The role of self-sovereign identity in evolving enterprise IAM

Identity and Access Management (IAM) has long been key to enterprise cybersecurity. It encompasses the processes and technologies used to manage digital identities and control access to systems, applications, and data. Traditional IAM systems typically rely on centralised architectures where identity information is stored and managed by a single authority or through federated identity providers. These systems authenticate users using credentials like passwords and assign access rights based on roles or attributes.

However, as digital ecosystems grow in complexity, the limitations of centralised IAM systems have become more apparent. They are costly to manage, difficult to scale across hybrid environments, and vulnerable to credential-based attacks such as phishing and brute force. The rise of remote work, increased compliance demands, and increased third-party integrations further expose their weaknesses. For instance, a data breach at a major enterprise may trace back to a compromised employee password, revealing just how fragile traditional authentication methods can be.

In response to these challenges, Self-Sovereign Identity (SSI), also referred to as decentralised identity or user-centric identity, is emerging as a promising alternative. SSI shifts control over digital identity from centralised entities to the individual. Rather than being managed by the organisation, identity credentials are issued by trusted authorities but held securely in a user-controlled digital wallet. These verifiable credentials can then be presented to systems or services as proof of identity, using privacy-preserving cryptographic techniques.

This speech will introduce the concept of SSI through enterprise use cases. Recent research, including a systematic review of IAM requirements in enterprise environments, identifies four overarching dimensions critical to effective IAM: security and compliance, operability, technology, and user-centricity. These categories encompass concerns such as regulatory alignment, access control enforcement, automation, interoperability, credential management, and overall user experience. The reviewed literature and expert insights point to growing frustration with the complexity and rigidity of traditional IAM systems, particularly regarding cross-organisational collaboration, administrative overhead, and dependency on central authorities.

In light of these findings, this session explores how self-sovereign identity may offer meaningful contributions across these four dimensions. By decentralising credential issuance and verification, SSI could support greater automation, improve system interoperability, and enhance user control and privacy. However, the adoption of SSI also introduces new challenges, including integration with legacy systems, governance of trust frameworks, and ensuring usability for non-technical users. These considerations will be discussed in the context of the broader evolution of IAM practices and technologies.

For IAM professionals and decision-makers, understanding how SSI redefines identity is crucial. As organisations strive to enhance security, reduce overhead, and meet evolving compliance needs, SSI offers a compelling vision for the next generation of enterprise IAM.