Identity & Access Management
,
Security Operations
OneLogin Departs Forrester’s Leaderboard as User Experience Takes Center Stage
Microsoft, Okta and CyberArk remained atop Forrester’s workforce identity rankings, while OneLogin tumbled from the leaders’ spot.
The shift toward digital platforms and growing adoption of cloud services have been pivotal in driving the evolution of workforce identity platforms, according to Forrester Principal Analyst Geoff Cairns. The increased prevalence of remote working arrangements spurred by the COVID-19 pandemic prompted an evolution of the workforce identity space, highlighting the need for better security and user experience.
“Moving toward cloud adoption and digital transformation adds to the new approach to workforce identity management,” Cairns told Information Security Media Group. “We’re seeing security and productivity finally joining hands, offering better experiences for employees without compromising security.”
The workforce identity Forrester Wave replaced the Wave for Identity as a Service, which was released in summer 2021. Okta held steady atop Forrester’s evaluation for the strength of its current offering, and Microsoft, CyberArk and Ping Identity took second, third and fourth place, respectively. Last time, OneLogin, CyberArk and Microsoft were in second, third and fourth place, respectively.
Microsoft bested Okta this time for the top strategy score, while in 2021, Microsoft received the fourth-highest strategy score behind Okta, CyberArk and OneLogin. In the current evaluation, Okta and CyberArk tied for the second-highest strategy, while Saviynt and SailPoint tied for the fourth-highest strategy score. OneLogin was acquired in 2021 by One Identity, which Forrester ranks as a contender (see: CyberArk, Delinea, One Identity Top Gartner MQ for PAM).
“Leaders in the workforce identity market come from diverse backgrounds, each bringing their own strengths based on their heritage,” Cairns said. “M&A activity is reshaping the workforce identity landscape, potentially influencing the offerings and market positioning of key players.”
Bringing User Experience to the Forefront
Workforce identity providers have moved away from traditional, isolated security controls and toward integrating security and productivity to provide employees with a better user experience, Cairns said. The technologies used for workforce identity are increasingly blending with what customer identity providers offer, and adaptive, risk-based authentication technologies are moving into the workforce space.
“There are commonalities between workforce identity and CIAM, but the mindset and execution can differ significantly,” Cairns said. “Risk-based authentication techniques from CIAM are finding their way into workforce identity, signaling a blending of strategies.”
Cyber insurance requirements are pushing small to medium-sized enterprises toward more mature identity management platforms that offer stronger authentication methods. Cairns said many customers face challenges with aging identity management systems that are siloed, meaning they can rationalize and update their workforce identity infrastructure as part of their digital transformation efforts.
“M&A activity is reshaping the workforce identity landscape.”
– Geoff Cairns, principal analyst, Forrester
Customers typically prioritize addressing workforce-specific identity challenges rather than linking their workforce and customer identity technology together, Cairns said. Generative AI’s impact on workforce identity is currently limited, but Cairns expects it to help with policy configuration. There’s also the need to gain visibility and address engineering issues around how APIs are used in workforce identity, he said.
“Advancements in AI and machine learning are expected to automate more solutions in workforce identity platforms, breaking down siloed approaches,” Cairns said. “The impact of gen AI in the workforce is still unfolding, with potential for aiding in policy configuration and automation.”
Outside of the leaders, here’s how Forrester sees the workforce identity market:
- Strong Performers: Ping Identity, Saviynt, SailPoint, IBM
- Contenders: JumpCloud, One Identity
- Challengers: OpenText, Entrust, Broadcom
Okta Rolls Out Identity Governance, Privileged Access
Okta over the past year has invested in new workforce identity capabilities, enhanced existing functions, strengthened security and usability, and used artificial intelligence for identity threat protection, said Sagnik Nandy, president and chief development officer for workforce identity. The firm adopted a neutral stance around integration to accommodate different organizational structures.
The company recently launched identity governance and privileged access products and built out a unified control plane to evaluate risks using data from various sources, Nandy said. Okta also acquired Spire to boost its posture management capabilities and provide detailed visibility into security gaps, and artificial intelligence can help customers achieve optimal security configurations (see: Okta Exec Sagnik Nandy on Protecting the Extended Workforce).
“We’re focusing on making our existing offerings more secure and user-friendly while exploring new areas of investment, particularly in AI,” Nandy told ISMG. “Our goal is not just to provide tools but to ensure they are easily usable and help our customers achieve their ideal security configuration.”
Forrester criticized Okta for its response to recent security incidents, its relatively basic identity governance and privileged access capabilities, and the training and ramp-up time needed to use Okta Workflows. Nandy said Okta plans to streamline workflow connectors and enhance ease of use across its offerings, and it is dedicated to becoming the most secure company in the industry by embracing best practices.
“We’re committed to continuous improvement, especially in enhancing security and usability across our platforms,” Nandy said. “Our commitment to security is unwavering, and we’re continuously working to ensure our products are the most secure in the market.”
CyberArk Debuts Enterprise Browser to Guard Unmanaged Devices
CyberArk shifted from merely managing identities to actually securing them, which requires continuous monitoring of user activities within applications to ensure security beyond just access and authentication, said Chief Solutions Officer Gil Rapaport. The company launched a secure web browser to protect both managed and unmanaged devices by rolling out features including cookieless browsing and one-time tokens.
The enterprise browser not only enhances security but also improves the user experience by providing secure single sign-on across all enterprise resources rather than just web applications, Rapaport said. The solution addresses privacy and data sovereignty concerns by allowing businesses to decide what data should be hosted on the cloud and what data should stay within the corporate premises, he said (see: CyberArk CEO Touts New Browser That Secures Privileged Users).
“By unifying the user experience, we’re making security seamless and integrated across all enterprise resources,” Rapaport told ISMG. “Flexibility for our customers is key; we allow them to decide what stays on-premises and what goes to the cloud.”
Forrester criticized CyberArk for subpar dashboarding, native access governance, and no-code/low-code workflow capabilities. Rapaport said the company is currently working on projects related to its dashboard, user experience and admin experience, and it is planning to roll out more features around life cycle management, compliance management and managing licenses in its governance dashboard.
“Our approach differentiates us from competitors by focusing on securing user activities and not just managing access,” Rapaport said. “We are addressing the critiques from Forrester head-on, investing in making our products more robust and user-friendly.”
Identity Takes Center Stage at Microsoft Amid Entra ID Rebrand
Forrester said Microsoft remained in the background of the identity and access management vendor landscape until 2023, when it rebranded Azure Active Directory to Microsoft Entra ID and debuted investments around generative AI and decentralized identity. Entra’s power comes from its adaptive policy engine, identity life cycle management and an end-to-end approach to identity threat detection.
Microsoft supports a full range of authentication methods, including native and third-party phishing-resistant passwordless multifactor authentication options, according to Forrester. It also offers an application proxy to extend its reach to legacy, on-premises and non-Microsoft resources and applications (see: Transforming Cyber With AI: Insights From Microsoft Experts).
Forrester criticized Microsoft for making it difficult for buyers to navigate stand-alone pricing options for specific capabilities as well as for lacking a drag-and-drop canvas and visualization for journey time identity orchestration workflows. Microsoft declined an ISMG request for comment on the workforce identity Forrester Wave.