Insights
Articles on identity and access
In-depth articles from our advisors on identity and access management: IGA, PAM, Access Management, and the compliance requirements driving the field.
You can't govern what you can't see
AI agents pull their tools from MCP servers that nobody ordered, approved, or registered. Why your identity platform does not catch it, and what can be done without a large program.
Read more →
Who closes the account in the vault?
A PAM solution without a process for creation and removal drifts away from reality. How to give privileged accounts a lifecycle that is governed from IGA and can be documented.
Read more →
Non-human identities: the access nobody watches
Service accounts, API keys and certificates make up the vast majority of identities in modern IT environments – and few of them have an owner. Here is how to bring non-human identities under the same governance as your employees.
Read more →
DORA and access management: what the regulation requires of you
DORA sets concrete requirements for access management, privileged access and supplier oversight in the financial sector. See where the regulation touches identity, and how to turn the requirements into practice.
Read more →
Entra ID Governance or a dedicated IGA platform – which should you choose?
Microsoft Entra ID Governance covers more and more – but when is it enough, and when does the task call for a dedicated IGA platform? Get the criteria that decide the choice.
Read more →
EU AI Act: who is liable when your AI promises too much?
A chatbot promised a customer a discount, the airline denied responsibility and lost in court. With the AI Act’s transparency rules in force from August 2026, the question is no longer whether you are liable for your AI, but whether you can govern it.
Read more →
Standing admin privileges are your biggest risk
Admin accounts that are always active are the first thing an attacker looks for. Just-in-time access removes standing privileges – without slowing down the IT department’s day-to-day work.
Read more →
Third-party access: when your security depends on someone else’s
External consultants, support agreements and shared VPN accounts give vendors access to your most critical systems – often with no expiry, owner or traceability. Here is how to take control of third-party access.
Read more →
Passkeys: MFA that cannot be phished
Passwords can be guessed, leaked and phished – and even classic MFA can be bypassed. Passkeys remove the password entirely and make phishing of logins technically impossible. Here is how to get started.
Read more →
What is IVIP – and why is everyone talking about it?
Gartner has named a new product category: Identity Visibility and Intelligence Platforms. What an IVIP is, why the category has emerged, and how it fits alongside IGA, PAM and Access Management.
Read more →
IVIP in practice: what should you use the overview for?
What is an Identity Visibility and Intelligence Platform actually used for? Orphaned accounts, accumulated entitlements, audit evidence, and a clean data foundation before the IGA project.
Read more →
Role mining: let data propose the roles – and the business decide
Role models fail when built purely top-down or purely bottom-up. A hybrid approach lets data propose the roles and the business decide – and an IVIP delivers the data foundation role mining needs.
Read more →
NIS2 affects you even if you are not in scope yourself
NIS2 requires security across the entire supply chain. In-scope companies are now setting concrete security requirements for their suppliers – in contracts, due diligence and supplier audits.
Read more →
How to answer your customer's security requirements without a big IAM project
Customers covered by NIS2 require documented access governance from their suppliers. Here are the typical questions – and a phased approach that delivers credible answers without a multi-year programme.
Read more →
Case: From manual access management to full overview in 12 weeks
A manufacturing company with 2,000 employees and 15 offices established a single identity overview and automated on- and offboarding with Pointsharp IGA – using a phased approach that can be completed in as little as 12 weeks.
Read more →
NIS2 sets requirements for your access management – are you ready?
NIS2 sets concrete requirements for access management: access control policies, MFA, and documented control of who has access to what. Here is how the directive connects to IAM and IGA.
Read more →
Forgotten access: the quiet risk of poor offboarding
When employees leave, their access does not always leave with them. Forgotten accounts are one of the most overlooked security risks – here are the gaps and the process that closes them.
Read more →
Five pitfalls in IGA projects – and how to avoid them
IGA projects rarely fail on technology. They fail on data, roles, ownership, and first steps that are too big. Here are the five pitfalls we see most often – and what works instead.
Read more →
AI agents are your newest identities – who governs their access?
AI agents sign in to systems, call APIs, and make decisions – but who owns them, and what may they do? How to apply the IGA disciplines to a new type of identity.
Read more →Has an article raised questions about your own access management?
We are happy to have a no-obligation conversation about where you stand and what to address first.