Finding where managed identity services are under-served in the US and India
Cybersecurity is too wide a category to plan against. A clear boundary, maturity segments and a provider landscape show where managed identity demand outruns supply in each country.
- Challenge
A wide security category with no boundary, segments or provider view for managed IAM.
- Approach
Market boundary, maturity segments, demand drivers and a provider landscape per country.
- Result
A market view showing where each country's demand is under-served, and why.
The situation
Managed IAM providers growing across the US and India often plan against "cybersecurity", a category so wide it hides their own market. Most identity spend buys licences that clients' own teams run, which a managed provider does not win. Without a boundary, segments or a view of who serves each country, nobody can say where demand is unmet. Hiring and partner bets follow inbound enquiries, often into segments large integrators already hold.
The question that mattered
Where in the US and India does managed identity demand outrun current supply, and what drives it?
What we did
- 1
Draw the market boundary
Include managed workforce IAM, IGA and PAM, where an outside provider runs access reviews, joiner-mover-leaver processes and privileged access. Exclude licence-only purchases and customer identity.
- 2
Segment by identity maturity
Place organisations by how they run identity today: manual processes and spreadsheet access reviews, tools licensed but under-staffed, or a mature in-house identity team. The under-staffed middle is where managed demand concentrates.
- 3
Trace demand drivers in each country
In the US, sector rules such as New York's DFS cybersecurity regulation, HIPAA access controls and SOX access reviews make firms evidence access control. In India, DPDP Act obligations, RBI's IT governance directions and SEBI's cyber resilience framework reach banks, NBFCs, brokers and asset managers.
- 4
Map providers and whitespace
Profile global integrators, IT services majors, managed security providers and vendors' services arms in each country, marking where each is thin. Test the picture in practitioner interviews.
What we delivered
The evidence and working documents the team kept.
- Market definition with inclusions and exclusions
- Identity-maturity segmentation, with the public signals used for placement
- Demand-driver brief per country and regulated sector
- Provider landscape per country, with each provider type's strengths and gaps
- Whitespace map of segments where demand outruns current supply
The outcome
Licence-only demand
removed from the plan, leaving buyers who want identity run for them
Under-staffed, tool-owning firms
chosen as the core segment in both countries
Country priorities
set: mid-sized US banks, insurers and health systems below integrators' deal size; Indian NBFCs and brokers without identity teams
Hiring and partner plans
tied to the whitespace map instead of inbound enquiries
Leadership now invests by segment and country, and account list-building starts only once a segment is chosen.
What changed in the GTM motion
Planning now starts from a written market definition and maturity segmentation. When an obligation lands, such as the next phase of DPDP rules, the team updates the demand-driver brief and re-checks segment priorities.
Services in this programme
Case studies
More programmes like this
Is your category too broad to plan against?
Tell us where it is stuck. A founder replies within one working day.