45°58'35"N, 7°39'31"E
Identity Security
Build trust into every access decision.
From employees and partners to machine identities and AI agents, we design Identity & Access Management with traceable access rights and controls proven effective in day-to-day operations.
your challenges
Keeping pace with identity complexity
- Audits and regulations such as NIS2 and DORA demand clear, verifiable evidence of access rights.
- Replacing Microsoft Identity Manager or SAP IdM becomes increasingly urgent as support deadlines approach.
- You rely on Microsoft Entra ID, but access approvals remain difficult to trace with confidence.
- Copilot, Claude, and custom AI agents access company data, yet their permissions remain unclear.
- Critical IAM operations rely on a handful of specialists, putting continuity at risk.
- Service accounts, API keys, and other machine identities are multiplying faster than the processes designed to govern them.
The problem
Access outlives its purpose
Onboarding clearly defines who gets access to what. Offboarding is often less rigorous. Accounts and credentials remain active long after they are needed, with no clear owner: a former contractor’s account from 2021, a service account left behind after a migration, or an API key buried in an abandoned script.
Machine identities receive even less scrutiny. Access reviews typically focus on people, leaving service accounts and API keys outside the review process altogether.
These gaps often go unnoticed until evidence is required. During an audit, conducting access reviews alone is not enough. Auditors examine selected departures to verify exactly when access was revoked and in which systems. Without proper documentation, even access that has been removed cannot be proven.
Why SECURIX
Our commitment goes beyond go-live
We’ve supported some identity environments for more than a decade. Identity Security doesn’t end at go-live. Roles evolve, new systems are introduced, employees change positions, and temporary access often becomes permanent.
That’s why every IAM project includes a plan for what happens afterward. SLA-based support and the continuous development of your environment are an essential part of our work.
- MANN+HUMMEL
Omada Identity brought AD accounts and access rights under centralized management. Required reports can now be generated in just a few clicks. - BKW
Omada Identity on Azure for more than 150 group companies, with ongoing SLA-based support and continuous development by SECURIX. - Luzerner Psychiatrie
As digital services expanded, Luzerner Psychiatrie needed a scalable IGA solution to reduce manual user management and support regulatory compliance. - Swiss Red Cross
The Swiss Red Cross selected Omada Identity Cloud to manage 2,400 identities. Omada names SECURIX as a partner involved in the project.
- 15 years Omada partnership
- 25+ IAM specialists
- 24/7 Service desk with agreed service hours and regular SLA reporting
our services
From initial assessment to ongoing operations
-
We identify every person and machine that can access your systems. Employees, external users, service accounts, API keys, and other Machine Identities are assigned a clear purpose and a responsible owner. We also clean up source data to establish accountability for each account. This gives you visibility into existing identities, including access that is no longer needed.
-
We assess whether your security controls are consistently enforced across all access paths. This includes MFA, legacy protocols, integrations, and exceptions. Any necessary exceptions are assigned a responsible owner and an expiration date.
-
We establish Joiner, Mover, and Leaver processes that reliably trigger and document access changes. Approvals and Access Reviews cover employees, partners, and Machine Identities. This ensures permissions are updated as roles and responsibilities change.
-
With Privileged Access Management, we replace standing administrative privileges with time-limited access. Elevated permissions are granted when needed and revoked afterward, preventing unnecessary administrative rights from remaining active.
-
Our involvement continues beyond go-live. We provide support with defined response times under our SLA, alongside recurring Access Reviews, audit reporting, and adjustments for new systems or organizational changes. This keeps your identity environment and supporting evidence up to date, rather than requiring everything to be gathered before each audit.
We recommend technology only after understanding your environment. We work with platforms for IGA, PAM, and Access Management, and we’ll tell you when a new product isn’t necessary.
how we support you
From consulting to ongoing operations
For clearly defined initiatives, we handle assessments, architecture, solution design, and implementation. We integrate HR systems, Active Directory, Microsoft Entra ID, and target systems, and support testing, acceptance, and go-live.
When your team needs additional expertise or capacity, our specialists work directly alongside you. We support IAM architecture, requirements engineering, and project management for clearly defined tasks or project phases.
After go-live, we support your IAM operations through an SLA. Our service desk provides second-level support with service hours from 5 × 9 to 7 × 24 and defined response times, plus a pool of support hours, SLA reporting, and regular service meetings.
the bigger picture
Access is only the beginning
Even properly approved access can pose a security risk. An IAM or IGA platform alone cannot tell you whether that access is actually being used, whether unusual activity is taking place, or whether an account has remained dormant for years.
- Identity: How do we secure access to what matters?
- Observability: How do we detect & respond to security threats?
- Advisory: How do we manage security risks & verify compliance?
We connect identity events from IGA, PAM, and directory services with logs and security events to reveal the bigger picture behind every access. This allows us to understand even a login at 3 a.m. in its full context, rather than viewing it as an isolated event.
Entitlement reports, documented approvals, and access reviews provide the evidence auditors need. By capturing this evidence as part of daily operations, it remains readily available for audits without having to piece everything together at the last minute.
At SECURIX, our three disciplines work together, connecting the dots and turning operational insights into informed security decisions.
TechniCAL Expertise
The details behind the architecture
If you’re responsible for IAM architecture, you need a clear understanding of the protocols, integrations, and operating models that make it work. Here’s a closer look at the technical foundations of our approach.
For federation and single sign-on, we use SAML 2.0 and OpenID Connect (OIDC). Provisioning runs through SCIM 2.0 where supported, or through connectors and APIs when needed.
We integrate existing environments using LDAP and Kerberos, and connect VPN and network infrastructure through RADIUS. Where NTLM is still in use, we plan for its eventual replacement. OAuth 2.0 enables delegated authorization, including token exchange and MCP authorization for AI agents.
For communication between services, we favor managed identities, workload identity federation, and certificates over static secrets. Passkeys, FIDO2, and WebAuthn provide phishing-resistant authentication, while X.509 certificates enable certificate-based machine identities.
Our authoritative sources for employee identities include HR platforms such as SAP SuccessFactors, SAP HCM, Workday, and Abacus. For partners, we integrate contract management and CRM systems, while asset registers and CMDBs provide the foundation for device identities. We also work with Active Directory, Microsoft Entra ID, and hybrid environments.
Typical target systems include SAP, Microsoft 365, Salesforce, Atlassian, ServiceNow, file services, databases, and Linux and Windows servers. Kubernetes workloads and custom applications are integrated through APIs or database connectors.
Whether SaaS, private cloud, or on premises, we establish your data residency requirements in Switzerland or the EU before selecting the right platform.
We identify critical combinations of access rights across systems, particularly in SAP environments, and ensure they are clearly documented throughout access requests and reviews.
We feed identity events into your SIEM and manage requests and tickets through your ITSM platform, such as ServiceNow.
We start by examining authentication patterns. Domain controller logs reveal which accounts sign in without user interaction, where those requests originate, and how frequently they occur. We also examine directory accounts for missing owners, absent interactive logins, Service Principal Names (SPNs), and passwords configured never to expire.
Our discovery covers service principals, app registrations, and managed identities in Microsoft Entra ID, alongside AWS roles, GCP service accounts, Kubernetes service accounts, and AI agents. We also review certificate inventories from internal certificate authorities, scan repositories and pipeline configurations for secrets, and examine scheduled tasks and server services. API gateways and integration platforms provide further insight.
These findings form a comprehensive identity inventory, documenting each identity’s owner, purpose, privilege level, credential rotation status, and last recorded use. Authentication data helps determine whether access is still needed. Unnecessary access is then retired in stages, starting with restrictions before moving to deactivation and eventual removal.
Four records are essential for a successful audit: a current entitlement report for every system in scope, an approval record for each access grant, documented access reviews conducted at defined intervals with named reviewers, and evidence showing exactly when access was revoked after an employee’s departure.
The first three can usually be assembled retrospectively. The fourth is often where audit findings arise. When access is revoked manually without a timestamped record, the action may have been completed, but the evidence needed to prove it is missing.
We detect suspicious sign-ins and block them before access is granted, extending protection to legacy systems that do not support MFA.
Getting started
Know where to focus next
Our checks and assessments provide a clear picture of your current cybersecurity posture, revealing where action is needed and helping you set the right priorities to move forward with confidence.
SECURIX developed product
Non-human Identity Discovery X Ray
A discovery assessment of your non-human identities, including service accounts, credentials, AI agents and cloud workloads, that uncovers the ownership, privilege and lifecycle risks behind them.
SECURIX developed product
IGA Starter Package
A standardized entry into identity governance that automates joiner, mover and leaver processes, provisioning and access approvals, with a production-ready baseline live in 3–5 months which you can expand over time.
SECURIX Developed Product
Identity Security Maturity Assessment
A structured, independent assessment of your identity governance, processes, technology and operating model, with a maturity score, prioritised gaps and a roadmap for what to fix first.
Frequently asked questions
Before we get started
Not necessarily. Microsoft Entra ID already covers many identity and access management needs. A dedicated IGA platform may become valuable when your environment includes on-premises or SAP systems, segregation of duties across multiple systems, several HR data sources, or complex role structures.
No. Many identity environments combine cloud and on-premises infrastructure. Active Directory and Microsoft Entra ID can remain part of your architecture and integrate seamlessly into a modern IAM or IGA framework.
Assessment and design typically take a few weeks, while a pilot may take several months depending on its scope. For clearly defined IGA projects, go-live is often achievable within three to five months.
We never delete an account without an agreed decision. First, we establish who is responsible, what the account is used for, and whether it is still needed. If no owner can be identified, we follow a controlled, reversible deactivation process before permanent removal.
Your team remains in control of the platform, while we provide ongoing support under an agreed SLA. Our service desk offers second-level support with defined response times and a dedicated pool of support hours.
Replacing the platform isn’t always the answer. We first identify whether the underlying issues lie in the technology, role model, processes, data quality, governance, or day-to-day operations.
That depends on the platform and operating model. Whether you prefer SaaS, private cloud, or an on-premises deployment, we clarify your data residency requirements during the assessment, before any platform decision is made.
Your team primarily contributes decisions and knowledge of your environment. We’ll need input from system and account owners, HR for authoritative data, and someone responsible for setting priorities. We handle the implementation and estimate the effort required from each role during the assessment.
We work with several IGA, PAM, and Access Management platforms and maintain partnerships with selected vendors. Our recommendations are guided by your environment and requirements, not by a particular product. If you don’t need a new solution, we’ll tell you.
AI agents need clear ownership, a defined purpose, limited access rights, and traceable activity, just like any other machine identity. We include them in your identity inventory and apply the same governance processes used for service accounts.
your next step
Your environment sets the direction
You don't need to know whether IGA, PAM, machine identities, or something else should come first. We start by understanding your environment, then help you identify where the next step will make the greatest difference.
