A manufacturing company’s finance manager arrives at the office one morning to find she cannot log into the ERP system. The IT team investigates and the picture that emerges is uncomfortable: an account created for a supplier’s employee, unused for six months, had been active throughout the night — reading invoice records and transferring data outside the network. The account had never been closed. The password was ‘Supplier2018’. This scenario captures a security vulnerability that mid-sized businesses in Turkey are encountering with increasing frequency: the neglect of Identity and Access Management, or IAM. Malicious software and external attacks attract more media attention, but the majority of breaches begin from a far more mundane point — an expired, over-privileged, or compromised user account sitting quietly inside the perimeter.
Consistent findings from global security research point to the same conclusion: stolen or misused credentials play a direct role in more than half of all corporate data breaches. Turkey is no exception. When the Personal Data Protection Law (KVKK) came into force in April 2018, organisations became legally obligated to report personal data breaches — and this obligation brought to light many incidents that had previously been quietly overlooked. Insider threats, active accounts belonging to former employees, and identities scattered across cloud applications all demonstrate that the traditional perimeter-defence model is no longer sufficient. Staying behind a firewall does not guarantee protection when a significant portion of the threat is already inside, moving around under a legitimate identity.
The core of IAM is ensuring that the right person accesses the right resource at the right time and with only the level of access they actually need. That definition sounds straightforward, but in practice it requires managing several distinct layers simultaneously. The first is authentication: verifying that a user is who they claim to be. The second is authorisation: defining which resources an authenticated user can reach and what actions they can perform. The third is lifecycle management: keeping identity records current from onboarding through to offboarding. Many SMEs in Turkey address all three layers with a single password policy. The result is that system access rights accumulate, go unmonitored, and eventually become unmanageable.
Multi-factor authentication (MFA) stands out as the IAM component with the fastest return on investment. Authentication that relies on a password alone offers no barrier once credentials are compromised. MFA adds a second factor to something the user knows — a password — by requiring something they possess, such as a mobile phone or hardware token, or a biometric element. Turkey’s banking sector has applied this method to customer transactions for years; adoption in corporate systems, however, remains low. Requiring MFA for access to ERP, accounting, and HR systems dramatically reduces the risk of account takeover. The additional cost and user friction are real obstacles, but they need to be weighed against the operational and legal consequences of a single breach — especially under KVKK, where notification obligations and potential administrative fines are now concrete risks.
Privileged Access Management (PAM) represents the most critical and most frequently neglected segment of IAM. Highly privileged accounts — system administrators, database administrators, external consultants — can compromise an entire environment if they are taken over. In many Turkish organisations these accounts are shared among multiple people, their passwords are changed infrequently, and access logs are rarely reviewed. PAM solutions place these accounts in a secure vault, record every session, and restrict authorisation to defined time windows. Implementation costs can appear significant for a mid-sized business, but cloud-delivered PAM services have substantially lowered that barrier. If prioritisation is necessary, bringing privileged accounts under control before deploying a comprehensive IAM platform delivers faster and more measurable risk reduction.
Identity lifecycle management is the area most consistently overlooked in practice. When an employee leaves an organisation, closing their account seems like a simple process in theory. In reality, coordination gaps between HR, IT, and individual system administrators mean accounts remain open long after they should have been deactivated. In Turkey’s retail and logistics sectors, where staff turnover rates are high, this problem is particularly pronounced. Automated provisioning and deprovisioning processes — integrating the HR system with the ERP and directory services — close this gap systematically. Periodic access reviews reveal whether current employees still hold permissions they no longer need. Automating these processes is a necessity for large enterprises; for SMEs, starting with a manual audit conducted every six months is a realistic and meaningful discipline.
An SME manager looking to implement IAM has a few concrete decision points to work through. The starting point is producing a current account inventory: how many accounts exist, who owns them, and which have not been used in the past six months. This step alone provides the visibility that most organisations lack. The second step is adding MFA to the most critical systems — for most cloud applications this requires no additional licence cost. The third step is making privileged accounts individual and auditable, eliminating shared administrative credentials. These three steps meaningfully improve the risk profile even before a comprehensive IAM platform is in place. From a KVKK compliance standpoint, they also ensure that access to personal data is documentable — a critical requirement in any regulatory audit. Security investment always looks like a cost line; to see the full picture, the calculation must also include the operational downtime, legal notification obligations, and reputational damage that follow a breach.
This article was originally written in Turkish by Gökhan MERCANOĞLU on April 22, 2019 and has been automatically translated into English and other languages using machine translation.