Every identity under control.
Including AI agents.

Vendor-neutral Identity and Access Management consulting for banks and insurers. For employees, non‑human identities and AI agents.

Start the DORA check

New white paper on AI agents and DORA

Read for free

Cover of the white paper AI agents with access but without identity

All identities, one set of rules

Employees, non‑human identities and AI agents access the same systems. That is why they pass the same four checks in identity and access management before they get access to applications, infrastructure or data. If one is missing, such as a named owner, access is denied.

Matching solutionAccess governance & certification

Application onboarding

Onboard applications to the identity platform using a standardized process.

Identity lifecycle & role model

Automated joiner, mover and leaver processes and a well-structured role model.

Access governance & certification

Audit-ready control of roles, SoD policies and access reviews.

Privileged access & just‑in‑time

Just-in-time admin access with approval and a full audit trail.

Non-human identities & AI agents

Service accounts and AI agents governed by the same rules.

Customer IAM (CIAM)

Secure identities for your customers.

Application onboarding engine

Onboard applications faster

Significantly faster onboarding

Consistent security and least privilege

Full auditability

Scales to hundreds of applications

Analysis & kick-off: Analysis of the existing system landscape, requirements and integration goals.
Design & role modelling: Development of role models, RBAC structures and access policies.
Integration & automation: Standardised connection, provisioning and automated workflows.
Testing & validation: Technical validation, security testing and user acceptance testing.
Go-live & governance: Go-live, monitoring and continuous access governance.
Hypercare: Intensive support after go-live until operations are stable.

Case studies

Results from our projects

Privileged Access Management

3,200 privileged accounts secured in 6 months

Privileged access management for a German financial services group, with 100% PAM coverage of all privileged accounts.

View case study

Application Onboarding

2,500 applications onboarded to SailPoint IdentityIQ

For a German financial services group: a standardized process, classification by effort and a mandatory security test before every release.

View case study

IAM Migration

Legacy customer IAM replaced by Keycloak after more than 20 years

65,000 customer accounts and more than 60 applications moved from an in-house system to Keycloak, without a production outage.

View case study

Identity Governance

38 use cases designed for a central IAM in public administration

Two integrated platforms, Garancy for identities and DirX for accounts and roles, plus 38 use cases and a six-stage release plan.

View case study

01/05

Banking

Secure, audit-ready identity and access management in highly regulated financial systems.

We align your IAM with DORA, MaRisk and PSD2: strict access control, consistent segregation of duties (SoD) and complete evidence for every audit.

02/05

Insurance

Management of complex identity and authorization processes across distributed insurance platforms and all of the internal systems involved.

Specifically designed for the requirements of DORA and GDPR, and for the strict access controls needed for sensitive customer data and policy administration.

03/05

Financial services

Secure authentication, access governance and identity processes across the financial services sector.

Meeting the requirements of DORA, MaRisk, the German Capital Investment Code (KAGB) and further supervisory requirements for IT security and third-party risk management.

04/05

Automotive

Connecting and securing identity systems across production, engineering and supplier environments as well as the wider enterprise landscape.

Taking into account ISO/SAE 21434, TISAX, DORA (for financial and cloud services) and strict requirements for supplier access and intellectual property protection.

05/05

Public sector

Secure identity and access management for public authorities and institutions with distributed specialist applications and long lifecycles.

Taking into account BSI IT-Grundschutz, NIS2 and the German Online Access Act (OZG), as well as accountability to courts of audit and supervisory bodies.

Financial services

WertFels guided us from fragmented identity chaos to a central, automated IAM platform. BAIT and MaRisk audits are now considerably faster and easier. The application onboarding engine was a game changer.

Head of IAM

German financial services group

Insurance

Thanks to WertFels, we finally have unified identity governance with end-to-end role and lifecycle management. VAIT and DORA requirements are met, and manual processes have been significantly reduced.

Head of IT Governance

Insurance group in Germany

Automotive industry

WertFels secured our complex OT/IT environment with a scalable IAM solution and standardized application onboarding, achieving TISAX and ISO 21434 compliance across hundreds of suppliers.

Director Cybersecurity

Automotive manufacturer in Germany

Initial call

You describe your situation and your goal. We ask questions and tell you openly whether and how we can help. The call is without obligation.

Assessment and proposal

We outline the approach, effort and staffing and send you a concrete proposal, with a short analysis beforehand if you wish.

Delivery

Once you approve, we implement together, with regular check-ins and results that internal audit and external auditors can trace.

FAQ

Can't find your question?

Talk to our experts.

Ask a question

How should we handle non-human identities and AI agents?

Should we roll out IAM all at once or step by step?

We advise against a big bang. If all applications and processes switch over at once, business units, operations and internal audit are overloaded at the same time, and a single error hits the whole organization immediately. We roll out in stages: first the applications with the highest risk, then the rest in fixed waves with testing and sign-off. Each wave delivers an auditable interim result, and operations stay stable.

How do we show the regulator that entitlements are under control?

With evidence that comes from the IAM system itself: who requested, approved and confirmed which entitlement and when, and when it was revoked. Commission Delegated Regulation (EU) 2024/1774 under DORA requires, in Articles 20 and 21, governed identity and access management with clear accountability. We map every control to the relevant provision so the auditor finds the evidence directly.

What is best practice for admin rights?

Admin rights exist only for a limited time. Administrators use a standard account for their daily work and receive privileged rights through just-in-time access only for a specific task, only for as long as it takes, after approval and with logging. The rights then expire automatically. In normal operations there are no standing admin rights that an attacker could take over.

Which IGA system is the best on the market?

There is no general answer. The established systems all cover the core functions, whether SailPoint IdentityIQ, One Identity Manager or Omada Identity Suite: lifecycle, roles, recertification and segregation of duties. That is why the target operating model comes before the selection. It defines who runs the platform, who maintains roles and integrations, and which resources your organization actually has available for this. Only then can the remaining criteria be weighted sensibly, for example on-premises operation or SaaS, connectors for your applications, the complexity of the role model and the total cost over the full lifetime. We carry out this assessment with you before any license is bought.

Thank you for your inquiry.

Your message has been sent successfully. Our team will get in touch with you as quickly as possible.

Every identity under control.
Including AI agents.

New white paper on AI agents and DORA

All identities, one set of rules