What Is Identity and Access Management (IAM)?
Identity and Access Management (IAM) governs who can access what, across every system. It is the control plane of modern security: as the network perimeter dissolves, identity has become the perimeter, and access decisions turn on who you are rather than where you are. Get IAM right and most of security follows; get it wrong and a single stolen identity unlocks everything.
What does IAM cover?#
IAM ties together the concepts from the fundamentals into an operational system:
| Concept | Question |
|---|---|
| Identity | Who or what is this? (users, services, devices) |
| Authentication | Are they who they claim? |
| Authorization | What are they allowed to do? |
| Least privilege | Do they have only what they need? |
| Lifecycle | Provisioning, review, and revocation |
That last point — lifecycle — is where many programs fail: access is granted freely but rarely reviewed or removed, so privilege quietly accumulates.
Why is IAM the modern perimeter?#
Because location no longer bounds access. Cloud services, remote work, and third-party integrations mean the old “inside the network = trusted” model is gone — the assumption that zero trust explicitly rejects. What remains as the reliable basis for access decisions is identity. And since most breaches involve compromised or over-privileged identities, IAM is where a great deal of real security is won or lost.
IAM is the control plane for access across the enterprise. More at the Defense & Hardening hub.
Frequently asked questions#
What is IAM?
Identity and Access Management (IAM) is the framework of policies and technologies that ensures the right identities have the right access to the right resources at the right time. It covers creating and managing identities (users, services), authenticating them, authorizing what they can do, and reviewing and revoking access — the control plane for who can do what.
Why is IAM so central to modern security?
Because identity has become the primary security perimeter. With cloud and remote work dissolving the network boundary, access decisions now hinge on identity rather than location. Most breaches involve compromised or over-privileged identities, so managing them well — with least privilege and strong authentication — is foundational to defense.