Blog

AI chatbot - Artificial Intelligence innovation digital concept

Today, the term AI Agent is gaining traction, but what exactly does it mean? It signals a move beyond AI that simply processes prompts to systems designed for autonomy and action. Unlike standard applications or even sophisticated LLMs, an AI Agent possesses the core capabilities to reason through problems, plan effective solutions, and utilize a toolkit of functions or APIs to interact with the environment. This capacity for independent operation makes them particularly powerful. Could AI Agents be the key to truly dynamic IAM? What is an AI Agent? More Than Just a Smart Chatbot First, let's clarify what we mean by an AI agent. It's more than just a system that responds to prompts. An AI agent is designed to be autonomous. It possesses the ability to:1. Reason: Analyze a goal or a situation; 2. Plan: Break down the goal into actionable steps; 3. Act: Execute those steps by interacting with its environment.Crucially, AI agents are equipped with a set of tools. These aren't physical tools but rather functions, API calls, database queries, or other capabilities that allow them to interact with other systems and data sources. The agent autonomously decides when and how to use these tools based on its reasoning process to achieve its objective.Agent vs. Prompt Chain: The Key Difference is Autonomy You might wonder how this differs from simply chaining prompts together. While you can create sequences where the output of one LLM prompt feeds into another or even use LLM outputs to generate code (like SQL queries) for external interaction, this approach lacks the core element of agentic AI: autonomous reasoning and tool selection. <ul><li>Prompt Chaining: Follows a more pre-defined path. The interaction logic is largely determined by the human designer chaining the prompts.</li><li>AI Agent: The LLM is in the driver's seat. It assesses the situation, reviews its available tools, decides the best course of action, executes it, observes the result, and then reasons about the next step. It has a holistic view and control over the process.</li></ul>Applying Agentic AI to IAM: A Workflow Revolution Now, let's bring this concept into the world of IAM. Consider the often complex and rigid nature of access request management and workflow implementation in traditional systems. Agentic AI offers a paradigm shift. Imagine defining complex access workflows using natural language. Instead of clicking through configuration menus, you could simply instruct the system: “Access requests for resources classified as "High Risk" require sequential approval. First, approval must be obtained from the requestor's direct manager. Second, if the manager approves, approval must be obtained from the designated Application Owner. Third, if the Application Owner also approves, final approval is required from the relevant Entitlement Owner associated with the specific access being requested”.An AI agent specifically designed for IAM could then:1. Understand &amp; Structure: Parse this natural language request, understand the intent, and structure the necessary workflow steps. 2. Reason &amp; Verify: Initiate a reasoning process. Who is the requestor? Is the request compliant with existing policies? Who is the designated manager? 3. Utilise Tools: Use its available tools (API calls, directory lookups) to:<ul><li>Verify the new requestor's details.</li><li>Identify the correct manager.</li><li>Check relevant security policies related to the requested access. </li></ul>4. Act &amp; Provision: Once all checks pass and approvals are secured, use another tool like an API call to your existing IGA platform to actually trigger the provisioning of the requested access rights. 5. Report: Confirm completion or report any issues encountered. Integrating Human Oversight: The Human-in-the-LoopOf course, not all IAM decisions can or should be fully automated. Many processes, particularly those involving high-risk access or periodic reviews, mandate human judgment and explicit approval. This is where the concept of "human-in-the-loop" becomes essential, and agentic AI is well-suited to accommodate it. Imagine an access review campaign or our previous high-risk access request workflow. When the AI agent reaches a pre-defined step that requires human intervention (like manager certification), its reasoning identifies this requirement. Instead of proceeding autonomously, the agent pauses the workflow. It can then utilize its tools to notify the designated human approver through appropriate channels (e.g., email or a notification in the IGA platform), providing them with the necessary context. The workflow remains suspended until the human provides their decision (approve, deny, revoke). Once the input is received, the agent resumes the workflow, incorporating the human decision into its next steps – either proceeding with provisioning/attestation, escalating, or closing the task based on the feedback received, and logging the entire interaction for audit purposes. This seamless integration ensures that automation boosts efficiency without bypassing critical human control points and compliance requirements.Why This Matters for IAM<ul><li>Efficiency: Automates complex decision-making and actions, speeding up processes.</li><li>Flexibility: Allows for dynamic workflows defined more easily.</li><li>User Experience: Enables natural language interfaces, simplifying tasks for managers and end-users.</li><li>Intelligence: Enhances workflow reasoning by incorporating natural language understanding and semantic analysis, enabling the agent to interpret complex instructions, policies, and context accurately during execution.</li></ul>Conclusion Agentic AI represents a significant step beyond simple LLM interactions. By granting AI the ability to reason, plan, and autonomously use tools, we unlock powerful new possibilities. In the IAM space, this could lead to more intelligent, efficient, and user-friendly ways to manage identities and access, transforming complex processes like workflow management into dynamic and flexible operations. The future of IAM looks increasingly autonomous and intelligent.

Reason, Plan, Act: Putting AI Agents to Work in IAM

The traditional organizational model in software development and IT consulting has long resembled a pyramid: a small layer of decision-makers and architects at the top, supported by middle management, and a broad base of developers executing the work. This structure worked well in a world where value is created primarily through manual coding and implementation. But with the rise of large language models (LLMs) and AI agents capable of reasoning, generating code, and automating tasks, the game is rapidly changing. We are now witnessing the emergence of a new model that resembles a diamond more closely. In this paradigm, the broadest layer of the organization is no longer at the bottom but in the middle. The core value creators are no longer just software developers but domain experts, knowledge workers, and AI engineers who translate complex expertise into structured prompts, tasks, and workflows for AI agents.<figure id="figure-n6w3941a6ym8pyx4cm"><img id="n6w3941a6ym8pyx4cm" src="https://cdn.durable.co/blocks/1f7JFu89rKTrgVHzurYGsUqAIGUgCbbIeB99ygH1rGRg6X0bvmybQygwVRc4ZwyD.png" alt="How AI reshapes the Organization of Software and IT Consulting companies (and not only…)" title="How AI reshapes the Organization of Software and IT Consulting companies (and not only…)" class="object-cover bg-gray-100 rounded-sm md:rounded-md lg:rounded-lg" style="aspect-ratio: 16/9; object-position: undefined undefined;" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/blocks/1f7JFu89rKTrgVHzurYGsUqAIGUgCbbIeB99ygH1rGRg6X0bvmybQygwVRc4ZwyD.png" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure>Knowledge and Natural Language become the New CodeIn the diamond model, the organization's foundation is deep domain knowledge: industry-specific insights, business logic, regulatory nuances, and strategic context. This knowledge is no longer "thrown over the wall" to developers. Instead, it's actively curated, structured, and encoded into prompts and data that can guide LLMs and AI agents.The traditional developer's role is evolving into something new: AI/LLM Engineers, who act as translators between human expertise and machine reasoning. They are responsible for transforming domain knowledge into instructions that LLM-powered systems can understand and execute effectively. They don't just write code, they design prompts, orchestrate agent workflows, and fine-tune outputs based on real-world feedback.The Diamond Structure: A New Division of LaborIn this new structure, the layers of the organization shift:<ul><li>Top: Strategic leadership and governance remain essential but now include broad and real knowledge of AI</li><li>Middle (Broadest Layer): A large, empowered group of domain experts and AI engineers who create, manage, and optimize knowledge flows. This is where innovation and value creation happen.</li><li>Bottom: A way smaller team for Traditional Coders and IT Operations.</li></ul>This model is not just about efficiency, it's about scaling intelligence. The impact on the Cybersecurity and IAM industriesAI will reshape our beloved Cyber and IAM industries as well.<ul><li>Software vendors: Hire people who know your domain and let them write very good documents, as Natural Language is the new code.</li><li>Consulting and system integrators: forget about hiring “juniors” and achieve your EBIT thanks to their endless dedication to the company. SOC L1 and L2? Gone. Junior Building connectors in IAM platforms? Gone.</li><li>Auditors, Risk &amp; Compliance Professionals: Get ready to Audit AI-based applications. It's better than 'traditionally software-coded' applications, believe me. Policies are in Natural Language, so get prepared to write clear documents that can be reasoned upon by Large Language Models.</li></ul>ConclusionThe transition from a pyramid to a diamond organization is more than a reorganization: it's a fundamental rethinking of how value is created in the age of AI. As knowledge and natural language become the new code, and AI agents take on increasing responsibility for reasoning and execution, organizations must embrace this shift or risk being left behind.

From Pyramids to Diamonds: How AI reshapes the Organization of Software and IT Consulting companies (and not only…)

Munich/Bologna, 6/03/2025 IAMONES announces signing a global partnership agreement with iC Consult, a world leader in IAM consulting, integration and managed services.This agreement, effective January 2025, marks a significant step in the collaboration between the two companies, which aims to provide AI-powered solutions for secure digital Identity Management on a global scale.Named "Rising Star" by KuppingerCole Analysts in December 2024, IAMONES focuses on erasing complexity in the Identity management domain through Natural Language. With his motto "Ask Anything, Configure everything using only your Mother Tongue", IAMONESvhas quickly gained recognition for its unique approach to using Large Language Models to meet the AI-modernization needs of big companies with legacy IGA solutions that are often complex to use and expensive to maintain. iC Consult is the trusted partner for Identity-driven Cybersecurity and Identity &amp; Management, offering over 25 years of industry-leading expertise. With a global team of 850+ professionals and a strong network of top-tier partners, iC Consult provides scalable, world-class identity solutions. The partnership between IAMONES and iC Consult aims to combine the agility and innovation of a pure-play "Born on the Cloud and LLM"start-up with an industry leader's expertise and established network. Through this collaboration, IAMONES will gain access to a global network of clients and partners, while iC Consult will enhance its offering with innovative solutions developed by IAMONES. "The collaboration with iC Consult represents an extraordinary opportunity to accelerate our growth and expand the impact of our Conversational IAM platform in the global market" said Andrea Rossi, CEO of IAMONES.&nbsp; "By combining our expertise, we will be able to offer a simpler and more reactive Identity-centric Security”."We are excited to welcome IAMONES into our global partner network" commented Andre Priebe, CTO of iC Consult. “GenAI is a game changer in the IT landscape, and we are committed to leveraging this incredible potential for our clients in a secure and reliable way. The collaboration with IAMONES allows us to make IAM more efficient and more secure".About iC Consult iC Consult is the world-leading independent consultancy, systems integrator, and managed services provider for identity-driven cybersecurity. Our team of over 850 experts is committed to delivering next-level solutions tailored to the unique needs of our clients worldwide. We achieve this by continuously driving innovation, leveraging cutting-edge technology, and partnering with leading identity and cybersecurity vendors, as well as renowned analyst firms.&nbsp;Identity is our specialty: Our end-to-end service portfolio covers all aspects of professional and managed services in identity security including advisory, architecture, implementation, integration, support, and operations. We help our clients navigate key initiatives such as zero trust, identity threat detection and response, IAM cloud migration, and more to ensure they stay ahead in cybersecurity. With a strong global presence spanning North America, Europe, Asia, and beyond, we ensure the security and expert management of digital identities for the world’s largest brands.&nbsp; <a data-mce-href="http://www.ic-consult.com" href="http://www.ic-consult.com">www.ic-consult.com</a>

iC Consult and IAMONES sign a Global Partnership to deliver AI-Innovation in Identity & Access Management (IAM)

IAMONES has been recognized as a Rising Star in the latest KuppingerCole Analysts Report on Identity Governance &amp; Administration (IGA).&nbsp;Being acknowledged by a leading analyst firm validates our vision: modernizing IGA with AI-powered conversational interfaces that make identity governance more intuitive, efficient, and secure.<h3>Why IAMONES? </h3>The Problem with Traditional IGA Identity Governance &amp; Administration (IGA) is a critical part of cybersecurity, ensuring the right people have the right access at the right time. However, legacy IGA solutions are often:❌ Complex – Role management and policy enforcement require expert knowledge❌ Difficult to use – Traditional interfaces are not user-friendly❌ Expensive to maintain – Upgrades and overhauls are costly and time-consumingAt IAMONES, we saw a clear need for a better way to manage identity governance—one that doesn’t require ripping and replacing existing systems.Our core innovation is the IAMONES Conversational Identity Platform, which integrates with any existing IGA system and transforms how users interact with identity governance.<h3>Why KuppingerCole Named Us a Rising Star</h3>The KuppingerCole report recognizes IAMONES as a game-changer in the IGA market, thanks to our innovative approach to solving long-standing identity governance challenges.The report highlights:✔️ Enhanced IGA Efficiency – Our conversational AI interface eliminates complexity and improves usability✔️ Cost-Effective Modernization – Businesses can upgrade without replacing existing infrastructure✔️ Security-First Approach – Our LLM Firewall ensures AI-powered automation meets strict security and compliance standards✔️ Future-Proof Solution – Our platform is flexible, extending into areas like Privileged Access Management (PAM) and Threat Intelligence (XDR)<h3>Read the Full Report </h3>We’re proud to be recognized as a Rising Star by KuppingerCole, and we invite you to explore why IAMONES is shaping the future of Identity Governance &amp; Administration.➡ Click <a data-mce-href="https://iamones-my.sharepoint.com/:b:/g/personal/claudiac_iamones_onmicrosoft_com/EZSSCmTxc7lNpxNC5i9fAOEBNp8lhZO-2zGdthRQrRno7A?e=g6dyvD" href="https://iamones-my.sharepoint.com/:b:/g/personal/claudiac_iamones_onmicrosoft_com/EZSSCmTxc7lNpxNC5i9fAOEBNp8lhZO-2zGdthRQrRno7A?e=g6dyvD" title="Rising Start KuppingerCole Analysts Report: IAMONES" target="_blank">Here</a> to read the full report.

The Future of Identity Governance: Read the KuppingerCole Rising Star Report

Hexagon shell with binary code and glowing Fingerprint icon. Protection against hacker attacks and data breach.  Safe your data. Internet security and privacy concept. 3d illustration

Hold on to your firewalls, because the bad guys aren’t just coming for your code anymore, they’re targeting your words. With the rise of SaaS platforms powered by Large Language Models, a new and unsettling frontier of cybersecurity is emerging: natural language exploits. This phenomenon will redefine the threat landscape, making exploitation more accessible than ever. We’ll explore natural language vulnerabilities, why they’re dangerous, and what solutions will reshape how we approach cybersecurity.<h3>The Rise of Natural Language Vulnerabilities</h3>Traditional cybersecurity exploits typically rely on vulnerabilities in code: bugs, misconfigurations, or other technical flaws that require a certain level of expertise to exploit. Natural language exploits, however, take a fundamentally different approach. They leverage the inherent complexity of human language, exploiting tone, ambiguity, and context in ways that LLM-powered systems fail to anticipate. What makes these vulnerabilities particularly dangerous is the low barrier to entry. Exploiting them doesn’t require technical expertise; anyone who can type a carefully worded sentence is a potential threat actor. Whether it’s bypassing content filters or manipulating LLM responses, the possibilities are as vast as the nuances of language itself. <h3>Why Traditional Defenses Fall Short </h3>Rule-based firewalls and traditional cybersecurity tools struggle with the complexity of natural language, which is dynamic and context-dependent, unlike strictly structured code. For example, a seemingly benign sentence could mask harmful intent, slipping past a rule-based system undetected. These shortcomings demand a paradigm shift in how we think about cybersecurity in the age of LLMs.<h3>Advanced Solutions: The Next Generation of Defense</h3>To counter natural language exploits, the cybersecurity industry must focus on NL firewalls, a new way of leveraging language understanding to detect and mitigate malicious content. Here are two key approaches we use at IAMONES: Fine-Tuned LLMs for Content Classification This solution involves fine-tuning large language models specifically for content classification tasks. By training these models on datasets rich in malicious and benign language examples, they can learn to recognize subtle indicators of exploitation, such as manipulative phrasing or contextually inappropriate responses. A notable example of this approach is <a data-mce-href="https://ai.meta.com/research/publications/llama-guard-llm-based-input-output-safeguard-for-human-ai-conversations/" href="https://ai.meta.com/research/publications/llama-guard-llm-based-input-output-safeguard-for-human-ai-conversations/" title="**Llama-Guard**" target="_blank" rel="noopener" data-mce-selected="inline-boundary">﻿Llama-Guard</a>, a fine-tuned LLM developed by Meta designed to safeguard human-AI interactions by monitoring input and output for malicious or unsafe content. Encoder-Only Transformer Models While decoder-only architectures dominate the LLM landscape, encoder-only Transformer models (such as BERT) can be a more efficient alternative for classification tasks. These models are optimized for understanding input text and are particularly well-suited for detecting and categorizing malicious content with high precision.<h3>A Sentence as a Weapon</h3>We’ve entered an era where a well-crafted sentence can act as a weapon. Whether it’s convincing an LLM to leak sensitive information, bypass restrictions, or produce harmful content, the potential for harm is significant. But while the risks are real, so are the solutions. By embracing a multi-faceted approach to cybersecurity, we can effectively address the challenge of natural language exploits. The age of natural language vulnerabilities is here, but we are not powerless.

The New Frontier of Cybersecurity: Natural Language Exploits

<h2>NIS2, Third Party Risk, IAM: Connecting dots and DOCS</h2>Third-party risk management is vital for compliance with NIS2. NIS2, as well many other regulations such as DORA, expands its scope to include more organizations and enforces stricter requirements for managing supply chain risks. Third-party identities, especially those of IT consultants, differ from traditional employee identities. While employees follow predictable patterns tied to job roles and HR systems, IT consultants are dynamic, wearing multiple hats, accessing diverse systems, and posing varied risks.<h3>Core Questions for Third-Party IAM</h3>1. Role Clarity:<ul style="list-style-type: circle;" data-mce-style="list-style-type: circle;"><li>Who are the IT consultants?</li><li>What are their tasks and deliverables across projects?</li><li>Which data and IT resources do they access?</li></ul>2. Risk Assessment:<ul style="list-style-type: circle;" data-mce-style="list-style-type: circle;"><li>How are consultants scored or assessed for risk?</li><li>Have any of them been involved in security incidents, such as credential leaks?</li></ul>3. Data Source Integration:<ul style="list-style-type: circle;" data-mce-style="list-style-type: circle;"><li>Where and how is critical information (like project roles, permissions, and risks) captured?</li><li>Can this data be easily extracted and used for compliance and decision-making?</li></ul><h3>The IAMONES Solution</h3>IAMONES brings an innovative approach by leveraging a fine-tuned Large Language Model (LLM) integrated with Retrieval-Augmented Generation (RAG) to address these challenges. Here's how: Unlocking Natural Language InsightsDocuments such as Statements of Work (SoW), Data Processing Agreements (DPA), and Project Documents often hold the key to answering identity-related questions. With IAMONES:<ul style="list-style-type: circle;" data-mce-style="list-style-type: circle;"><li>Document Analysis: The system extracts actionable insights from unstructured text. </li><li>Conversational Queries: Natural language queries like "Who is working on X?"; or "What permissions does Y have?"; are resolved with precision.</li></ul>Enhanced TPRM Through Identity Intelligence <ul style="list-style-type: circle;" data-mce-style="list-style-type: circle;"><li>Comprehensive Consultant Tracking: Understand each consultant's roles, data access, and permissions.</li><li>Real-Time Risk Scoring: Leverage document-derived insights to assess risk dynamically.</li></ul><strong style="font-family: var(--head-fontFamily); font-size: calc(32px * var(--head-fontSize, 1)); font-style: var(--head-fontStyle, normal); background-color: rgba(249,250,251,var(--tw-bg-opacity));" data-mce-style="font-family: var(--head-fontFamily); font-size: calc(32px * var(--head-fontSize, 1)); font-style: var(--head-fontStyle, normal); background-color: rgba(249,250,251,var(--tw-bg-opacity));">Key Benefits1. Efficiency: Eliminate manual processes by automating document analysis and identity verification. 2. Risk Reduction: Proactively address supply chain risks by identifying vulnerabilities in third-party access and credentials. 3. Regulatory Compliance: Ensure adherence to emerging standards with real-time insights and robust documentation.

NIS2, Third Party Risk, IAM: Connecting dots and DOCS

iamones

identity & access management

Poppins

Roboto

This website uses cookies. Please refer to the Privacy &amp; Cookie policy for more details.

Blog

Reason, Plan, Act: Putting AI Agents to Work in IAM

From Pyramids to Diamonds: How AI reshapes the Organizati...

iC Consult and IAMONES sign a Global Partnership to deliv...

The Future of Identity Governance: Read the KuppingerCole...

The New Frontier of Cybersecurity: Natural Language Exploits

NIS2, Third Party Risk, IAM: Connecting dots and DOCS