “what was your first pet’s name?”. And central directories held it all together, with Microsoft’s Active Directory, launched with Windows 2000, setting the pattern and LDAP, already a standard, as its query language. The vendors of the era were Microsoft with Active Directory, Sun with Sun Identity Manager for enterprise provisioning, IBM’s Tivoli Identity Manager, Novell’s eDirectory, popular across mainframes and Unix, and Computer Associates’ eTrust Admin, one of the first identity suites.

Picture a home-appliance manufacturer in 2002, with 3,000 employees across five plants. The IT director walks into a meeting with two numbers: “last year we spent 1.8 million on the help desk, and 38% of the tickets were password resets.” The finance director asks what they’re going to do about it. The answer is to buy Sun Identity Manager, set up self-service password reset and connect every application to the company directory. Three years later tickets are down 60%, the return is obvious and nobody questions the investment. That conversation, repeated in thousands of companies, paid for the first wave.

The first wave did what it set out to do. Tickets fell and people reached their applications with less friction. But it left two large gaps. There was no governance: once access was granted, nobody checked whether it was still needed, and people piled up privileges as they moved from team to team, what we now call privilege creep. And security was an afterthought: passwords were sometimes stored without proper hashing, MFA didn’t exist and privileged accounts lived in shared spreadsheets. Those two gaps drove the next two waves. An organization whose “IAM program” today is Active Directory, a provisioning script and a password-reset portal is still, in practice, in the first wave. That isn’t an insult, and many work fine like that, but they have no governance or security coverage to speak of.

Wave 2: governance (about 2005 to 2015)

In the early 2000s a series of accounting scandals, Enron in 2001 and WorldCom in 2002, shook confidence in corporate financial reporting in the United States. The legal response was the Sarbanes-Oxley Act of 2002, SOX, which required listed companies to show working internal controls over their financial systems. Other pressures soon followed: HIPAA in healthcare, Basel II in banking and, later, the GDPR for privacy in Europe.

The question changed overnight. It was no longer “how do we spend less on the help desk?” but “who has access to which financial systems, who approved it and when, is it still needed, can anyone both record and approve the same payment, which is a textbook fraud setup, and how do we prove all of that to an external auditor?”. The tools of the first wave couldn’t answer, because they were built to create accounts, not to keep an eye on them.

A new category was born to answer those questions with evidence: IGA, identity governance and administration. Its pieces became standard. Access certification, where every quarter or half-year managers or application owners review their people’s access and approve or revoke it. Access requests with approval workflows, where any new access goes through a request, the manager’s approval and sometimes the application owner’s review. Separation of duties, rules that detect toxic combinations of permissions, with “create a supplier and approve a payment” in SAP as the classic combination SOX went after. Continuous audit, a log of every change in access that can be handed to the auditors. And role modeling, grouping permissions into business roles such as “accounts analyst” instead of managing them one by one. SailPoint, founded in 2005, led the category for years with IdentityIQ; Aveksa, also from 2005 and bought by RSA in 2013, pioneered access certification; Courion repositioned itself around access risk; Oracle offered Identity Manager inside its suite; and Saviynt, founded in 2010, was the first to be born with the cloud in mind.

Anyone who worked at a listed company in those years knows the words “certification campaign”. For two weeks or a month, every manager received the list of their team’s access and had to approve or revoke it line by line in an IGA tool. It was tedious, people resisted it, and many managers ended up clicking “approve all” just to finish on time. That experience had two lasting effects. Identity governance became a serious project inside IT, and modern identity programs were born there. And the industry learned that certifying everything without context didn’t work very well, which planted the seed of the risk-based reviews of the fourth wave.

IGA was very good at answering “who has access to what, and why?”, but it left gaps of its own. It didn’t spot misuse: someone with legitimate access who abused it raised no alarm, and separation of duties caught toxic combinations, not actual malicious activity. It was built for employees, so service accounts, machine identities and external customers stayed out. And the cloud was a blind spot, because many traditional IGA platforms struggled to connect to the SaaS applications that were spreading at the same time. The biggest trap of the second wave is believing that passing the audit means being secure. An organization can pass SOX every year and still be breached through leaked credentials; meeting a control isn’t the same as being protected.

Wave 3: security (about 2015 to 2022)

Between 2013 and 2017 a wave of breaches changed the conversation across the industry. At Target in 2013, 40 million credit cards were stolen, and the way in was the credentials of an air-conditioning contractor. At the US Office of Personnel Management in 2015, 21.5 million records of federal employees were exposed, including security clearance files, through stolen valid credentials. At Anthem in 2015, 78.8 million medical records were taken after spear phishing aimed at an administrator. At Equifax in 2017, 147 million people were affected; the first step was an Apache Struts vulnerability, but the attacker moved around using internal credentials. And at Marriott, disclosed in 2018, data on 500 million guests was exposed after four years of persistent access.

The pattern was plain: attackers weren’t breaking through perimeters any more; they were getting credentials and logging in. Neither the first nor the second wave’s tools were designed for that. At the same time, the cloud and remote work were wearing away the network perimeter, as the article on modern identity types described.

The conversation turned to identity as the security layer. MFA stopped being optional for administrators and became mandatory for everyone, and platforms such as Duo, founded in 2010, and Authy grew fast with push notifications, one-time codes and, gradually, FIDO and WebAuthn. Privileged access management started treating admin accounts as extremely valuable assets, with vaults, recorded sessions and automatic password rotation, and CyberArk, BeyondTrust and Delinea became the big three. The identity provider moved to the cloud as identity as a service, with Okta, founded in 2009 and listed in 2017, leading alongside Microsoft’s Azure AD, now Entra ID, which became the default identity provider of the Microsoft 365 world, and Ping Identity. Cisco bought Duo in 2018 for 2.35 billion dollars, a sign of how much the market valued the category. Zero Trust got its formal definition when NIST published SP 800-207 in August 2020, writing down what Google and others had been doing since 2014 with BeyondCorp. And modern federation, first SAML and then OIDC, became critical infrastructure for connecting the SaaS world.

What began as “let’s add MFA” ended up redefining how security is thought about, and three phrases from this wave are still everywhere: “identity is the new perimeter”, “assume breach” and “never trust, always verify”. The first says the network no longer protects you. The second says you have to design as if the attacker is already inside. The third says verification doesn’t stop at sign-in but continues with every decision.

The third wave raised the bar a long way, but gaps remained. Detecting threats against identity was immature: you had MFA, but if someone got round it with MFA bombing or an adversary-in-the-middle kit, the system didn’t necessarily notice. Non-human identities stayed in the background: privileged access management covered human admins, while machine identities, workloads and secrets in code remained a minefield. And the platforms were silos, with access management, IGA and privileged access sold as separate products by different vendors that barely talked to each other. In 2026, an organization that still doesn’t have MFA on every privileged account and a working vault for admin credentials is at least ten years behind, and saying so with data behind it is the basis of many budget requests.

Wave 4: identity security (about 2022 to now)

We’re living through this wave, so what follows is a tentative reading rather than settled history. Three forces define it. The first is sophisticated attacks on identity infrastructure itself: SolarWinds in 2020, Okta in 2022, Lapsus$, MOVEit in 2023, Snowflake in 2024. Attackers now go after the identity provider, not just the users. The second is the explosion of non-human identities, cloud workloads, microservices and AI agents, which turns the question from “who is this user?” into “how many machine identities do we have, and what can they do?”. The third is ransomware run as an industry, professional groups selling ransomware as a service, where the return on an attack is so high that spending on defense has to keep pace. On top of that there’s a growing expectation that identity should not only protect but also enable the business, opening new channels, such as banking embedded in other apps, platform ecosystems and AI agents serving customers, instead of only putting up barriers.

The fourth wave is producing categories that haven’t settled yet but already have names. ITDR, identity threat detection and response, the automated eye over the identity layer that Gartner named in 2022, sold by Microsoft Defender for Identity, CrowdStrike Falcon Identity, Silverfort and Semperis. ISPM, identity security posture management, which gives continuous visibility into risk in the identity infrastructure (are there hidden admins? forged tickets in use? how exposed are we?), from vendors such as Wiz, Microsoft Entra Permissions Management and Sonrai. The identity fabric, an architecture Gartner has promoted since 2021 that tries to bring access management, IGA, privileged access and ITDR under one control plane with consistent policies and visibility, now part of the strategy of Okta, Ping, ForgeRock and SailPoint. Passkeys at scale, with Apple, Google and Microsoft pushing them to replace passwords and adoption growing fast among consumers. Security platforms for non-human identities, a new category of companies such as Astrix, Token Security and Oasis Security that do nothing else. And identity for AI agents, where there’s no standard yet but every major player is building something.

There’s a subtle but important change in tone between the third and fourth waves. The third was defensive: identity is the perimeter, and it has to be protected. The fourth adds an enabling side: well-designed identity makes things possible that weren’t before. A bank can offer its services inside a retailer’s app without giving the retailer its customer database, only signed claims. A company can launch AI agents that act for its customers with precise, revocable permissions. Several organizations can share services on one platform while each keeps control of its own data. That’s what people now mean by “identity security”, or “identity-first security”.

The waves stack rather than replace one another, like rock strata where the deeper layers still hold up everything above.

There’s no point talking about identity security if the organization doesn’t yet have MFA for everyone, and no point talking about MFA if joiners and leavers aren’t handled automatically. The order matters.

It’s too early to say what the fourth wave will leave unsolved, but some tensions are already visible. Complexity piles up, because organizations run IAM tools from all four waves at once with fragile connections between them. Identity for AI agents is a new problem without mature answers, and whoever solves it well may well be the SailPoint or the Okta of the next decade. And skilled people are scarce: few professionals understand all four waves at once, which is exactly what this program is trying to build.

Putting the history to work

Knowing the waves is more than a curiosity. It gives you a quick diagnosis when you walk into a new organization, by looking for a few signals:

It also gives you a story when you need to justify a project to an executive committee. “We’ve solved X, the previous wave; now competitive, regulatory or security pressure means we have to solve Y, the next one” persuades better than a list of features. And it helps you see what’s coming. If the fourth wave is identity security, what comes after it? Reasonable bets include decentralized identity with digital wallets, post-quantum cryptography everywhere and federated governance of AI agents. Whoever starts designing for that fifth wave now will have an advantage in five years.

Recap

The four waves tell one coherent story. IAM was born to save money, grew up to satisfy regulators, turned to security when breaches forced it to, and is now reorganizing around a world in which identity, human, machine and AI agent, is the control plane for everything. The first wave asked how to cut IT costs and answered with SSO and provisioning. The second asked how to pass audits and answered with IGA and certifications. The third asked how to stop breaches and answered with MFA, privileged access management and Zero Trust. The fourth asks how to treat identity as one control plane and is answering with ITDR, governance of non-human identities and the identity fabric. Keep those four questions in mind and a few minutes in any organization will tell you where it stands, as Daniel found in his first week.

Three questions to test yourself

1. As an IAM consultant you visit a large family-owned company with 2,000 employees. They have Active Directory, password reset by security questions and a provisioning script. Which wave are they in, and what would you prioritize for the next 12 months?
2. Your finance director says “we paid for SailPoint eight years ago, why do we need more identity tools?”. How would you explain the difference between IGA (wave 2) and identity security (wave 4) in under three minutes?
3. If you had to bet on what will define the fifth wave of IAM, what would your hypothesis be, and which early signals would confirm it?