Avid followers of the Identity Management world from the past decade would remember a company called Osirium. A trailblazer in the new wave of “Cloud PAM” solutions, Osirium got many things right — they foresaw back in 2014/15 that infrastructure-as-code presents a different challenge from a UX and policy governance perspective. The product developers foresaw the current din around “NHI”’s. The product caught some initial traction but did not make much of an impression eventually. The company listed on AIM and their shares fell precipitously through 2015 before they were bought out by an IGA vendor.
The first week of 2026 saw another announcement. A company that had a fresh take on policy governance and were addressing the access management conundrum in PAM head-on, were bought out by a so-called “traditional” PAM vendor.
Osirium was probably a little bit early in the cycle. The orthodoxy perhaps prevailed there, at the cost of customers and adoption, to the benefit of an ecosystem of vendors, analysts and implementers that rode the another decade without a chink in their armour. I hope history does not repeat itself. Drastic measures are required.
It is not like we haven’t known this for some time. As a consultant i have consistently championed integrated access management and governance for PAM from get go. It made intuitive sense. But like so much that makes sense in the industry, we still know that it is sometimes the tail that wags the dog.
As security and tech folks we like solutions that go deep. The nitty gritty of how credentials can be retrieved, shared, or split before being shared and the rotation scenarios have engrossed PAM teams for a few decades now. We are still stuck there, even when IT infrastructure and software deployment is going through unprecedented automation and pipelines are deployed at scale. The issue today is not just static parameters or attribute sets like a flesh and blood identity, a SNOW ticket and a role. It is an MCP server acting on behalf of an Agent client to execute a process on a target for which credentials are retrieved as code.
True, the old world will still exist for a while, but the biggest risk vectors are emerging from context and provenance, which PAM solutions are not built for. This is where i believe Access Governance is going to make a vicarious new world comeback. So much so, that the weightage will shift decisively towards policy governance with credentials or equivalent being wrapped into and driven by this context and provenance payload.
What can we do about this?
I think the industry and the collective have a role to play here.
First off, retire the PAM related Magic Quadrant/Forrester Wave, already. Access Management is single pane, that covers fabric, visibility, access control, policy orchestration and governance. Now, i would throw it up to the readers to agree what and if you would call this a stack, but splitting these capabilities today, perpetuates the lazy tool led transformations that just keep consultancies (like mine!) busy and leads to repetitive cycles of remediation packaged as “transformation”.
Second, let us set a higher bar for vendors as customers and decision makers. An imperfect but integrated identity stack should always win over a litany of point perfect solutions. If i have a vault vendor, a separate one for managing the policy plane and yet another to manage access, things will get broken in between, use cases will be expensive to deploy, technical debt will rise and adoption will suffer.
Third, and this is perhaps a controversial one. For the past couple of decades, we have rewarded vendors for depth in controls without realising that depth often enough implies debt. The debt is paid in adoption or lack of it, process and control design overheads, stagnating and inconsistent levels of user uptake due to system complexity factors. Session Management for Privileged Access Management is an oft quoted example, the control panes, ingress and egress restrictions, policy planes and their management, all added layers on layers in terms of complexity until we were asking — what is the problem we are trying to solve again?
I would encourage practitioners embarking on new transformation projects in the (Privileged) Access Management area to start afresh with laser focus on 101 Access Control, end user adoption with the requisite adaptation to security and software engineering practices.
The siloed PAM world is disappearing before our very eyes, if the stream of mergers and acquisitions over the past couple of years were anything to go by. Singular governance panes for any forms of access “privilege” or otherwise, machine or human, agent or code, are emerging from the detritus of the old world where IGA, PAM and Directory services were distinct capabilities. Acquisitions are consolidating stacks, the end game is not clear yet, but the writing for me is on the wall.
It is time to drop “Privileged” from Access Management, because a good Access Management solution should establish identity, process provenance, policy and request context on the fly and apply corresponding controls and governance measures per incidence. Can our vendor ecosystem respond to this ask?