Published on the 16/06/2025 | Written by Newsdesk

More than just cybersecurity…

There’s an often-overlooked part of cybersecurity that Raymond Dickinson says can be transformational for local businesses securing access to digital resources, improving user experience and supporting compliance. The wunderkind?… Identity security.

“Identity security is an enabler for digital transformation. It is a foundation for cloud adoption, hybrid work and zero trust and enables you to transform your business so much faster,” says Dickinson, SailPoint New Zealand country leader.

“Without it, every project hits friction, risk or delay because teams just can’t move fast enough because at the end of the day, when people need to get access to the cloud there is an identity that needs access into that cloud.”

The discipline focuses on managing and protecting digital identities, ensuring the right people have the right access to the right resources at the right time and for the right reasons. It extends beyond just managing usernames and passwords, providing context aware, policy-driven controls enforcing a least-privilege access model for each digital identity.

While most local companies are currently managing cloud adoption manually, Dickinson says managing identity via a single tool enables cloud adoption to be dramatically sped up.

“Identity security is an enabler for digital transformation. It’s a foundation for cloud adoption, hybrid work and zero trust”

One area of identity security Dickinson believes has particularly big benefits for business and users alike is lifecycle management, or ‘joiner, mover leaver’, streamlining user on- and offboarding, improving productivity and creating a more secure, efficient and agile environment for businesses.

“It automates the processes of new hires to get the right access from day one, enabling them to be productive and feel like they are delivering value from day one, which has a huge user experience impact.”

That extends throughout their time with the organisation – if they change roles or are temporarily assigned to help another team, they can gain the access they need quickly and easily.

Access can be instantly deprovisioned when they leave the organisation.

Also included is the facility to enable users to self-service and for requests to be routed to the appropriate person for approval and for policies to be enforced; risk-based access controls to ensure dynamically based access is provisioned; and integration with MFA (multi-factor authentication) and single sign on to deliver strong authentication at the first log-on and simplify access across all apps.

Alongside the business transformation benefits are the cybersecurity benefits, protecting digital identities from unauthorised access, misuse and cyberattacks, and ensuring only authorised individuals and systems can access data and applications, helping prevent cyber risks including data breaches, account takeovers, and financial fraud.

Dickinson likens it to having a smart, evolving security guard at every digital door in your organisation, constantly checking who users are, what they should have access to, whether they are still authorised to be there and whether their behaviour is normal.

But while identity security has been a cornerstone of modern cybersecurity for several years, Dickinson says it remains one of the most overlooked areas for New Zealand organisations, with Kiwi organisations ‘significantly’ trailing Australian counterparts in identity security.

Part of that is down to the idea we’re not likely to be a target at the bottom of the world, and the ‘she’ll be right’ attitude, which he says has created complacency around cyberthreats, especially those originating from internal mismanagement, like identity misuse.

Adding to that complacency is the lack of regulation in New Zealand, compared to Australia, where regulatory risk drives greater cyber focus.

But Dickinson says even without the regulatory risk, there are plenty of good reasons for Kiwi businesses to be embracing identity security, including the business risks of doing nothing, with potential for data breaches from misused or excessive access.

“Without identity governance users – especially contractors and leavers – can often have too much access for far too long. Stolen credentials for insider misuse can go undetected and cause significant harm and that’s a risk we’ve seen here before.”

In the event of a breach, figuring out how someone got in, where they went, what they did also takes much longer without an identity security platform in place, Dickinson says.

SailPoint research suggests that every dollar invested in identity security delivers disproportionately higher returns. Unlike traditional cybersecurity spend which typically delivers linear returns, identity security spend can ‘bend the curve’, delivering more value than investments in other cyber capabilities, according to SailPoint’s Horizons of Identity Security 2024-2025 report.

Those disproportionately higher returns are observed through business value and productivity, alongside the higher risk reduction, with the report showing more advanced companies were seeing accelerated time to market and reduced friction, while productivity gains for mature identity security users were 22 percent higher than less mature organisations.

For organisations keen to get started in identity security – or to level up their existing identity security work – Dickinson says a key starting point is an identity maturity assessment to understand their current state, what is working, what is manual and where there are risks.

“Identity security is critical to any security strategy today, but it extends well beyond just cybersecurity benefits,” Dickinson says. “If it’s not already in your strategy, you need to be thinking about how you are going to do it and do it well.”