Strategic Partnership — KuppingerCole

Identity strategy built on independent research, not on a vendor's slide deck

KuppingerCole Analysts is a vendor-neutral research firm and the source of the Identity Fabric reference architecture. Kommando is a strategic partner: we use their research and frameworks as the backbone of our IAM strategies, and we build the programmes that turn them into working identity security across Norway, Sweden and Denmark.

Start with an IAM maturity assessment: know where you are before you decide where to go.

Who is KuppingerCole?

An analyst firm that sells research, not licences

KuppingerCole Analysts is an independent research and advisory firm focused on digital identity, access management, cybersecurity and cloud security. Founded in 2004 and headquartered in Wiesbaden, Germany, the firm publishes more than 150 research reports a year and runs a large programme of conferences and webinars for identity and security leaders.

The distinction that matters for our clients is a simple one: KuppingerCole is 100% vendor-neutral. They do not resell software and they do not take a cut of a licence deal. Their market intelligence, evaluations and frameworks are written to help buyers decide, which makes them a solid foundation for a strategy that has to outlive any single product choice.

Their identity frameworks, including the Identity Fabric reference architecture, are used by organisations worldwide to structure IAM programmes rather than assemble them tool by tool.

What they produce

Independent research
Advisory services
Reference architectures
IAM maturity assessment
Conferences & webinars

The framework

The Identity Fabric reference architecture

The Identity Fabric is not a product you can buy. It is a design paradigm: instead of a collection of isolated identity systems, you deliver identity as a set of connected services covering every identity in the organisation, human and non-human alike. The architecture organises those services into four functional domains, and that is where most IAM roadmaps should start.

Every identity

Workforce
Partners
Customers
Devices
Workloads
AI agents

Identity Fabric · identity services

Admin-timeAdministration

Lifecycle / JML
Provisioning
Roles & entitlements

Real-timeAuthentication

MFA & passwordless
Federation
Adaptive policy

Real-timeAuthorization

Least privilege
Just-in-time access
Policy enforcement

Post-eventAnalytics & Risk

Access reviews
Monitoring
Audit evidence

Integration & API layer

Every target system

SaaS apps
Cloud platforms
On-prem systems
Legacy apps
OT & IoT

Admin-time

Administration

Joiner, mover and leaver processes, provisioning, roles and entitlement management. The identity lifecycle that decides who exists in your systems in the first place. This is where IGA lives.

Real-time

Authentication

Verifying the identity at the moment of access: multi-factor authentication, federation, passwordless and adaptive policies, including on the legacy systems that were never designed for it. See Access Management.

Real-time

Authorization

What an identity is actually allowed to do once it is inside: entitlements, policy enforcement, least privilege and just-in-time access. The domain where PAM and cloud entitlements belong.

Post-event

Analytics & Risk

Governance, monitoring, access reviews and the evidence an auditor asks for. The domain that tells you whether the other three are working, and the one most programmes postpone until a compliance deadline forces it.

Why it matters

Most IAM programmes don't fail on technology

They fail on structure. Tools get bought in the order the budget allows, each one solves the problem in front of it, and three years later nobody can describe the target architecture in a single picture. The consequence is familiar: overlapping licences, gaps nobody owns, and an access review that takes a quarter to complete.

A reference architecture fixes the order of the conversation. You describe the identity services your organisation needs, place your current systems into that model, and see the gaps and the overlaps before anyone signs a purchase order. The Identity Fabric also comes with second-level reference architectures for specific domains such as workforce IAM, privileged access, B2B and consumer identity, so the model gets concrete quickly.

That is exactly the work we do in an Identity Advisory engagement, and it is why we build on KuppingerCole’s model instead of inventing our own.

functional domains structure the whole model: Administration, Authentication, Authorization, and Analytics & Risk

150+

independent research reports published by KuppingerCole every year, none of them tied to a licence sale

The partnership

Kommando × KuppingerCole

Kommando is a strategic partner of KuppingerCole Analysts. We use their research and their Identity Fabric reference architecture in our advisory work, and we recommend both to the organisations we work with.

The two halves fit together. KuppingerCole brings independent, vendor-neutral market intelligence and a proven architectural model. Kommando brings consultants who have delivered identity security in regulated Nordic environments and know what the model looks like when it meets a real Active Directory, a real change board and a real budget.

Together we can produce and realise high-quality IAM strategies and programmes for Nordic organisations: research-backed direction, local delivery from Oslo, Gothenburg, Stockholm and Copenhagen.

Our approach

From reference architecture to running programme

Maturity assessment

We benchmark your current identity capabilities against the model, domain by domain. No tooling decisions yet. The output is an honest picture of where you are, which is usually less flattering and more useful than the one in the last board deck.

Target architecture

We map your existing systems into the Identity Fabric and design the target state: which identity services you need, how they connect, and which of today's tools survive into it.

Roadmap and business case

Gaps sequenced by risk and by what the organisation can actually absorb, with the cost and the compliance drivers spelled out. This is the document that survives contact with the budget process.

Vendor-neutral selection

Requirements come from the architecture, not from a demo. We use independent research to shortlist, and we are open about where our own CyberArk, SailPoint and Silverfort expertise fits and where it does not.

Delivery and managed services

Certified consultants implement the roadmap in waves, and stay on to run and extend the platform afterwards. A strategy nobody implements is just a PDF.

The hardest question in an IAM programme is rarely which product to buy. It is what the target looks like, and who owns it once the project ends.

— Kommando identity advisory team

Local delivery

Advisors and certified consultants in Oslo, Gothenburg, Stockholm and Copenhagen. International-grade research, delivered in your language, your time zone and your regulatory reality.

Frequently asked questions

Questions we actually get

What is KuppingerCole's Identity Fabric?

The Identity Fabric is a reference architecture for identity and access management from the analyst firm KuppingerCole. Instead of treating IAM as a set of separate products, it describes identity as a connected set of services covering every identity, human and non-human, organised into four functional domains: Administration, Authentication, Authorization, and Analytics & Risk. It is a design model, not a product, and it is used to assess maturity, design a target architecture and structure an IAM roadmap.

Why use a reference architecture instead of just picking tools?

Because tools bought one at a time produce overlaps, gaps and licences nobody can justify. A reference architecture forces you to describe the identity services the organisation needs first, then place existing systems into that model. Selection criteria come out of the architecture, so you buy what fills a real gap. It also gives the programme a shared picture that survives changes of vendor, sponsor and team.

Which consultancy in the Nordics works with KuppingerCole?

Kommando is a strategic partner of KuppingerCole Analysts and applies their research and Identity Fabric reference architecture in identity advisory engagements across Norway, Sweden and Denmark, with teams in Oslo, Gothenburg, Stockholm and Copenhagen.

Does working with KuppingerCole make Kommando vendor-neutral?

We are honest about this. Kommando is a certified partner of several identity security vendors, and we say so. What the KuppingerCole partnership gives us is a vendor-neutral starting point: the architecture and the requirements are defined before the product conversation, using independent research rather than a vendor's roadmap. If the right answer is a platform we don't deliver, you will hear that from us.

How do you measure IAM maturity?

We assess your capabilities against the domains of the Identity Fabric, using KuppingerCole's maturity assessment approach as the benchmark. Each domain is scored on what exists today, what is documented, and what is actually operated day to day. The gap between the last two is where most findings come from.

Where does this fit with our existing CyberArk, SailPoint or Silverfort investment?

Each of those platforms covers part of the fabric: SailPoint in Administration, Silverfort in Authentication, CyberArk in Authorization and privileged access. Mapping what you already own into the model usually shows both unused capability you have already paid for and the one or two gaps worth funding next.

Next step

Find out where your identity programme actually stands

An IAM maturity assessment maps your current capabilities against the Identity Fabric and gives you a target architecture and a sequenced roadmap. No product decisions required to get started.

Benchmarked against an independent reference architecture
Target state and roadmap you can take to the board
Delivered locally across the Nordics

Oslo · Gothenburg · Stockholm · Copenhagen