Author: Mika Aromaa, CEO, Trivore
How identity stacks become fragmented
No organization sets out to build a fragmented identity stack. It happens one reasonable decision at a time.
In 2015, you added a single sign-on solution because users were drowning in passwords. In 2018, you bolted on a provisioning tool because onboarding new employees took two weeks. In 2020, a customer-facing portal needed its own identity management, so you brought in a CIAM vendor. By 2022, auditors wanted access reviews, and a governance tool joined the stack.
Each purchase made sense in isolation. Each was the right answer to the problem in front of you at that moment. Nobody planned for five vendors, five data stores, and five admin consoles. But that is what most Nordic mid-to-large organizations are running today.
The result is predictable. Identity data is scattered across systems that were never designed to work together. Policies are defined in different places, enforced differently, and reviewed separately. Between these systems sits an integration layer that someone built years ago, that nobody fully understands, and that breaks whenever one vendor ships a major update.
This is not a technology failure. It is the natural outcome of buying best-of-breed solutions in a market that kept inventing new categories. SSO, provisioning, governance, CIAM, and privileged access management all grew up as separate product categories with separate budgets. The industry trained buyers to think in point solutions.
The problem is that identity is not a collection of point problems. It is a continuous lifecycle that starts when a person first interacts with your organization and ends when every trace of their access has been decommissioned. Fragmenting that lifecycle across five products creates costs that most organizations have never properly measured.
The costs that don’t appear in licence invoices
Licence fees are visible. They arrive quarterly, they sit in a budget line, and procurement tracks them. But in a fragmented identity stack, licence fees are often the smallest cost. The real expense hides in operations, risk, and time.
Integration maintenance is a permanent tax. Every connection between two identity tools requires ongoing care. When your SSO provider changes their token format, the provisioning tool’s connector breaks. When your CIAM vendor updates their API, the governance tool loses visibility into customer identities. With five tools, you don’t have a simple chain of integrations. You have a matrix. And every node in that matrix is a potential failure point that someone in your team must monitor, test, and repair after every vendor update cycle.
Audit trails have gaps you cannot close. Under NIS2 and the regulatory direction in the Nordics, organizations must demonstrate who had access to what, when it was granted, and when it was removed. In a fragmented stack, access might be granted in one system, reviewed in another, and revoked in a third. Reconstructing the complete lifecycle of a single identity for an auditor becomes detective work that takes hours instead of minutes. Some gaps cannot be reconstructed at all, because the systems simply do not share a common timeline or identifier.
Policies cannot span disconnected platforms. You define MFA requirements in your SSO tool, but your CIAM platform enforces different authentication standards. Separation-of-duty rules in your governance tool cannot see entitlements managed by the provisioning system. The result is policy fragmentation: you believe you have a standard, but enforcement varies depending on which tool handles which part of the lifecycle.
Vendor management multiplies quietly. Five contracts mean five renewal cycles, five support relationships, five roadmaps to track, and five sets of terms to negotiate. Each vendor relationship requires someone’s time and attention. Consolidating vendor management is one of the most overlooked savings in identity infrastructure.
Incident response slows to a crawl. When a security incident occurs, the first question is always: “What did this identity have access to across all our systems?” In a fragmented stack, answering that question means querying five separate databases, correlating results manually, and hoping the timestamps align. During an active breach, those minutes matter.
Skills and key-person risk concentrate dangerously. Each tool in the stack requires its own expertise. Over time, knowledge concentrates in one or two people per tool. When the provisioning specialist leaves, provisioning breaks. When the governance admin is on holiday, access reviews stall. This is not hypothetical. It is the most common operational failure mode in fragmented identity environments.
A 2023 study by Forrester of comparable identity platform consolidations found that organizations moving from point solutions to a unified platform avoided between 400 and 1,200 euros per employee per year in manual management costs. That figure covers the labour of maintaining integrations, running manual JML processes, handling email-routed access requests, and conducting spreadsheet-based reviews. For a 2,000-person organization, the annual waste ranges from 800,000 to 2.4 million euros. Most of it invisible, because it is distributed across dozens of people spending portions of their time on tasks that a unified platform eliminates.
What consolidation actually looks like
Consolidation does not mean ripping out everything and starting over. It means establishing a clear architecture where identity has a single source of truth rather than five competing ones.
The target architecture is straightforward. A single identity store holds the authoritative record for every person: employees, contractors, partners, customers. Authentication, lifecycle management, governance, and provisioning all operate from one policy engine against that shared store. One audit trail covers the full lifecycle from first access to final decommissioning.
This does not mean workforce identities and customer identities follow the same rules. They share infrastructure but have separate policies, separate risk profiles, and separate user experiences. The point is that both are visible from the same console, governed by the same engine, and recorded in the same audit trail.
The integration model shifts from a mesh to a hub-and-spoke pattern. The identity platform is the hub. HR systems, Microsoft environments, SaaS applications, on-premise directories, and business applications are spokes. Each spoke has one integration point to maintain, not five.
This is where a common misunderstanding arises. Consolidation does not mean replacing your Microsoft estate or your HR system. Those become spokes. Your Active Directory, Entra ID, SAP HR, or whatever you run continues to operate. What changes is that the identity platform is the authoritative source for policy, lifecycle, and audit, and the downstream systems receive and execute rather than independently deciding.
The economic impact of this shift is measurable. The same Forrester study showed payback periods of 12 to 18 months and three-year ROI between 150 and 280 percent for organizations that consolidated. Nordic-market analysis suggests that a unified platform approach can reduce three-year total cost of ownership by 30 to 40 percent compared to assembling an equivalent capability from separate vendors.
At Trivore, we have built our platform around this exact architecture: a single identity core that spans workforce and customer use cases, with governance and provisioning layered on top rather than bolted on from outside. But regardless of which vendor you evaluate, the architectural principle holds. Fewer moving parts mean lower cost, faster response, and cleaner compliance.
When to act
Three situations create natural windows for consolidation.
Contract renewals. When an existing identity tool comes up for renewal, that is the moment to ask whether it should be renewed, replaced, or absorbed into a broader platform. Renewing without evaluating alternatives locks in fragmentation for another cycle.
Regulatory deadlines. NIS2 compliance timelines are real. The European Digital Identity Wallet framework is approaching. Both demand capabilities that fragmented stacks deliver poorly: complete audit trails, consistent policy enforcement, and rapid incident response. Waiting until the deadline means implementing under pressure, which is expensive and risky.
Organizational change. Mergers, acquisitions, and restructuring are the worst time to discover identity fragmentation and the most common time it becomes visible. When two organizations merge, their identity stacks collide. If both are already fragmented, the integration challenge multiplies. The organizations that consolidate before M&A activity move faster and spend less when the time comes.
The cost of waiting is not zero. Each year that passes adds integration debt: more custom connectors, more workarounds, more institutional knowledge locked in departing employees. The longer fragmentation persists, the more expensive consolidation becomes.
Three questions for your next IAM review
Before your next renewal decision or budget cycle, ask your identity team these questions:
- Can you produce a complete access history for any identity, across all systems, in under one hour?
- Do your customer identity management and workforce identity management share a common audit trail?
- If one of your IAM vendors ceased operations tomorrow, how long would it take to replace them, and what would break in the meantime?
If the answers are uncomfortable, the conversation about consolidation is already overdue. Start it before the next renewal window closes.