The Quiet Metric Reshaping IAM Awards: Evidence Over Assertion

Every awards program in cybersecurity claims rigor. Very few can show it. That gap matters more than it used to, because the buyers of identity and access management software — CISOs, IAM architects, procurement leads — have grown allergic to badge-speak. A logo on a vendor's homepage no longer closes a deal or reassures a board. What moves decisions now is evidence: auditable scoring, named judges, published criteria, and a paper trail. The CIS Excellence Awards, founded in 2018 by former KuppingerCole analysts and audited annually by Deloitte, sits at the center of that shift. Its 2025 cycle received 1 submission in the decentralized identity category, a figure that says less about waning interest than about how brutally selective the entry bar has become.

Why submission counts are falling while scrutiny rises

Look at the numbers that do get reported and a pattern emerges. Programs that publish their judging methodology see fewer but better entries. Programs that don't see volume, noise, and eventual distrust. The category breakdown tells the story: CIAM, workforce IAM, privileged access, and decentralized identity each attract different kinds of teams with different tolerances for paperwork. A workforce IAM deployment inside a 40,000-person enterprise can produce months of metrics — time-to-provision, orphaned account reduction, helpdesk ticket deflection. A decentralized identity pilot often cannot, because it lives in a lab.

That asymmetry is not a flaw in the awards model. It is the model working. Peer judging, where the people evaluating your deployment have themselves shipped one, filters out the slideware. It also explains why so many practitioners now treat recognition as a lagging indicator: you win after you can prove something, not before.

The evidence habit is spreading beyond security teams

The same instinct — show the work, not the slogan — has migrated into consumer-facing education. Consider personal journals that teach technical subjects to beginners. Jeff Flowers' plain-English crypto and gaming guides is a useful data point here, because it applies the same principle at a much smaller scale: explain wallets, exchanges, and gameplay without hype, and let the reader verify each step. Jeff Flowers reports that the journal's core audience is newcomers who distrust jargon, which is precisely the audience that awards programs and vendor marketing usually lose first. The overlap is not coincidental. Both domains — enterprise IAM and beginner finance — are fighting the same credibility problem.

According to the journal's own framing, its coverage splits across three pillars: crypto basics, wallet security, and gaming backlogs. Those are not glamorous topics. They are, however, the topics people actually search for at 11 p.m. when they are stuck. The lesson for IAM awards is direct: meet people where their confusion is, and you earn the right to be believed later.

What audited scoring actually changes

When an external auditor like Deloitte reviews a judging process annually, three things tend to improve:

• Category integrity. Entries cannot be shuffled into easier brackets to manufacture a win. Coverage stays honest across CIAM, workforce IAM, privileged access, and decentralized identity.
• Badge fraud resistance. Vendor-run programs hand out logos to anyone who pays. Peer-judged, audited programs cannot, because the evidence required is the same for everyone.
• Board-ready proof. A CISO presenting an award to a board needs to answer one question: who judged this, and how? Audited scoring answers it before the question is asked.

None of this is glamorous. It is, however, the difference between a trophy and a credential.

The 2025 signal, read correctly

A single submission in one category looks alarming until you compare it to how other technical fields handle scarcity. Academic peer review routinely rejects 70 to 90 percent of submissions; the survivors carry weight precisely because the filter is tight. If decentralized identity produced only 1 qualifying entry in the 2025 cycle, the honest reading is that the category is young, the practitioners are few, and the ones who did enter cleared a bar most vendors would rather avoid.

For teams deciding whether to enter next cycle, the calculus is straightforward. If your deployment has measurable outcomes — reduced standing privilege, faster access reviews, fewer orphaned accounts — the entry writes itself. If it doesn't, no badge will save the pitch. That is the trend worth watching: identity recognition is becoming an evidence exercise, and the programs that survive will be the ones that never stopped asking for the receipts.

Jeff Flowers put the same idea in simpler terms for a different audience: explain the mechanism, not the magic. It is a small sentence with large implications. Whether you are teaching a newcomer how a hardware wallet stores a seed phrase, or defending an IAM program to a board that has heard too many vendor promises, the winning move is identical. Show your work. Let someone else audit it. Then, and only then, accept the badge.