# 6. Identity: IAM, PAM, ITDR
Identity is arguably the most important topic on this list, because identity is the new perimeter, and most breaches in the last five years have involved compromised credentials, over-privileged accounts, or identity infrastructure that was poorly understood, let alone defended.
Context:
- IAM (Identity & Access Management), the system of record for who exists, what they can access, and how they authenticate. Includes SSO, MFA, lifecycle management, provisioning. Vendors: Okta, Entra ID (Azure AD), Ping, JumpCloud, etc.
- PAM (Privileged Access Management), protecting and monitoring the powerful accounts: admins, service accounts, root, break-glass. Vendors: CyberArk, BeyondTrust, Delinea, Teleport, etc.
- ITDR (Identity Threat Detection & Response), the newest category: detecting attacks against the identity infrastructure itself (token theft, MFA bypass, AD compromise, OAuth abuse, lateral movement via identity). Vendors: Silverfort, Semperis, Crowdstrike Falcon Identity, etc.
The market is messy because: IAM vendors claim PAM features, PAM vendors claim ITDR features, EDR vendors claim identity protection, and everyone claims "Zero Trust" and "AI-driven." The truth is that these are three distinct disciplines that share a data model but require different operational muscles. Buying one and assuming you've covered the others is how organizations get breached.
The core question across all three: "When (not if) someone steals a credential, session token, or service account in my environment, how quickly will I know, and what will stop them from using it?"
14 Questions to Ask IAM/PAM/ITDR Vendors
1. "How do you handle non-human identities, service accounts, machine identities, API keys, OAuth tokens, workload identities? They now outnumber human identities 20:1 or more."
Why: This is the elephant in the IAM room. Most IAM tools were built for humans logging in; the modern attack surface is dominated by service accounts and tokens. Many breaches (Okta, Microsoft, MGM, etc.) hinged on non-human identity abuse.
Good answer: Discovery, inventory, lifecycle management, and credential rotation for service accounts; OAuth app governance; secrets management integration. Red flag: "We focus on user identity" (= they're 5 years behind).
2. "Walk me through your MFA story honestly, including what's phishing-resistant, what's not, and where you still allow weaker factors."
Why: MFA fatigue, push-bombing, SIM-swapping, and adversary-in-the-middle (AitM) attacks have all proven that not all MFA is equal. SMS and push-only MFA are now considered weak. Vendors should push you toward FIDO2/passkeys.
Good answer: Native FIDO2/WebAuthn/passkey support, phishing-resistant by default, granular policy by risk. Red flag: "We support all MFA methods" with no opinion on which to use.
3. "How does your platform behave when you have an outage? What's my break-glass story, and have you tested it?"
Why: Identity is critical infrastructure. When your IAM provider has an outage (and they will, Okta, Microsoft, every provider has had them), can your business log in? Can you respond to incidents? This is a sleeper question that exposes immature vendors.
Good answer: Documented break-glass accounts, offline access mechanisms, regional failover, post-incident reports from past outages. Red flag: "Our uptime is 99.99%" (deflection, that's not the question).
4. "For PAM specifically, how do you handle modern infrastructure: cloud, Kubernetes, ephemeral workloads, DevOps pipelines, and APIs? Or are you still vault-and-jump-server-centric?"
Why: Legacy PAM was built for Windows admins RDPing into servers. Modern environments are ephemeral, API-driven, and code-managed. Many PAM tools have bolted on cloud features that work poorly in practice.
Good answer: Native cloud privileged access, just-in-time access, ephemeral credentials, secrets manager integration, API-first architecture. Red flag: "Our vault stores all credentials" as the centerpiece (= legacy thinking).
5. "What does your zero-standing-privilege / just-in-time access model look like in practice? Show me a real workflow, not a slide."
Why: "Zero standing privilege" is the modern PAM north star, admins shouldn't have permanent admin rights; they should request them when needed. Most vendors claim this; few execute it well.
Good answer: Live demo of access request → approval → time-bound elevation → automatic revocation, with audit trail. Red flag: "We support JIT" with no real workflow.
6. "How do you detect and respond to identity attacks, token theft, golden ticket, kerberoasting, OAuth consent abuse, illicit grant attacks, MFA fatigue?"
Why: This is the ITDR test. Many IAM and PAM vendors claim "identity threat detection" but really mean failed-login alerts. Real ITDR understands AD/Entra attack patterns deeply.
Good answer: Specific named attack techniques covered, real detection logic, integration with EDR/SIEM, behavioral analytics. Red flag: "We detect anomalous logins" (table stakes, not ITDR).
7. "How do you protect Active Directory / Entra ID itself, both in detection and recovery? What's your AD disaster recovery story?"
Why: AD compromise is catastrophic and increasingly common (NotPetya, ransomware, etc.). Most organizations have no clean recovery plan if AD is destroyed. Few IAM vendors actually address this; specialized ITDR vendors do.
Good answer: AD/Entra-specific attack detection, forest recovery capabilities, immutable backups, tested recovery playbooks. Red flag: "AD is Microsoft's responsibility."
8. "How do you handle identity sprawl across multiple IdPs, SaaS apps, cloud providers, and legacy systems? Or do you assume one identity provider rules them all?"
Why: The reality of mid-market and enterprise companies is multiple identity sources, Okta + AD + Google + a dozen SaaS apps with their own user stores. Federation isn't enough; you need unified visibility and policy.
Good answer: Multi-IdP support, identity fabric/orchestration capabilities, unified policy engine. Red flag: "Just consolidate everything onto our platform" (rarely realistic).
9. "What's your lifecycle automation story, joiner/mover/leaver, and how does it integrate with HR systems? How long does it take to deprovision a terminated employee in practice?"
Why: The most common identity failure isn't fancy attacks, it's terminated employees retaining access for weeks or months. Audit findings here are universal. Real automation cuts this to minutes.
Good answer: Native HRIS integration (Workday, BambooHR, etc.), automated deprovisioning across all connected apps, measurable SLAs. Red flag: "We integrate with HR systems" (verify the depth).
10. "How do you handle access reviews and certifications, and what percentage of your customers' reviewers actually engage thoughtfully versus rubber-stamp?"
Why: Access certifications are a compliance requirement that almost universally devolves into mass rubber-stamping. Mature vendors acknowledge this and design around it; immature ones pretend the problem doesn't exist.
Good answer: Risk-based reviews focused on outliers, AI-assisted recommendations, microcertifications, honest discussion of the rubber-stamp problem. Red flag: "Our reviewers love it!" (no, they don't).
11. "What's your data residency, encryption, and key management story, and where do session tokens, secrets, and credentials physically live?"
Why: Identity systems contain the keys to your kingdom. A breach of the IAM/PAM vendor itself is catastrophic (see Okta 2022, 2023). Where the crown jewels live matters enormously.
Good answer: Regional hosting, BYOK/HYOK options, hardware-backed key storage, transparency on internal access. Red flag: Vague answers about "encryption at rest."
12. "How transparent are you about your own breaches and incidents? Show me your last 3 years of public security incidents and post-mortems."
Why: Identity vendors are high-value targets and have been breached repeatedly. Maturity isn't measured by whether they've had an incident, it's measured by transparency, learning, and customer communication.
Good answer: Public post-mortems, named CISO/security leader, transparency reports, customer notification commitments. Red flag: "We've never had a security incident" or evasion.
13. "How do you reduce blast radius if a privileged account is compromised? What controls limit damage even after authentication succeeds?"
Why: The mature mindset is "assume breach." Authentication is just the first line of defense. Session monitoring, anomaly detection, time-bounded access, and automatic revocation matter as much as login.
Good answer: Session-level monitoring, behavioral anomaly detection, automated session termination, command-level audit (for PAM). Red flag: "Once authenticated, the user is trusted."
14. "If I terminate the contract, what happens to my identity data, session logs, audit trails, and federation configurations? What's the migration path?"
Why: Identity migrations are notoriously brutal, federation, MFA enrollment, app integrations, service account dependencies. Vendors know this and use it as leverage. Get exit terms clear up front.
Good answer: Documented export procedures, transition assistance, no proprietary lock-in for federation standards. Red flag: "We make it easy to migrate to us" (note the direction again).
🎯 The Meta-Test
- Q1, Q4, Q6, and Q7 separate the modern from the legacy. Vendors who can't answer these are stuck in the 2015 identity model.
- Q3 and Q12 are the resilience and trust test. You're handing them the keys; they should be paranoid about losing them.
- Q9 and Q10 are the operational reality test. Lifecycle and certifications are where identity programs succeed or fail in practice.
💡 Honest Observation
For "regular" companies, the most common identity mistakes I see are:
- Buying IAM and assuming it covers PAM. It doesn't. Your domain admins, service accounts, and cloud root accounts need separate, dedicated controls. SSO + MFA on a privileged account is not PAM.
- Buying PAM and never operationalizing it. PAM tools that aren't fully adopted are worse than none, they create a false sense of control while admins continue to use shared credentials in spreadsheets. Adoption is a year-long change management project, not a 90-day deployment.
- Ignoring service accounts entirely. This is where the breaches are happening now. If you don't have an inventory of service accounts and a rotation plan, that's where I'd start before buying any new tool.
- Treating MFA as a checkbox. "We have MFA" is no longer enough. Phishing-resistant MFA (FIDO2/passkeys) for privileged accounts is now table stakes, and SMS-based MFA should be considered a stopgap, not a control.
- Forgetting AD/Entra recovery. Almost no one I talk to has tested a full forest recovery in the last 12 months. Ransomware groups know this and target it. ITDR + tested recovery is the unsexy investment that prevents existential events.
For mid-market companies, the right purchasing sequence is usually:
- Get IAM right first, SSO, phishing-resistant MFA, automated joiner/mover/leaver
- Then PAM, at least for tier-0 (domain admin, cloud root, hypervisor) and service accounts
- Then ITDR, once you have something worth defending and detecting against
Skipping straight to ITDR while your service accounts are still on permanent passwords is buying a security camera for a house with no doors.
