This ist the first part of our two-part-interview with Orchid Security. Firstly, we talk to Roy Katmor – CEO & Co-Founder. Identities took on a vital role in the modern IT landscape. Together we talk about the complexities of these systems, what many fail to do in their identity security model and much more.
In our second part we focus on the DACH and enterprise perspective with Günther Müller – Director DACH & Italy at Orchid Security. We ask ourselves: What do many CIOs overlook in the DACH region? How does Cloud, OT, and AI change identity challenges in DACH? And much more.
Orchid Security is Platinum Partner at the Confare CIOSUMMIT in Vienna. If you want to talk more about identity security models, meet them at their booth. Sign up HERE.
Part 1 – Why have identities become so central to digital transformation?
Identity has become the control plane of the enterprise.
As organizations moved to cloud, SaaS, APIs, M2M, automation, and now agent-AI, everything meaningful began to happen through identities. Applications don’t talk to networks, they talk to identities. Employees don’t access systems, identities do.
Digital transformation didn’t just add software; it multiplied identities, relationships, and permissions beyond what manual processes can handle. Identity is no longer IT hygiene, it’s the operational fabric of the business.
What is fundamentally broken in today’s identity security model?
The industry still treats identity as a static access problem, while reality is dynamic, behavior- and risk-driven.
Most IAM and IGA systems are built around snapshots: roles, entitlements, certifications, and point-in-time approvals, and are lightly utilized due to onboarding and integration challenges. They focus on managed applications and try to answer “Should this identity have access?”
What they miss is the identity dark matter: local, orphaned, unmanaged, and non-governed identities, and what those identities are actually doing.
As a result:
- Over-provisioned access becomes the norm
- Remediation is slow and manual
- Security teams manage theoretical risk while real exposure goes unnoticed
In short, we’ve partially optimized for compliance workflows, while remaining largely blind to how identities are actually abused in the real world.
Orchid Security is Platinum Partner at the Confare CIOSUMMIT in Vienna. If you want to talk more about identity security models, meet them at their booth. Sign up HERE.
How do Zero Days change the role of identity in security?
Zero Days don’t break systems, they abuse trust.
When a Zero Day hits, traditional controls fail fast. What remains is identity: which identity is compromised, what it can access, and how far it can move.
That makes identity the blast-radius limiter, not as a gatekeeper, but as a real-time risk surface:
- Which identities are exposed?
- What can they reach right now?
- How fast can we contain impact without stopping the business?
Zero Days force identity to become an active, real-time security domain, not a configuration artifact.
Looking ahead, what needs to change in identity security?
Three things, fundamentally:
- From IAM operations to an identity control plane
Manual inventories and non–risk-based onboarding don’t scale. Identity security must stand as a first-class, risk-based orchestration alongside endpoint, cloud, and data security.
- From entitlement-centric to exposure-centric
Stop counting permissions. Start understanding effective exposure, what identities can actually do across systems and data.
- From manual remediation to system-driven action
If remediation relies on tickets and quarterly reviews, it’s already too late. Identity security must operate dynamically at machine speed and integrate directly with enforcement.
At Orchid, we believe the future of identity security isn’t about replacing IAM, but completing it, turning identity into a living, risk-aware control layer for the enterprise.
Get to know your target audience personally. Become partner at the Confare CIOSUMMIT Vienna. Sign up HERE.
Part 2 – How well are enterprises in the DACH region positioned today?
Many organizations in the DACH region have invested heavily in IAM and have strong security teams. The challenge is not commitment, but visibility.
Across manufacturing, energy, finance, and retail, there are often hundreds or even thousands of applications that were never fully onboarded. Legacy systems, M&A environments, OT platforms, and shadow IT all contribute to blind spots.
This closely aligns with insights from The State of Identity in Europe report.
While many organizations express confidence in their IAM strategy, the data shows that visibility across the full application landscape remains limited.
Where do CIOs and CISOs feel the most pressure in practice?
Three issues come up consistently:
Application onboarding takes too long and consumes scarce resources.
Identity data inside applications is often outdated or incomplete.
Audits depend heavily on interviews and documentation instead of direct evidence.
This creates friction between security teams, application owners, and auditors, and it slows down the business.
Identity governance often sounds abstract. What does it look like in practice?
In practice, governance is very concrete. CIOs and CISOs want reliable answers to simple questions:
Which identities exist today?
Who or what had access, and when?
Does reality still match policy?
When these answers come directly from applications, governance becomes manageable. Without that insight, governance turns into guesswork.
How are Cloud, OT, and AI changing identity challenges in DACH?
They remove traditional boundaries. Identities now span IT systems, production environments, cloud platforms, and automated workloads.
In highly regulated and industrial environments, especially in DACH, visibility across these domains is essential. Without it, neither security nor compliance can be sustained.
How can organizations balance security, compliance, and usability?
By reducing manual effort behind the scenes. When discovery, analysis, and integration are automated, users experience less friction while security teams gain stronger control.
Good identity security supports the business rather than slowing it down.
What should CIOs and CISOs focus on right now?
Instead of asking which IAM tool to add next, a more important question is:
Do we actually see all identities and access paths that exist today, including those no one planned for?
That question usually leads to clearer priorities and better decisions.