WIXLIB

installed on a Windows server). For the repository, Courion can use the customer's preferreddatabase. The most unique feature of Courion's product is that identity information does not coexistwith policy and rule definitions in the repository; its Dynamic Link technology is used to fetchauthoritative identity information from managed account repositories when it is needed for systemoperations.Strengths Although CourionLive does not offer parity with Access Assurance Suite in terms of overallfunctionality, it does provide a compelling deployment option for many customers at a lowerprice. Courion packages connectors, which are usually sold separately, to appeal to specific verticalmarkets such as healthcare, financial services, retail, energy and manufacturing. Access Assurance Suite provides one of the most business-friendly user interfaces in the IGAmarket for access requests, approvals and access certification.Cautions Courion's IGA product line remains confusing to prospects because of the many potentialcombinations of modules and connectors. New offerings and methods of delivery exacerbatethat confusion. Courion has experienced multiple reorganizations in recent years that have had a negativeimpact on partners and customers, which has affected sales, support and deployments/upgrades. Courion has a weak partner ecosystem and one of the lowest percentages of deploymentprojects that have participation from partners and system integrators.CrossIdeasCrossIdeas, which is based in Rome, was established in 2011, but traces its origins back to 2001 asa company called Engiweb Security. The company operates in the IGA market exclusively with itsIDEAS (IDEntity and Access governance Solution) suite, which supports IGA functionality throughthree modules: IDEAS Access Governance Foundation, IDEAS Access Provisioning and IDEASAccess Analytics. IDEAS is a Java EE Web application that runs with multiple application servercontainers (JBoss, WebSphere and WebLogic) on Windows, AIX, Solaris and Linux platforms. It canuse Oracle or PostgreSQL databases for its repository.The IDEAS suite of modules provides the full range of IGA functionality, as well as externalizedauthorization enforcement for attribute-based access management. IDEAS offers a unique objectrelational data model known as Access Warehouse that supports fine-grained management ofentitlements and flexible modeling of roles, organization information and business activities. IDEAShas also been developed to include an inherent multitenancy architecture that promises easiertransition to cloud-based hosting arrangements.Gartner, Inc. G00253758Page 7 of 39

Strengths CrossIdeas has embarked on an aggressive push to expand its partners program, including anew cloud delivery (IGA as a service) with a white-box OEM program, allowing partners todeliver IDEAS solution components with their own branding, distinctive content, service levelsand pricing models. CrossIdeas has cultivated a reputation as one of the most innovative companies in the IGAmarket in terms of product features and delivery/pricing models. CrossIdeas possess an unusually clean model for managing identities, attributes, accounts,roles and entitlements. IDEAS has anticipated the need to coexist with other IGA products by offering connectors toutilize some competitors' provisioning systems for fulfillment.Cautions CrossIdeas has limited platform support for pure Microsoft-based infrastructures, including thelack of support for SQL Server and .NET. CrossIdeas has a small customer base and limited channels into international markets, whichcontinues to be a challenge. Recent changes in its international sales and marketing strategyhave yet to bear fruit. Despite a track record that demonstrates superior vision and innovation, CrossIdeas remainslargely unknown outside Europe.Deep IdentitySingapore-based Deep Identity had focused on access governance, beginning with its founding in2009. The company's restructuring in 2013 resulted in changes to its focus and road map. Althoughsmall compared with other vendors in this market, Deep Identity remains the only IGA productvendor Gartner has identified that is headquartered in the Asia/Pacific region.The relevant Deep Identity offerings for IGA are its Identity Audit & Compliance Manager (IACM) andIdentity Manager (IM) products. The products are .NET Web applications that run with the IIS Webserver on Windows 2008 servers, using Microsoft SQL Server as the repository. Beyond IGAfunctionality, Deep Identity has a file-server plugin called BigData Governance & Administration thatallows governance to be extended to cover unstructured data as well.Strengths Deep Identity architecture can be deployed in multitenant cloud-ready configurations whererequired. IACM and IM have out-of-the-box policy templates for performing user and role SODcompliance checks, and include a basic risk-scoring methodology and some data accessgovernance functionality.Page 8 of 39Gartner, Inc. G00253758

Deep Identity has very competitive pricing compared with other IGA vendors.Cautions Deep Identity IACM is based predominantly on Microsoft infrastructure and developmentenvironments, though it does provide adapter support for other platform environments. Company recognition is primarily confined to markets in Asia/Pacific, including China,Indonesia, Vietnam and Australia. Deep Identity must continue to compete with bigger IGA vendors that attract larger Asia/Pacificcustomers. Moreover, the company lacks feature differentiation aside from some flexibility in itsadapter architecture.DellDell, which is based in Round Rock, Texas, offers IGA functionality with Quest One IdentityManager (Q1IM). The product, which will soon be rebranded Dell One Identity Manager, came toDell through the acquisition of Quest Software in 2012. Q1IM expands Dell's IAM supportsignificantly beyond the current Microsoft-centric audience, and provides an effective foundation foran identity data model as part of an IGA solution. Q1IM can also be deployed with Dell OnePassword Manager. Other options include the Dell One Quick Connect Sync Engine and the DellOne Quick Connect Virtual Directory Server. Q1IM is written for the .NET environment and runs onWindows or on Linux and Unix using the Mono .NET framework. It uses a service-orientedarchitecture that allows application components to run on separate systems. Oracle or MicrosoftSQL Server can be used for its identity data warehouse.The identity data and log model for Q1IM is known as the Unified Namespace. It is declarative andprovides object-oriented database capabilities in an SQL environment. All manual and systeminitiated actions in Q1IM are traced and stored. A proprietary analytics tool provides correlation andanalysis. More than 40 standard reports are delivered out of the box by Q1IM's reporting tool, and areport designer is provided. Risk scoring of access during policy checking, mining and discovery issupported.Strengths Dell offers an identity vision, strategy and portfolio that spans administration and governancewithout an undue focus on any single platform or software development environment. Dell can leverage a strong global presence throughout the world based on an extensive networkof resellers, value-added resellers (VARs) and system integrators. Dell's support offering includes a user community where customers can interface with R&D.Gartner, Inc. G00253758Page 9 of 39

Cautions Dell's pricing model favors smaller companies, but can be expensive for larger companies,especially with add-ons. Dell has not been successful with any distinctive marketing, as IAM products are not highlightedas part of Dell's enterprise software offerings. Dell's current restructuring plans create a level of uncertainty: All products in the IAM portfoliohave experienced some upheavals over the past few years — first after being acquired byQuest Software and then following Quest's acquisition by Dell.EMC (RSA Aveksa)Aveksa was acquired by EMC in July 2013, and is now part of RSA, The Security Division of EMC.RSA Aveksa's Identity and Access Management Platform consist of the core component AccessCertification Manager with several additional optional modules (Access Request Manager, AccessFulfillment Express [AFX], Business Role Manager and Data Access Governance). RSA Aveksa,based in Waltham, Massachusetts, also offers MyAccessLive, a cloud-based SaaS version of itsIGA offering, that includes single sign-on features via a OneLogin partnership.Most components of the Access Management Platform are Java-based, running on Linux and Unixplatforms within WebLogic, WebSphere or JBoss application servers, and using an OracleDatabase as a primary identity repository. The business client interface is a Web browser. AFXemploys an open-source enterprise service bus (ESB) that is composed of public messagedefinitions, interaction patterns and adapters. It has now been extended to SaaS applications, suchas salesforce.com and Google Apps.RSA Aveksa's identity data and log model uses its Access Management Database called XMDB tocombine identity information and log data in the same repository for report intelligence. Workflow,analytics, rule processing, administration and reporting are available. Mining and discovery toolsscan for key identity data in applications and systems to help populate the XMDB for use.Strengths EMC's acquisition of Aveksa embeds Aveksa's products into a viable IAM suite offering, and isexpected to boost sales and geographical reach. A best-practice proof-of-concept process, aggressive pricing, improvements in scalability, highmaintenance renewal rates and an expanding partner list are providing Aveksa with continuedmomentum in the IGA market. Aveksa's clean data model and architecture emphasize configuration instead of customizationto achieve flexibility and adapt to customers' specific demands, as well as to simplifydeployments and future upgrades.Page 10 of 39Gartner, Inc. G00253758

Cautions Aveksa's AFX module that offers provisioning and deprovisioning has yet to reach parity withthe breadth and depth of features available with other, longer-established user administrationand provisioning (UAP) products. Aveksa's channel sales strategy has lagged behind its main competitors, and will likely lag untilthe RSA channel ecosystem is engaged with the Aveksa solution. Aveksa is not invited to participate in RFI and/or RFP processes as often as some of itscompetitors, and needs to improve market awareness of its products in order to avoid beinginadvertently overlooked.e-trustSao Paulo, Brazil-based e-trust offers an IGA product called Horacius. The product, which has beensold since 2006, evolved from e-trust's experience with professional services engagements withinIAM projects. Horacius was developed with a focus on security and governance. This has led e-trustto develop many features out of the box. Horacius emphasizes configuration over customization.Horacius provides access request workflow functionality and tools to create managerial approval,multiple data owner approval, incident management, and segregation of duties. Horacius supportsmultiple data feeds in order to cater to complex corporate structures with many HR systems, andprovides connectors to automate provisioning on Microsoft AD, Microsoft Exchange, SAP, LDAP,Web Services and Oracle with optional password synchronization. Discovery tools are available onall connectors; mining tools are only available in conjunction with the Microsoft AD connector.Analytics tools aren't available; however, Horacius has integrated with security information andevent management (SIEM) products to support automatic lockdown or flagging of accounts thathave been linked to suspect activity.Strengths In order to comply with Brazilian federal regulations, Horacius supports privacy guards withinthe products. Access rights can be tagged to information classification levels. Horacius has the notion of "security events" that can be triggered from outside or by detectingpatterns such as an SOD violation, or differences between effectively approved rights versusrights discovered on a target platform. These security events can then be handled according toconfigured actions. Of all products covered in this report, Horacius has one of the smallest footprints in terms ofhardware required.Cautions The UI is functional but oriented more to an IT audience.Gartner, Inc. G00253758Page 11 of 39

E-trust is growing, but the company is small, and its customer base is still exclusively withinBrazil. The company is expanding into other Latin American markets and has plans to enter theU.S. market. The product is developed to emphasize configuration, but customization requires code changesthat can be carried out only by e-trust.EvidianEvidian, based in Les Clayes-sous-Bois, France, was established in 2000 as a subsidiary of GroupeBull. Most of its suite has been developed in-house, apart from the acquisition of Enatel, tosupplement Evidian with an enterprise single sign-on (ESSO) product. Evidian approaches the IGAmarket through its Identity & Access Manager. Additional options include ID Synchronization, abuilt-in connectors package and configurations for high availability. The product is written in Javaand runs within the Tomcat application server on Windows, Solaris, AIX or Linux. Oracle, SQLServer, MySQL or PostgreSQL can be used as the identity warehouse. The current solution has IGAfeatures such as access policy management, a workflow-based access request manager, rulebased entitlement administration and a role-based identity data model.Strengths Evidian can leverage its two shareholders, Bull and NEC, to reach customers typically beyondthe reach of a company of Evidian's size. Evidian has extended the role-based access control (RBAC) model with concepts such asorganization and context. This provides enterprises with the opportunity to implement apowerful security policy while using a simple security policy model.Cautions While the company is growing at low double-digit rates, it still has most of its customer base inEurope. The number of customers in the U.S. is picking up, but at a slow rate, with a 12%increase expected for 2013. Evidian is still lacking some of the role mining, role life cycle and identity analytics featuresfound in many other IGA products; however, these features are on the product road map. Evidian must build a stronger partner network, especially in the U.S., where a partnership withQuest Software (now part of Dell) has been limited by Dell being a direct competitor in the IAMspace.Fischer InternationalFischer International, based in Naples, Florida, offers Fischer Identity Suite for the IGA market withthe following modules: Fischer Automated Role & Account Management, Fischer PasswordManager, Fischer Identity Compliance and Fischer Identity Connectors. Fischer Identity Suite is aJava EE Web-based application that runs within Tomcat on Java-supported platforms such asPage 12 of 39Gartner, Inc. G00253758

Windows, Unix and Linux. Any Java Database Connectivity (JDBC)-compliant database can beused as the repository.Fischer Identity Suite was built with inherent support for both cloud and on-premises deliverymodels, and the company-provided cloud-based hosting option includes the full-featured productwith subscription pricing. The suite also provides privileged account access management as anoption. Fischer designed the product with ease of deployment as a primary objective, so all productfeatures are accessible and configurable through the administrative interface without requiring anycoding or scripting.Strengths Fischer's solution is particularly appealing to smaller enterprises requiring IGA capabilities,enterprises with simpler governance-oriented requirements, and those that are cost-sensitiveregarding deployment and maintenance. Fischer International was the first IGA vendor to offer a multitenant cloud-based product morethan four years ago, and it has continued to mature the product while other vendors are justgetting started. Fischer offers low base prices for both perpetual and subscription licenses, with flexible licenseoptions, especially for higher education and retail customers with large user populations (forexample, students and store personnel) with relatively standardized provisioning needs.Cautions Governance-specific functionality such as access certification is limited, reflecting the product'sheritage as a UAP tool. Fischer International is a small company with limited visibility and name recognition, and withthe emergence of many identity-as-a-service providers, it risks being crowded out of its primarymarket. Despite making investments to broaden its network of partners for sales and system integration,Fischer International has not been able to generate momentum in this area, which couldconstrain growth in the future.Hitachi ID SystemsHitachi ID Systems, based in Calgary, Alberta, Canada, offers the Hitachi ID Identity ManagementSuite, which consists of Hitachi ID Identity Manager and Hitachi ID Password Manager. Allprovisioning connectors are included at no additional cost. The software is written in C and SQLstored procedures, and runs on Microsoft Windows 2008 R2 or Windows Server 2012 with IIS orApache. Load balancing and replication across multiple, concurrently active servers are standardfeatures of the product. The back end may be Microsoft SQL Server or Oracle Database. Theproducts support technical standards as well as most features included in IGA solutions, includingGartner, Inc. G00253758Page 13 of 39

workflow for access certifications, entitlement mining and discovery, role engineering, a datarepository, and connector architecture.Hitachi ID policy engines support change approvals, SOD and RBAC. For access control within theproduct, relationships between identities can be defined, and access rights can then be attached tothose relationships. Users access the system via an HTML5 Web portal, which supports self-serviceand delegated administration, as well as analytics and certification. Risk classification can becalculated based on entitlements and identity attributes. Connectors are included, and almost allare bidirectional. The Hitachi ID data model is a normalized, relational database supporting users,accounts, groups, identity attributes, roles and more. Event logs include SQL (structured), text(debugging) and syslog integration (SIEM). Hitachi offers ID Identity Manager for one price for IGAbased solely on the number of human users. Implementation services are provided by Hitachi on afixed-price basis and by partners.Strengths Hitachi's product has organically grown through in-house development. It has a considerablysmaller footprint than most competing products, scales well and consistently generates positivecustomer feedback. Hitachi's price model is simple and appeals to many potential buyers. Hitachi ID has a lowdeployment-to-license cost ratio and therefore a low TCO. The internal data model supports multiactor relationships to closely model existing structures inorganizations for access control within the p

Additional capabilities often included in IGA systems are role management, role and entitlements mining, identity analytics, and reporting. For 2013, Gartner introduces this Magic Quadrant for Identity Governance and Administration, which consolidates two separate Magic Quadrants —"Magic Quadrant for User Administration and