Protect · Identity & Access Management
Identity & Access Management
Identity is the perimeter now. Most breaches involve compromised credentials or excessive access, not a firewall bypass, which makes IAM the highest-leverage place to invest.
Delivered from our base in Utrecht, available to organisations across the Netherlands.
The problem
Access accumulates and rarely gets cleaned up. Employees change roles and keep old permissions. Contractors finish projects and keep their accounts. Service accounts get created for a one-off task and never get decommissioned. None of this looks urgent day to day, until one of those forgotten access paths is exactly what an attacker needed.
Business impact
Compromised credentials remain one of the most common ways into an organisation, and excessive access turns a minor compromise into a major one: the difference between an attacker reading one mailbox and an attacker reaching your entire file share, because the account they phished happened to still have admin rights from a project two years ago.
From access governance to Zero Trust identity, for both the people in your organisation and the machines acting on their behalf.
IAM & IGA strategy
Identity governance that actually reflects who should have access to what, and who decides, with a review cycle that doesn't rely on memory.
Entra ID & Active Directory
Configuration review and hardening across the identity platforms most organisations already run, including hybrid environments bridging both.
Okta & other IdPs
Single sign-on and identity provider configuration for organisations standardised on Okta or another platform instead of Entra ID.
SSO & MFA
Single sign-on and multi-factor authentication rolled out in a way that improves security without breaking the workflows people rely on daily.
Conditional Access & RBAC
Access policies driven by device, location and risk signal, not a blanket rule applied to everyone regardless of context.
PIM & PAM
Privileged identity and access management so standing admin rights stop being the default, replaced by time-bound, justified elevation.
Joiner-Mover-Leaver processes
Access lifecycle automation so a departing employee's access is actually revoked on their last day, not weeks later when someone notices.
Machine identities
Governance for the service accounts, API keys and workload identities that most access-review processes forget exist.
How this engagement runs
Assess
Understand the current state, real risk, and what's actually driving the need for this work.
Architect
Design the controls and approach that fit your environment, not a generic template.
Implement
Deploy and integrate the work: configuration, code, or process, whichever the engagement calls for.
Validate
Test that it actually holds up, rather than assuming it does because it's been deployed.
Improve
Feed findings back in as your environment and the threat landscape change.
Who this is for
- Organisations without a formal joiner-mover-leaver process for access
- Companies running Entra ID, Active Directory, Okta or a mix, without a recent access review
- Businesses preparing for ISO 27001 or NIS2, both of which expect demonstrable access governance
- Any organisation that's grown quickly and suspects access sprawl has outpaced its processes
What you get
- An access review identifying over-privileged accounts and stale permissions
- A joiner-mover-leaver process your HR and IT teams can actually run
- Conditional Access and MFA policies scoped to real risk
- PIM/PAM implementation for privileged accounts
- A machine-identity inventory covering service accounts and API keys
Frequently asked questions
What's the difference between IAM, IGA and PAM?
IAM (identity and access management) is the broad umbrella: authenticating users and controlling what they can access. IGA (identity governance and administration) is the process layer on top: who approves access, how it's reviewed, how joiner-mover-leaver works. PAM (privileged access management) is specifically about the smaller set of highly privileged accounts, admins, service accounts, that need tighter controls than everyone else.
We're a small team. Do we really need formal identity governance?
The formality scales with size, but the underlying problem doesn't disappear at small scale: a 15-person company with three ex-employees who still technically have system access is a real, common finding. The process can be lightweight; it still needs to exist.
Can you help with Zero Trust identity architecture specifically?
Yes. Identity is usually the first and most impactful place to apply Zero Trust principles. See our Zero Trust page for how identity, device and policy verification fit together.
Do you cover machine identities and service accounts, or just human users?
Both. Machine identities (service accounts, API keys, workload identities) are frequently over-privileged and rarely reviewed, and they're an increasingly common path into an environment.