IAMONES - Two years in retrospect
We started IAMONES a little over two years ago, in April 2024.
It was based on a simple observation of the IAM market: instead of getting simpler, Identity vendors kept piling complexity on top of complexity. In plain terms, an IAM mainframe. And I have been part of that complexity journey myself. I loved making things very configurable, hence complex.
The arrival of Large Language Models (LLMs) then triggered a simple idea: isn’t IAM, at its core, a massive translation problem between two languages, technical entitlements and business language?
So, what if we could bridge that gap with the ability of LLMs to understand natural language, and drastically improve both the user experience and the configuration experience of IAM processes?
Come on, we all know the current UX is terrible, regardless of the product. And the configuration experience? It takes ages and expensive product specialists.
So IAMONES was born. With a few other serial entrepreneurs, we went all in on this crazy journey: building an AI-native Identity player that could make the most of natural language and LLMs. On the Mediterranean. Not the usual Mediterranean suspect though: Italy.
Fast forward to August 2026, and I am a little shocked. Positively, but shocked.
We had our first bookings already in 2024, we grew 100% in 2025, and we expect to grow another 150+% in 2026.
Initially, I would never have thought that today we would be serving several very large, regulated organizations for their IAM modernization needs. Yes, Clients with big, big names you are all familiar with. We now need two hands to count them.
So, I ask myself: why did they pick IAMONES? The industry has well-established players. Maybe not AI-native, but massive and established. So why pick us, a new and risky vendor, for something as critical as IAM modernization?
Three main reasons.
#1 They all have a massive tech debt they must live with
Highly configured on-premises IAM products (mainly SailPoint IIQ and One Identity Manager), combined with home-grown developments built to patch what the selected vendor could not provide: a better access request front-end, some role modelling tooling, some data lakes aggregating employee and privileged identities.
Ripping all of that out is a multi-year, multi-million programme, and nobody is in a hurry to sign up for it.
#2 A “Cloud yes… but” approach
Clients love the flexibility of the Cloud… but they want to keep control over their data. Data residency, hosting model and exit strategy now come up in the first meeting.
We designed for that from the start: Your Data – your IAM Data, your questions, your answers, your configuration prompts, etc. – stay where you want them to be. On premises? Fine. In your trusted hyperscaler? Fine. Your data stays inside the perimeter you – the client – are comfortable with.
#3 An “AI yes… but” skepticism
This is the big one. I would say that half of the reason clients choose us is that we took AI security seriously from day one. The questions we get are always the same. “Where do the prompts go?” “Can the model be tricked into showing me access I should not see?” “What happens to our data?”
Our answers are boring, and boring is exactly what a CISO wants to hear:
- Divide et impera: no single model ever sees the whole question. We never simply “send a question to an LLM”. The Identity Brain breaks every question into discrete sub-tasks and hands each one to a different specialised agent, on a different provider. A useful side effect: our Identity Brain is LLM-provider agnostic.
- PII never reaches the model. Personally identifiable information is stripped programmatically before any reasoning step and re-attached only afterwards.
- Data Visibility is enforced by the database, not by the model. Who can see what is written in natural language, then compiled into Row-Level Security policies that PostgreSQL applies at query time, row by row. Permissions are enforced before the LLM, not after it.
- Everything backstage is recorded, so you can always ask “why”. Not just the question and the answer: which agents were triggered, which instructions were in force, which rule fired, which data was returned.
- And we back all of this with an ISO 27001 certification. Obtained in June 2026 – unusual for a company this young. But it matters to our clients, so we did it.
IAMONES, who are you?
We are the IAM modernization choice for the sovereign-obsessed enterprises. The ones who want the simplicity of natural language and AI, but not at the price of losing control over their data.