The Identity Dividend: Why Getting IAM Right Is a Business Case, Not a Security Cost
The firewall gets the budget line. The SOC gets the headcount. Identity gets a footnote, right up until it's the thing that saved you, or the thing that sank you.
I wrote in my original post on identity that it’s become the new security perimeter: as the network edge dissolved, identity quietly took over as the control plane we actually defend. That’s still true. But "perimeter" is a defensive word, and it hides the more interesting story and the one your finance director would care about, if anyone bothered to translate it for them.
Identity is the only security investment that pays you back somewhere else. A firewall is money out, full stop. Get identity right and the returns show up in onboarding, in the service-desk queue, in the audit you didn't have to dread, in the breach that stopped at one account instead of forty. The savings are real. They're just scattered across budgets that never send security a thank-you note.
That scattered payback is the identity dividend, and this post is about how you collect it.
Zero Trust is a consequence of identity, not a product you buy
"Never trust, always verify" is a fine slogan until you ask the obvious question: verify what, exactly?
Verification is only ever a check against a known identity. If you can't reliably say who a user is, or what a device or workload is, you've nothing to check the claim against and "always verify" quietly becomes "wave it through." Everything we file under Zero Trust (secure collaboration, conditional remote access, micro-segmentation, least privilege) sits on top of how well you've actually sorted identity.
So the order matters. Organisations that buy Zero Trust as a bundle before they've cleaned up their identity estate end up with expensive tooling making confident decisions on bad data. Sort identity first, and Zero Trust becomes configuration rather than aspiration.
And it isn't only about people. Much of the interesting attack surface now is workloads (services, pipelines, automation) authenticating to each other. If those still run on shared secrets in a config file, your Zero Trust story has a hole in the middle of it. That's not an edge case. That's half your attack surface, sitting in a text file. Worse still, AI is about to make that surface much bigger: every agent you deploy is another non-human identity, acting on someone's behalf, needing exactly the scoped, revocable access a person would, but with none of the instinct to stop when something feels wrong.
The operational dividend finance keeps underrating
This is where good IAM stops being abstract.
When identity is done well, joiners are productive on day one, because access follows their role automatically. Leavers lose access the moment they leave, not three weeks later when someone remembers. Movers don't hoard a decade of stale entitlements that turn every audit into a dig. Access requests stop being helpdesk tickets and become self-service against policy. The audit trail writes itself.
A live example. We recently modernised a regional NHS imaging-sharing service, where clinicians in one organisation need to see radiology images held by another, instantly, because patients are waiting. The principle we held to was simple: put every decision with the one that owns it. Each clinician's identity is created and revoked by their own employer. Access to a given Trust's images is approved by that Trust's own service managers, the people who understand the clinical context. And the IT function? It signs off the approach and the security of the whole system once, then steps out of the loop entirely.
No standing queue of access tickets. No IT bottleneck between a clinician and a scan. That isn't a security feature bolted on. It's a way of working that's faster and safer at the same time, and it only works because the identity foundation underneath it is sound.
Multiply that across a whole estate, and the "cost" of IAM starts to look like the best margin improvement you never budgeted for.
Compliance stops being an archaeology project
If you work in IG, you know the real cost of compliance isn't the control, it's proving the control. Most audit pain is archaeology: reconstructing, after the fact, who had access to what and why.
Mature IAM inverts that. Least privilege, joiner-mover-leaver automation, periodic access reviews and immutable logs mean the evidence is a by-product of running the system, not a project you stand up every time an auditor emails. Audits get boring, in the good way. 😊
And it pays off across the whole regulatory stack. ISO 27001's access-control expectations, GDPR's data-minimisation and accountability principles, NIS2's sharper line on management responsibility and incident readiness. Underneath, they're all asking the same question: can you show that the right people, and only the right people, have the right access, and can you prove it? Good IAM answers on demand. It increasingly decides your insurability, too – underwriters now price cyber cover on MFA coverage, privileged-access controls and offboarding discipline. Weak identity doesn't just raise your risk. It raises your premium, or loses you the cover.
The economics, stated plainly
Let me put numbers-shaped logic to it, without pretending I can forecast your P&L.
IBM's Cost of a Data Breach Report 2024 put the global average breach at a record $4.88m and found that breaches involving stolen or compromised credentials were the hardest of all to contain, taking an average of 292 days to detect and resolve. (Source: IBM Cost of a Data Breach Report 2024)
Nearly ten months – that's how long an attacker can sit inside your estate on a valid credential before anyone contains it. It's exactly the dwell time that strong authentication, least privilege and fast revocation are built to collapse. That's the dividend, in one statistic. From there it compounds:
Breaches get less likely, and less severe. A stolen credential is a legitimate login by the wrong person – nothing looks broken, which is why it runs for months. Kill standing credentials and scope access tightly, and you shrink both the odds and the blast radius, which is what really drives the bill.
Manual effort falls. Every automated joiner, every self-service request, every access review that runs itself is work you're not paying a person to do and a wait no one is stuck in.
You avoid rework. Badly-designed identity is the gift that keeps taking. Retrofitting least privilege or untangling over-provisioned roles costs far more than getting the architecture right once.
Governance becomes predictable. Pulling a sprawl of directories, point tools and inconsistent policies into one coherent model turns a variable, surprise-prone cost into a flat, forecastable one. Predictability is itself a saving.
None of these are speculative. They're just rarely added up, because they land in different budgets.
Why Azure earns its place — specifics, not badges
I'll use whatever platform fits the problem, but for organisations already in the Microsoft world, Microsoft Entra ID (the identity service formerly known as Azure AD) is a genuinely strong foundation, provided you use it properly, rather than switching it on and walking away.
RBAC at the right scope gives you least privilege that's actually manageable, instead of a wall of one-off permissions.
Privileged Identity Management (PIM) turns standing admin rights (the thing attackers pray for) into just-in-time, time-boxed, approved elevation. Nobody is a permanent global admin; they become one for two hours, with a reason and a record.
Entra ID Governance runs the lifecycle: entitlement management through access packages, scheduled access reviews, and automated joiner-mover-leaver workflows, so entitlements track reality.
Conditional Access is the policy engine that makes Zero Trust real – decisions based on user, device, risk and context, every single time.
Managed and workload identities close the DevOps gap, letting services and pipelines authenticate without secrets in code – which is where an uncomfortable number of breaches actually begin.
The tools are excellent. The value comes from designing them into a coherent whole, which is a skills problem far more than a licensing one.
The team it actually takes
Which brings me to the uncomfortable truth: IAM fails most often not on technology, but on staffing. It gets handed to capable generalists as a project, when it's a discipline.
Doing it well needs identity architects who think in trust boundaries and lifecycles; cloud security engineers who can apply least privilege without grinding the business to a halt; policy and governance specialists who turn ISO, GDPR and NIS2 into rules a system can enforce; and real automation skill, because IAM that leans on humans remembering to do the right thing will drift within a quarter. The organisations that win put those people on one problem together – data, platform, cloud, identity and domain knowledge in the same room – not four specialisms lobbing tickets over a wall at each other.
Final thought
Identity isn't the cost of doing security. It's the infrastructure that decides how securely, how quickly and how cheaply you can do everything else. It's the foundation Zero Trust stands on, the reason audits get boring, the thing that pulls down both the likelihood and the cost of a breach, and increasingly what your insurer and your regulator judge you by.
Treated as infrastructure rather than a grudge purchase, it pays back in security, in lower long-term cost, in evidence you can hand an auditor without a fortnight's notice – and, best of all, in the confidence to move quickly on top of Azure, because you finally trust who's doing what.
That's the identity dividend. It was never really about keeping people out. It's about letting the right people, and the right workloads, safely get on.