Improved Identity Governance Efficiency

Evidence and data. Interviewees described extensive manual processes for access certifications, entitlement management, and handling ad hoc access requests prior to deploying Okta Identity Governance.

• The director, IAM at an IT services organization talked about the emphasis their team put on automations and self-service capabilities. They explained that: “The volume [of IAM work that] was more than 36 [people] full time dedicated to doing the same kind of stuff that we have now happening with basically five [people with OIG]. … Through their capabilities and automation using Workflows, we’re not going and developing and building scaffolding to do this stuff. We are living within the Okta platform using their low-code/no-code Workflows to do the automations.”

• The director, IAM added that the organization runs between 80 and 90 campaigns a month, covering 20,000 to 80,000 items, that each take less than an hour of work for the IAM team.

• The information security director at a healthcare organization said: “On the infosec side, it used to take one engineer and one analyst about four weeks to prepare a campaign. Then they had to babysit it and handhold managers — sometimes several hundred at a time. Two resources were basically tied up a quarter of the year just running access reviews. … Setting one up now takes 30 minutes.”

• The CIO in financial services said, “We went from 50% automation to 90% automation [with OIG] [and a] 50% reduction in labor.”

• The senior director, global head of IAM at a professional services organization estimated their IAM team of nine is now doing the work of 14 to 15 people.

• The CISO in IT services identified the automation provided by OIG as a top benefit, explaining that the organization has “basically built everything on Workflows and automated processes to take away that manual effort.”

• The IT solutions architect at a software organization discussed the impact of Okta Workflows: “We did have automation in place, but it was a hodgepodge of everything — PowerShell scripts, Python scripts, AWS Lambda functions, just all over the place. We were able to migrate all of that into the Okta Workflow stack and then use the built-in hooks into all of our different identity-related operations, which drastically reduced the complexity and also the amount of time needed to maintain those different platforms.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Ten IAM FTEs are allocated to core identity governance tasks, such as access requests and reviews and entitlement management.

• The average fully burdened annual salary of an IAM FTE is $140,900.

• After the eight-week implementation period, the team saves 40% of the time spent on identity governance tasks for the remaining 44 weeks, for a net savings in Year 1 of 34%.

• The time saved increases to 50% in Year 2 and 60% in Year 3 as more applications are managed by OIG and more automations are integrated, further reducing prior manual efforts.

• These time savings are reallocated toward other value-added activities at a rate of 75%.

Risks. To support realistic and defensible estimates, Forrester applies risk adjustments based on the consistency of interview evidence and the degree of variation in reported outcomes. This component of TEI methodology helps account for differences in implementation environments. The amount of this benefit can vary across customers due to differences in:

• The level of automation and time savings, which may vary based on legacy system complexity or compliance requirements.

• The need for manual oversight, which may be greater in organizations with regulatory or industry-specific constraints.

• The scale of benefit, which depends on user volume, campaign frequency, and the number and complexity of applications governed.

• The average fully burdened annual salary of an IAM FTE.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $1.1 million.

Reduced Audit Preparation And Compliance Reporting Efforts

Evidence and data. Interviewees reported that OIG helps streamline or avoid significant manual effort related to recurring audits, access reviews, and compliance reporting. Teams previously responsible for validating access controls and preparing evidence and reports reported material time savings and reduced audit-related efforts. Specific areas of reduced or avoided effort included the following.

• Interviewees described the weeks of audit preparation effort needed before OIG, which involved manually gathering certification data, taking screenshots of access approvals, and validating access control logs across systems.

• Several interviewees noted that automated certification workflows improved the completeness and consistency of review processes, reducing the risk of missing or incorrect records that could trigger findings. They also identified centralized policies, workflows, and audit logs in OIG as factors in reducing the effort required to explain governance processes to auditors and document exceptions.

• Interviewees described saving time and reducing complexity by using OIG dashboards to generate ad hoc reports on access reviews, user roles, and entitlements. These features helped teams respond more quickly to internal audit or external regulatory inquiries.

• The senior director, global head of IAM in professional services explained that without OIG’s automation, they “would have needed a team of three to five people to manage the consistency” of evidence gathering.

• The senior director added: “I am able to present to an auditor in a single 30-minute session and be done. Zero follow-up. … [The auditor] came back to me with [a request for their] security engineer to reach out to [us] so that [they] could implement [OIG]. That has happened twice. … That’s like the biggest compliment ever.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• Audit and compliance tasks are allocated to two FTEs.

• The average fully burdened annual salary of an audit and compliance FTE is $122,400.

• After the eight-week implementation period, the team saves 50% of the time spent on audit preparation and compliance reporting tasks for the remaining 44 weeks, for a net savings in Year 1 of 42%.

• The time saved increases to 60% in Year 2 and 70% in Year 3, as the IAM team becomes more efficient and OIG governance expands.

• These time savings are reallocated toward other value-added activities at a rate of 75%.

Risks. The amount of this benefit can vary across customers due to differences in:

• The number and complexity of audits required based on industry and geography.

• The maturity of existing processes and tools prior to adopting OIG.

• The size and structure of the IAM and compliance teams.

• The degree to which audit-related tasks are automated or integrated into other governance systems.

• The average fully burdened annual salary of an audit and compliance FTE.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $232,000.

Enhanced Platform Efficiency And Software Rationalization

Evidence and data. Interviewees shared that Okta Identity Governance improved platform efficiency by reducing reliance on costly external consultants, eliminating custom connectors, and empowering internal teams with low-code/no-code tools. In parallel, organizations gained better entitlement visibility and usage insights, allowing them to rationalize software spend and remove unused licenses. Together, these changes enhanced operational efficiency and strengthened governance coverage.

Platform efficiency:

• The information security director in healthcare reported that before OIG, their organization was spending $150,000 to $200,000 annually on consultants to make progress on legacy solution initiatives. With OIG, that additional cost is no longer needed thanks to out-of-the-box connectors, low-code/no-code automations, and internal resources empowered by more modern tooling.

• The CIO in financial services added: “[OIG] comes with a lot of prebuilt integrations, so that made it easier to connect to our current environment. … [OIG is also] helping us realize a benefit around license and resource management because of less unused accounts.”

• The senior director, global head of IAM noted that their professional services firm paid $15,000 to $25,000 to connect applications and as a result: “You don’t connect all the systems that you would have connected [for] governance, so there’s a risk that you have gaps because they’re not connected via an API…. [With OIG], anything that  had SSO connected to my identity provider automatically got added into governance, as it should be.”

Software rationalization:

• Interviewees explained that OIG’s entitlement visibility helped identify and remove unused or duplicate licenses. The IT solutions architect said their software firm conducts ad hoc certification campaigns to gain real-time insight on who is actually using applications and has “seen a huge benefit every time we roll it out.” One example reduced approximately 200 licenses for an application with 550 users at a cost of $5 to $10 per user per month.

• When asked about savings related to platform efficiencies and software rationalization, the CIO at a financial services firm estimated their organization saves over $200,000 annually.

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• The organization connects 10 incremental applications using OIG that would have required a paid connector under the legacy solution.

• Connector fees are $20,000 per application.

• OIG enables license cleanup for 10 applications, with an average of 50 unused or duplicative licenses removed and a monthly cost of $5 per license.

• After the eight-week implementation period, the organization avoids $21,000 in consulting or third-party support in Year 1 and $25,000 in Years 2 and 3.

Risks. The amount of this benefit can vary across customers due to differences in:

• The cost and availability of prebuilt connectors for legacy IGA solutions.

• The number and types of applications added or governed via OIG.

• License structures and overprovisioning patterns across enterprise software environments.

• Reliance on external consultants or managed service providers for IAM functions.

Results. To account for these risks, Forrester adjusted this benefit downward by 10%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $568,000.

Increased Productivity From Access Governance Enhancements

Evidence and data. Interviewees described how OIG streamlined access-related workflows for end users, managers, and application owners. Before OIG, end users would often over-request, resulting in delays and extra follow-up. With OIG, requests are routed and resolved more efficiently, reducing the burden on requesters and approvers. Automating and simplifying access requests, certifications, and entitlement reviews helped reduce the time spent navigating outdated interfaces, waiting on manual approvals, or responding to inconsistent governance processes.

• The IT solutions architect in software said: “[Before OIG], it would be between 45 minutes to 2-hour-long processes to get the approvals done, and up to 24 hours for access to be granted. We were able to collapse that with 30 minutes [to] when the request is fully completed end to end.”

• The managing director in financial services said about access requests or changes, “[It] would take at least the SLA of five business days, and now it’s automated and done within 30 minutes.”

Modeling and assumptions. Based on the interviews, Forrester assumes the following about the composite organization:

• 5,000 end users save, on average, 2 hours per year with OIG as a result of fewer access issues and improved access approvals and provisioning.

• The average fully burdened hourly rate of an end user is $47.

Risks. The amount of this benefit can vary across customers due to differences in:

• The types and volume of access-related tasks assigned to business users.

• The maturity and consistency of governance workflows prior to implementing OIG.

• The level of automation and customization deployed during rollout.

• How widely the request and certification workflows are adopted across the organization.

• The average fully burdened hourly rate of an end user.

Results. To account for these risks, Forrester adjusted this benefit downward by 15%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $497,000.

Reduced Risk Of A Security Breach

Evidence and data. Interviewees confirmed that Okta Identity Governance helped reduce the risk of a security breach by enforcing least-privilege access, eliminating unnecessary entitlements, and automating reviews and removals. Several highlighted OIG’s role in curbing access creep and cleaning up legacy access, which they noted as a foundational capability in their journey toward a Zero Trust architecture.

• The senior director, global head of IAM at a professional services firm said OIG helped reduce overprovisioned access and minimize human error, which previously exposed the organization to unnecessary risk. “People love that separation of duties and toxic entitlements. … The automation [from OIG] goes and looks quickly at the roles that you have to make sure the role that you’re requesting isn’t toxic to one of the ones you already have and remediate before it starts. It’s a huge, massive deal.”

• The information security director in healthcare explained that OIG facilitated a significant reduction in risk exposure related to protected health information (PHI). OIG helped tighten governance around PHI access, ensuring only essential users had visibility into sensitive data. This targeted reduction in unnecessary access mitigated potential compliance and security risks.

• The CIO in financial services said: “Having a capability to do separation of duties and policy enforcements helps us prevent conflict of interest and reduce potential fraud. … We’ve seen a reduction in insider threats because we’ve got a lot more visibility into these access reviews and certifications, especially with contractors and third-party partners. The automation of deprovisioning ensures that we’re not leaving access for former employees or former contractors or vendors that have departed, so that’s reduced a risk for us.”

Modeling and assumptions. Based on Forrester research and the interviews, Forrester assumes the following about the composite organization:

• The composite faces an annual breach risk exposure of $3.027 million² with a likelihood of experiencing one or more breaches of 63%.³

• Of these breaches, 76% originate from external attacks or internal incidents or are related to the external ecosystem.⁴

• Eighty percent of those incidents are addressable through stronger identity governance and access controls provided by OIG.

• The composite reduces its exposure to these risks by 10% through the adoption of OIG, based on interviewee-reported improvements in access hygiene and review effectiveness.

Risks. The amount of this benefit can vary across customers due to differences in:

• Organizational size, industry, and inherent security risk profile.

• Existing identity governance maturity and tooling.

• The breadth of the OIG deployment and enforcement of access policies.

• The internal alignment between IAM, security, and compliance teams.

Results. To account for these risks, Forrester adjusted this benefit downward by 20%, yielding a three-year, risk-adjusted total PV (discounted at 10%) of $231,000.

Unquantified Benefits

Interviewees mentioned the following additional benefits that their organizations experienced but were not able to quantify:

• Rapid time to value. Interviewees consistently emphasized the speed with which they were able to deploy and derive value from OIG compared with traditional IGA platforms that often required months of planning, customization, and integration work. OIG enabled teams to stand up core capabilities — including access requests and certification workflows — with minimal resources and configuration effort. This accelerated ramp allowed organizations to begin realizing meaningful governance improvements almost immediately, even before full optimization or broad rollout.
  
  The CIO at a financial services organization noted that OIG delivered faster time to value due to its deep integration with the organization’s existing Okta infrastructure — including single sign-on, multifactor authentication, and API access management. Because these core services were already in place, OIG could be deployed more quickly and with fewer integration hurdles compared with competing solutions.
  
  The information security director in healthcare said: “The implementation time was next to nothing. … There’s nothing to really do. It’s just part of the [Okta] platform. … We had it in production within two weeks — that was a grand slam for us.”
  
  The senior director, global head of IAM at a professional services organization discussed the deployment process: “It was me and my two engineers at the time and that was it, just talking through on the call on a Thursday and Friday, and I looked up and realized this thing is done. We have access requests. We have governance and certifications that are spinning now. Let’s move this to prod. We could have had it done within the first day if we had had more confidence in our ability.”

• Improved IT and security team morale. The interviewees said that by eliminating repetitive manual tasks and reducing the administrative burden of managing access requests and certifications, OIG allowed their teams to focus on more strategic, higher-value work. Interviewees described this as a productivity and culture boost for IT, IAM, and security teams. The director of security architecture in IT consultancy said, “Now we have less manual process management, and it allows us to focus on more strategic goals.” The senior director, global head of IAM at a professional services organization said: “My guys are now pseudo-stepping up into other roles that they dreamt of and that they want to do but just didn’t have the resume for. [OIG] permits a leader to prioritize work differently because you’re giving it to a team member that not only wants to do it as an analyst — they have the desire to do it. They’re knocking at your door, begging to get this kind of work. It’s the cool work.”

Flexibility

The value of flexibility is unique to each customer. There are multiple scenarios in which a customer might implement Okta Identity Governance and later realize additional uses and business opportunities, including:

• Increased future-readiness and agility. Interviewees cited OIG’s flexibility as a key enabler of both near-term wins and long-term strategic growth. Several interviewees noted that they started with a narrow use case — such as access requests or onboarding — and then expanded coverage over time to additional applications, business units, or compliance frameworks. Interviewees described this phased approach as essential for aligning governance scope with internal readiness and evolving regulatory priorities. OIG’s native integration with Okta’s identity platform allowed interviewees’ organizations to scale without adding an administrative burden or disrupting existing workflows; controls could also be configured to support diverse geographies and standards (e.g., SOX, HIPAA, and ISO). The information security director in healthcare summarized it simply: “[With OIG,] you’re in control of your own destiny.”

Flexibility would also be quantified when evaluated as part of a specific project (described in more detail in Total Economic Impact Approach).