There's a scene near the end of Indiana Jones and the Last Crusade where an ancient knight, guarding a cave full of chalices, tells Indy to pick the real Holy Grail out of dozens of convincing fakes. "Choose wisely," he warns, "for while the true Grail will bring you life, the false Grail will take it." Indy studies the room, a plain wood cup versus gilded goblets, and picks the humble one. He's right. The villain who grabs the jewel-encrusted one moments later is not, and it does not end well for him.
It's an odd place to start a conversation about enterprise security, except that identity and access management professionals have been calling their own end goal "the holy grail" for years and the metaphor holds up better than you'd expect. Most organizations aren't guarding one cave with one grail. They're guarding thousands of digital doors, spread across cloud apps, on-prem systems, and vendor tools, and most of them can't actually say with confidence who's holding which keys.
The Question Nobody Can Answer
"Who has access to what?" sounds like it should have a simple answer. Except it doesn't. Not who's supposed to have access according to a policy document nobody's opened since it was written, who actually, at this moment, has a working credential into a given system, application, or dataset.
This isn't an abstract problem. In 2023, a ransomware attack on MGM Resorts shut down slot machines and hotel key-card systems for days, with losses reportedly exceeding $100 million. Caesars Entertainment, targeted by the same threat actors around the same time, ended up paying a reported $15 million ransom rather than risk stolen customer data being leaked. Clorox suffered an attack severe enough to cause real product shortages on store shelves. Three companies undone by the same underlying gap: someone had access they shouldn't have, and nobody caught it in time.
Six Trials Guarding the Cave
Security teams tend to describe six specific capabilities as the "holy grail" of identity management, the things that when taken together, actually let an organization answer the access question with confidence:
A last-access policy tracks when someone last used a given permission, not just when it was granted. Access that's sat unused for months or years (often left over from a role someone held long ago) is exactly the kind of stale credential attackers look for, and most organizations have no systematic way to prune it.
Real-time event consumption means identity systems learn about a hire, a termination, or a role change the moment it happens, rather than through a nightly batch file pulled from HR software once a day. A day's lag doesn't sound like much until it's the day someone's employment ends and their access doesn't.
Separation of duties prevents any one person from accumulating a combination of permissions that lets them, say, both create a vendor and approve payment to it, a control that only works if there's a single, reliable picture of everything a person can already do.
Least privilege is the principle that someone should have exactly the access their job requires, no more. It sounds obvious and is notoriously hard to enforce, because it depends on everything above it already working.
Birthright access and role-based access control tie a person's permissions directly to their actual job function inside the HR system, so onboarding and offboarding happen automatically and correctly, rather than through a manual request queue that's perpetually behind.
Individually, none of these are new ideas. Running them consistently across every application a company has is the hard part, and it’s the part where most organizations fall short.
The False Grails Littering the Cave
Part of what makes this difficult is that the identity industry has produced a lot of legitimate, well-built tools without producing one that solves the whole problem. Early identity management platforms emerged decades ago from vendors like IBM, Computer Associates, Oracle, and Novell. A more mature generation followed; governance, single sign-on, and privileged access tools that most mid-size and large companies run some combination of today. A newer wave of specialized point solutions has since emerged to fill specific gaps, like discovering unsanctioned "shadow IT" applications or analyzing who can actually reach sensitive data.
Every one of these is a genuine, useful cup. None of them, on its own, is the Grail. An organization can own every category of tool in the identity stack and still fail the test, because the tools don't share data with each other, and nobody's routing the combined signal into a security operations center where a human can actually see the pattern.
The other trap is sheer scale. Most companies run far more applications than their security team can name, let alone govern. Building a proper integration for each one is slow and expensive, so teams typically onboard only the business-critical or regulated applications into formal access management, leaving the rest to manual, inconsistent processes. That's a lot of unguarded goblets sitting in the cave.
Choosing Wisely at Scale
The way out, increasingly, involves the same technology reshaping most other corners of IT: automation and machine learning, applied specifically to the grunt work of connecting applications and discovering the ones nobody knew existed. Done well, this turns six separate, manual disciplines into one orchestrated system, where access management, governance, and privileged access work from the same data instead of three teams squinting at three different dashboards.
For organizations starting from scratch, the practical path isn't to overhaul everything at once. A reasonable first step is to look at the applications already cataloged in a configuration management database, identify business-critical systems that sit outside regulatory scope, and pilot the full set of controls there before expanding. Even Indy didn't reach for the jewel-encrusted goblet first, he ruled out the obvious wrong answers before he ruled in the right one.
The stakes of getting this wrong aren't hypothetical, and they aren't small. The false grail in this story might not cost a life, but it will cost a quarter of revenue, a public breach disclosure, and a very uncomfortable conversation with the board.
You Don't Have to Map the Cave Alone
Every organization enters this journey from a different point in the cave: some are still running first-generation, on-prem identity tools; others have invested in a modern stack but can't get the pieces to talk to each other; others have the full toolkit but no orchestration layer tying it together. Wherever a company stands, the work of getting to a real, defensible answer to "who has access to what" is rarely a solo trek.
Gotham partners with IDMWORKS to help organizations move through exactly this kind of journey, at whatever stage they're starting from. Whether that means standing up foundational access management for the first time, maturing an existing identity governance and privileged access program, or orchestrating a full suite of existing investments into one coherent strategy, we work alongside your security and IT leadership to build a program suited to where you actually are. If your organization is trying to figure out its own path through the cave, that's a conversation worth having before the choice gets made for you.