At Industry Exchange Cloud 2025, Delinea’s Tony Goulding laid out three pillars of identity, credential and access management, a framing that matters because ICAM programmes inside large organisations tend to stall on scope rather than technology. The pillars, as presented, organise a sprawling discipline into a sequence that security leaders can fund and measure.
The problem the framing addresses is well documented. Identity and access management has become an umbrella covering human identity lifecycle, privileged access, machine and workload identity, authentication assurance and authorisation policy. Programmes that attempt all of it simultaneously produce parallel inventories, duplicated policy engines and a governance board that cannot answer basic questions about who can reach what. Meanwhile the environment keeps moving: cloud migrations scatter entitlements, contractors multiply the identity population, and automation introduces non-human accounts that were never designed to pass through a joiner-mover-leaver process.
The first pillar, identity, is the foundation layer: authoritative records for every principal, human or machine, with lifecycle processes that actually terminate access. The practical failure here is rarely a missing directory. It is the disconnected application with its own local accounts and the service identity created outside any request process. Achieving a single authoritative view of principals is unglamorous work, and it is the precondition for everything that follows.
The second pillar, credential, covers the secrets those principals use. Vaulting, rotation, and the elimination of embedded credentials in scripts and configuration files. This is where privileged account security programmes have historically concentrated their investment, and it is also where the sharpest measurement exists: how many credentials are unmanaged, how many are shared, how many have never been rotated.
The third pillar, access, is the policy and enforcement layer: who may use which credential against which resource, under what conditions, with what session controls. This is where the distinction between authentication and authorisation becomes operationally visible. Session management, brokered access and just-in-time elevation all live here, and this pillar is where most organisations find their biggest gap relative to zero trust ambition.
For practitioners, the value of a pillar model is diagnostic. It shows where an organisation is strong and where controls are nominal. A common pattern is a mature credential pillar sitting on top of a weak identity pillar, which produces vaulted passwords handed to accounts nobody can attest to. Another is strong identity governance with unmanaged secrets, where access reviews confirm entitlements while credentials sit in application configuration.
For CISOs in regulated or federated environments, the framing also helps in conversations with auditors, because it separates evidence types cleanly. Identity evidence is attestation and lifecycle records. Credential evidence is rotation and checkout logs. Access evidence is session recordings and policy decisions. Programmes that can produce all three on demand handle audits with far less disruption.
The through line is that ICAM succeeds when the three layers are governed together, with privileged access treated as the sharpest test of whether identity, credential and access policy actually hold under pressure.