Overview
Deloitte is the largest of the Big Four professional services networks by both revenue and headcount, reporting US$67.2 billion in aggregate revenue for FY2024 across approximately 460,000 employees in 150 countries. The network operates as Deloitte Touche Tohmatsu Limited, a private UK company with member firms in each major market. Joe Ucuzoglu serves as Deloitte Global CEO; Jason Girzadas leads Deloitte US, the network's largest member firm. Cyber sits within the Risk & Financial Advisory practice in the US and as a standalone Cyber business unit in EMEA, with combined cyber revenue widely estimated above US$5 billion globally.
Within identity and security consulting, Deloitte fields one of the largest Big Four identity practices, with deep benches on SailPoint, CyberArk, Saviynt, Okta, Ping, Microsoft Entra, and ForgeRock. The practice covers identity strategy, IGA implementation, PAM, customer identity, machine and non-human identity, zero-trust architecture, and IAM managed services. Deloitte also runs significant adjacent practices in cyber programme strategy, third-party risk, OT and IoT security, security operations transformation, and post-breach incident response. The firm's audit-aligned controls testing methodology is a frequent reason regulated buyers select Deloitte.
Deloitte is typically a fit for global enterprises and regulated industries that need identity work bundled with audit, financial controls, or wider ERP and HR transformation in a single integrated programme. The firm is rarely the lowest priced option, with premium onshore rates and methodology overhead. Smaller single-platform IGA deployments under US$1 million are usually better served by a specialist such as Optiv or by the vendor's professional services arm.
Services Offered
- Identity strategy, target operating model, and IAM transformation
- SailPoint and Saviynt IGA implementation and migration
- CyberArk, BeyondTrust, and Delinea privileged access deployments
- Microsoft Entra ID, Entra ID Governance, and Entra Permissions Management
- Customer identity (CIAM) on Okta, Ping, and ForgeRock
- Zero-trust architecture and security operations modernisation
- Audit-aligned IAM controls testing for SOX, SOC2, ISO 27001
- Cyber incident response, forensics, and post-breach remediation
- Managed identity services and access certification operations
- Privacy engineering, data classification, and consent management
Typical Engagement
| Engagement Type | Model | Typical Range |
|---|---|---|
| IAM strategy and target state design | Fixed-fee project | $300K–$1.2M (8–14 weeks) |
| IGA or PAM implementation | Fixed-fee or T&M | $2M–$10M (8–18 months) |
| Enterprise identity transformation | Multi-year outcome contract | $10M–$50M+ (24–48 months) |
| Managed identity services | Monthly retainer | $80K–$900K per month |
| Staff augmentation (Certified IAM) | Hourly bill rate | $180–$340/hour blended |
Pricing ranges verified May 2026 from public procurement records, identity vendor channel benchmarks, and reference checks. Onshore-only US delivery is materially higher; India USI delivery centres lower blended rates by 25–35%.
Strengths
- Largest Big Four cyber practice globally by revenue and certified identity headcount
- Audit-aligned controls testing methodology suited to SOX, SOC2, and ISO 27001 environments
- Integrated delivery combining identity with ERP, HR, finance, and risk programmes under a single contract
- Strong industry IP for financial services, life sciences, energy, and public sector
- Mature India USI delivery centres for cost-blended IAM platform work
- Top-tier partner status across SailPoint, Saviynt, CyberArk, Okta, and Microsoft Entra
Limitations
- Premium pricing — onshore partner rates frequently exceed US$400/hour and methodology overhead is significant
- Cannot serve audit clients with attest-conflicting work, which materially restricts the addressable buyer base in the US
- Methodology rigidity can slow delivery on smaller, product-led identity engagements
- Senior consultant turnover between accounts is common during multi-year programmes
- Member-firm structure means delivery quality varies across geographies and account teams