Umbrella Associates

What Umbrella Associates does

Umbrella Associates (legal entity: umbrella.associates GmbH, HRB 118978, Eschborn/Frankfurt) is a privately held, founder-managed boutique consultancy founded in 2020 specializing in Identity and Access Management (IAM) and information security advisory. The firm operates primarily in the DACH region (Germany, Austria, Switzerland), serving enterprise clients in verticals including Finance, Automotive, Supply-Chain, Mechanical Engineering, and Aviation. Its service portfolio spans strategic and architectural consulting across Identity Management, Access Management/SSO, CIAM, IGA, PAM, Cloud Governance, and Fine-Grained Authorization, augmented by instructor-led training programs covering CIDPRO, CISSP, CCSP, CISM, CISA, OSINT, and customized workshops. Named enterprise customers include ABUS, DB Connect GmbH, DB Services GmbH, Siemens Energy, and noris network AG; the company reports 50+ projects, 15,000+ protected identities, and 25%+ year-on-year growth.

The company's core technology and product surface is comparatively narrow for a consultancy of its scale. Two proprietary assets stand out: the OPA-SpiceDB extension, an open-source tool enabling Open Policy Agent to function as a Policy Decision Point for hybrid PBAC and ReBAC authorization (co-developed with Authzed/SpiceDB), and Application Supply Guard, a 2025-launched managed SBOM service co-developed with ReversingLabs that analyzes software binaries for supply-chain security and compliance with NIS2/DORA/CRA. The broader stack is built on partner-led integrations across OKTA/Auth0, cidaas, Hitachi ID, OneIdentity, Betasystems, Microsoft, Ping Identity, PlainID, Permit.io, SGNL.AI, Styra, SPIFFE/SPIRE, and others, supporting a vendor-independent advisory posture.

Commercially, Umbrella Associates generates revenue through professional services (IAM consulting, workshops, audits) and training programs, with pricing quoted on project scope and no public pricing disclosed. Distribution is direct, through regional field/enterprise engagement and partner-led training delivery with qSkills and Explorato. The firm markets itself through content (blog), industry conferences (Identiverse, EIC, IT Security Summit), GitHub open-source presence, and analyst relationships with Gartner, KuppingerCole, and CyberHut. The team is described as fewer than 10 employees per firmographics but 50+ associates per the company site, with 100% CIDPRO certification across personnel; no funding rounds, M&A, or external investment have been disclosed.

Name

Umbrella Associates

Legal name

umbrella.associates GmbH

Website

https://umbrella.associates

Company type

Private

Founded year

2020

Operating status

Operating

Headcount range

1–10 employees

Short description

Umbrella Associates is a Frankfurt-based boutique consultancy offering vendor-independent Identity and Access Management advisory, training, and proprietary tools (OPA-SpiceDB extension, Application Supply Guard SBOM service) to enterprise customers across DACH verticals including Finance, Automotive, and Energy.

Ownership category

akta.pro rank

Product category

Identity & Access Management Consulting

NAICS

Management Consulting Services (54161), Custom Computer Programming Services (541511), Other Management Consulting Services (541618)

SIC

Services-Computer Programming, Data Processing, Etc. (7370), Services-Management Consulting Services (8742), Services-Computer Programming Services (7371)

akta.pro primary industry

Identity & Access Management (IAM) Administration Services (BPAEABAJ)

akta.pro secondary industries

Strategy & IT Advisory (BPAEAAAA), ERP, CRM & Enterprise Applications Consulting (BPAHAEAI), Software/Application Support (SaaS, Enterprise Apps) (BPAAACAC)

Keywords

• Identity access management consulting
• Privileged access management services
• Customer identity management
• Fine grained authorization
• Cybersecurity training certification

Headquarters

HQ city

Eschborn

HQ country

Germany

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure

Revenue model

1. IAM Consulting Services: Strategic consulting, workshops, audits, and advisory services around Identity & Access Management and Information Security. Covers strategy, processes, people and tools. Vendor-independent advisory.
2. Training and Certification Programs: Professional training programs including OSINT, IAM Basics, CIDPRO, CISSP, CCSP, CISM, CISA, and customized in-house workshops delivered by experienced practitioners.
3. IAM Master Data Consolidation Services: Data massage and ETL services using tools like Pentaho to refine datasets from Sources of Truth (HR, Payroll) for IAM/IGA solutions.

Pricing tiers

Distribution channels2 records

Marketing channels4 records

Core offering

Umbrella Associates delivers vendor-independent boutique consulting and system integration services in Identity & Access Management, covering Identity Management, Access Management, CIAM, IGA, PAM, Fine-Grained Authorization, Master Data Records consolidation, and Cloud Governance. The firm complements its advisory practice with instructor-led certification training (CIDPRO, CISSP, CCSP, CISM, CISA, OSINT) and two proprietary technology offerings: the Application Supply Guard managed SBOM service and the open-source OPA-SpiceDB authorization extension.

Product overview

Umbrella Associates is a boutique IT Security and Identity & Access Management (IAM) consulting firm headquartered in Eschborn/Frankfurt, Germany. The company offers a portfolio of consulting services and proprietary tools rather than a unified software platform. Its core consulting practice covers Identity Management, Access Management, CIAM, IGA, PAM, Cloud Governance, and Fine Grained Authorization. Key proprietary offerings include the Application Supply Guard (a managed SBOM service developed with ReversingLabs for software supply chain security) and the OPA-SpiceDB open-source extension (for hybrid PBAC/ReBAC authorization). The company complements its consulting with instructor-led training programs including OSINT, IAM, CIDPRO, CISSP, CCSP, CISM, and CISA preparation, delivered both as open enrollment and customized in-house workshops.

Differentiator

Problem solved

Functional benefit

Brands

• Application Supply Guard: A managed service SBOM tool developed in partnership with ReversingLabs that analyzes software binaries to create complete Software Bill of Materials and security reports.

Products and services

• Application Supply Guard Managed Software Bill of Materials (SBOM) service that analyzes software binaries in their delivered state, generates complete SBOMs, cross-references components with CVE databases, and produces structured Security Reports for software supply chain assurance.
• OPA-SpiceDB Extension Open-source extension for the Open Policy Agent (OPA) that enables OPA to act as a Policy Decision Point for both Policy-Based Access Control (PBAC) and Relationship-Based Access Control (ReBAC), combining SpiceDB's relationship model with OPA's policy-based decision functions for hybrid fine-grained authorization.
• Identity Management Consulting Strategic and architectural consulting for Identity Management, including ID-Management strategy development aligned to business needs, ID-Architecture design supporting business processes, and CI/CD pipeline optimization for IGA environments.
• Access Management / Single Sign-On Consulting Consulting for defining and implementing Access Management and Single Sign-On solutions across open-source and proprietary technologies including Microsoft ADFS, OKTA, Ping Identity, Broadcom SiteMinder, and Shibboleth.
• Customer Identity and Access Management (CIAM) Consulting Business-oriented consulting for protecting digital online services and customer data with trustworthy, secure, simple, and highly-usable frontends. Preferred platforms include OKTA Customer Identity Cloud (Auth0) and cidaas for EU data residency requirements.
• Privileged Access Management (PAM) Consulting Privileged Access Management consulting covering strategy, requirements engineering, and architecture on solutions including Microsoft Azure AD PIM, OneIdentity Safeguard, Hitachi ID Bravura Privilege, Senhasegura PAM Core, BeyondTrust, and Segura.
• Identity Governance and Administration (IGA) Consulting End-to-end Identity Governance and Administration consulting including role-based and risk-based governance, automated recertification, SoD checks, and continuous compliance for employees, customers, partners, machines, and AI agents.
• Fine-Grained Authorization (FGA) Consulting Fine-grained authorization consulting and implementation helping organizations move beyond static RBAC to dynamic, context-based, policy-driven access control, including hybrid PBAC/ReBAC via the OPA-SpiceDB extension.
• Master Data Records for IAM Consulting Data consolidation and quality management for IAM/IGA projects using ETL-based extraction from authoritative sources (HR, Payroll), data cleansing, and preparation of ID data for IGA solutions via tools such as Pentaho, databases, and LDAP.
• Cloud Governance Consulting Cloud governance consulting focused on regaining control over cloud resources, establishing least-privilege access, building service inventories, and providing insights on consumption, cost, and risk across AWS, Azure, and MS 365 using Rencore, Codeshield, and meshStack.
• OSINT Training Open Source Intelligence training programs — OSINT Basics (5-day foundational course covering methodology, tools, OPSEC, darknet, social networks) and OSINT Intermediate (advanced course for experienced specialists), delivered in partnership with Explorato for law enforcement and cybersecurity audiences.
• CIDPRO Preparation Training Preparation training for IDPro's CIDPRO certification, covering current IAM foundational knowledge from the IDPro Body of Knowledge, delivered in partnership with qSkills.
• (ISC)² CISSP Preparation Course Certified Information Systems Security Professional preparation course covering IT security knowledge based on official (ISC)² materials, delivered in partnership with qSkills.
• (ISC)² CCSP Preparation Course Certified Cloud Security Professional preparation course covering cloud security knowledge based on official (ISC)² materials, delivered in partnership with qSkills.
• ISACA CISM Preparation Course Certified Information Security Manager preparation course covering information security management based on official ISACA materials, delivered in partnership with qSkills.
• ISACA CISA Preparation Course Certified Information Systems Auditor preparation course covering IT audit knowledge aligned with official ISACA materials, delivered in partnership with qSkills.
• Customized In-House Training Workshops Tailored in-house training workshops covering Applied Cryptography, PKI, IAM Strategy, Customer/Consumer IAM, PAM Strategy, DevOps automation, and Data Flow Analysis, typically delivered as 2-day workshop formats.

Quantifiable outcome

• Protected 15,000+ identities
• +2 more outcomes

Named customers5 records

Segments1 record

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Integration36 records

Feature3 records

Partnerships

Ten partnerships are on record, tiered minor and core.

• ExploratominorImplementation/ SI/ Consulting PartnerOSINT training partner for OSINT Basics and Intermediate courses, providing hands-on expertise for law enforcement and cybersecurity training programs.
• qSkillscoreStrategic or Co-development PartnerTraining partner for CISSP, CCSP, CISM, CISA preparation courses and CIDPRO training, co-delivering certification programs.
• IDProcoreStrategic or Co-development PartnerIDPro Body of Knowledge contributor and CIDPRO certification partner. All UA employees are CIDPRO certified.
• (ISC)2coreStrategic or Co-development PartnerAuthorized training provider for CISSP and CCSP certification preparation courses.
• ISACAcoreStrategic or Co-development PartnerTraining partner for CISM and CISA certification preparation courses.
• cidaascoreTechnology or IntegrationPreferred CIAM solution for customers requiring EU/Germany-local data residency. Training partner for cidaas Connect events.
• OKTA (Auth0)coreTechnology or IntegrationAuth0 partner for CIAM/Customer Identity Cloud solutions. Preferred platform for SaaS-based CIAM delivery.
• cidaascoreTechnology or IntegrationEU-local CIAM solution for customers with high data protection requirements.
• AuthzedcoreTechnology or IntegrationCo-developer of OPA-SpiceDB extension. SpiceDB provider for ReBAC authorization.
• ReversingLabscoreStrategic or Co-development PartnerJoint development partner for Application Supply Guard SBOM tool, providing binary analysis technology.

Scale indicators5 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• iC Consult Group: German boutique consultancy specializing in Identity & Access Management, Identity Governance, and Privileged Access Management. Closely comparable to Umbrella Associates in scope (IAM consulting), geography (DACH), and customer profile (large enterprises). Recently acquired by Reply Group but operates as a focused IAM boutique.
• Simeio Solutions: Globally focused IAM/IAM managed services firm offering strategy, implementation, and managed operations across workforce and customer identity. Comparable to Umbrella in core IAM services and vendor-independent posture, but materially larger scale.
• Edgile (now KPMG): Identity-focused security consultancy (acquired by KPMG) with strong vendor-independent IAM strategy, IGA/PAM, and privileged access advisory. Highly comparable in services offered; now backed by Big 4 scale.

Broad incumbents

• msg systems AG: Large German IT consultancy and software firm with a dedicated IAM/Identity Governance practice serving banks, insurance, and automotive. Broader portfolio than Umbrella but overlaps on IGA consulting for regulated German enterprises.
• Optiv Security: Large US-based security solutions integrator with strong identity and cyber-risk advisory practice. Significant overlap on enterprise IAM strategy and implementation, with broader geographic reach and a larger portfolio than Umbrella.
• Accenture Security: Global systems integrator with large Identity & Access Management services practice, including managed IAM and IGA implementations at scale. Competes with Umbrella on large multi-vendor enterprise IAM programs.
• Deloitte Cyber & Strategic Risk: Big 4 advisory firm with a substantial IAM and identity governance practice serving global enterprises. Overlaps with Umbrella on identity strategy and regulatory-driven IAM programs (NIS2, SOX, GDPR).
• Kyndryl: Global infrastructure services provider (spun out of IBM) with a managed identity services practice serving large regulated enterprises. Competes on large multi-year IAM transformation and managed services engagements.

Others

• Authzed: Commercial vendor behind SpiceDB (open-source ReBAC database). Co-development partner with Umbrella on the OPA-SpiceDB extension - technology partner rather than direct competitor, but central to Umbrella's fine-grained authorization practice.
• PlainID: FGA/PBAC authorization platform vendor that Umbrella partners with for fine-grained authorization projects. Adjacent rather than competitive, but operates in the same policy-based authorization space Umbrella consults on.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks7 records

Key highlights7 records

Customer concentration

• GitHubgithub.com/umbrellaassociates
• LinkedInlinkedin.com/company/umbrella-associates

Compliance6 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles2 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Umbrella Associates