IAM4SME: Identity and Access Management for SME's

Small and medium-sized enterprises (SMEs) in Flanders are increasingly exposed to cybersecurity threats, with authentication systems often serving as the first and most critical line of defence. As digital transformation accelerates—driven by remote work, cloud adoption, and regulatory pressure—many SMEs face difficulties in implementing authentication mechanisms that are secure, user-friendly, and future-proof.

Traditional password-based systems remain widespread despite their well-known vulnerabilities, primarily due to a lack of in-house expertise and awareness of modern alternatives such as multi-factor authentication (MFA), passwordless solutions, and modern standards such as FIDO2 and passkeys.

In addition, many SMEs operate in complex environments where the implementation of secure authentication and authorisation standards is not straightforward. Complex IT infrastructures combining on-premises and cloud servers, internal, remote, and external users, varying levels of technical debt, and established toolchains that are not easily replaced are common among many SMEs.

Alongside this IT context, many SMEs also have a relevant operational technology (OT) environment in which identity and access management (IAM) plays an important role. In these environments, digital business applications are combined with operational systems such as machinery, production lines, or industrial installations. Although the same fundamental IAM principles apply, the usage contexts, constraints, and implementation choices differ.

A recent consultation round with SME stakeholders revealed a strong and growing demand for practical guidance and hands-on support in improving authentication strategies. Many SMEs recognise the importance of strong authentication but lack the resources required to effectively evaluate, adopt, or integrate these technologies. Moreover, they are often insufficiently aware of the implications related to usability, compliance, and costs associated with more advanced solutions.

There is also a clear gap between academic research on secure authentication and the practical challenges SMEs face when implementing these systems in real-world business environments.