Cybersecurity is the ground we came from.
Before this was a product company it was years of identity and access work inside regulated businesses. That is why the products behave the way they do.
It proposes. A person approves.
Automation without a review gate is a faster way to be wrong. That is not a design preference, it is what a security review asks for.
We learned this before we wrote any of it.
Joiners and leavers. Privileged accounts. Access reviews. The audit evidence that has to survive somebody checking it. Work where nearly right is the same as wrong, and where being unable to show your reasoning is the same as not having any.
Proposing rather than acting, showing the working, leaving a record behind: every product we build does those three things, because we spent years in the place where software that did not do them caused the problem.
What we see, everywhere
Different organisations, the same three problems underneath.
Access that outlives the job
People change roles and keep what they had. Each move is defensible on its own and the total is not. Nobody is looking, until an auditor is.
Evidence assembled by hand
The review itself takes a week. Proving it happened takes another, and the proof is screenshots in a folder that nobody can reproduce next quarter.
Accounts nobody owns
Service accounts and shared logins outlive the person who created them. Asking who owns one is how you find out that nobody does.
Change your systems on our own judgement
Anything that alters a real system arrives with the evidence behind it and waits for a person. A tool that acts unilaterally is a tool you cannot put in front of an auditor.
Consultancy is a different company
Identity and access consulting is IAM Tech’s work, not ours. Same legal entity, different business. We build and sell the software.
Security is where we are strongest, not where we stop.
The same approach applies to any work that has to be right and nobody enjoys, which is why our first products are not security products at all.