A US digital investing and savings platform replaced its previous access review tool with BalkanID and brought 28 disconnected applications into scope ahead of a Big Four audit.
Systems
Identity provider and SaaS stack, plus 28 disconnected internal and third-party apps
Drivers
Big Four audit tied to a corporate separation, with the CEO and C-suite participating in reviews
Challenges before BalkanID
- The prior review tool covered connected SaaS apps but left many financial and internal systems outside automated reviews.
- A corporate separation triggered a Big Four audit that required clean, complete evidence across every in-scope system.
- Orphaned accounts (accounts with no matching active employee) had to be found and remediated manually.
- Executive reviewers needed a fast, simple experience or the campaign would stall.
What they implemented
- Access reviews across connected apps plus 28 disconnected apps.
- An orphan-account review campaign, with a playbook that automatically opens Jira tickets for remediation.
- Risk-based reviewer context so executives focus on the access that matters.
- Early discovery of non-human identities and AI agents, as a design partner.
Outcomes
- Every in-scope system, including 28 without APIs, covered in one review program and one evidence trail for the auditors.
- Orphan remediation moved from manual follow-up to automatic ticketing. The customer's security lead described the playbook as having "worked perfectly."
- Displaced the incumbent review tool and expanded into non-human identity governance.
.svg)
