Overview
EY (Ernst & Young) is one of the Big Four professional services networks, formed in 1989 through the merger of Ernst & Whinney and Arthur Young. The network reported US$51.2 billion in aggregate revenue for FY2024 across approximately 395,000 employees in more than 150 countries, operating as EY Global Limited with member firms in each major market. Janet Truncale assumed the role of Global Chair and CEO in July 2024, succeeding Carmine Di Sibio. Cyber and identity work sits within EY Consulting and is anchored by EY US, EY UK, EY Germany, EY India (GDS), and EY Australia.
Within identity and security consulting, EY runs a Big Four practice that has materially expanded over the past three years following the cancellation of the Project Everest split. EY holds top-tier alliance status with SailPoint, Microsoft, Okta, Saviynt, ForgeRock, and CyberArk, and operates a sizeable EY Global Delivery Services (GDS) bench in India and Poland for IGA platform work. Industry depth is strongest in oil and gas, power and utilities, life sciences, capital markets, and government. EY also runs a Managed Services capability for IAM operations and incident response through EY Cybersecurity Managed Services.
EY is typically a fit for global enterprises in energy, life sciences, or capital markets that want identity work bundled with risk, regulatory, or operational resilience programmes. The firm is rarely the cheapest option and faces the same audit-conflict constraints as other Big Four members in the US market. Smaller single-platform IGA deployments under US$1 million are usually better served by Optiv, SailPoint Professional Services, or another specialist.
Services Offered
- Identity strategy, IAM operating model, and roadmap
- SailPoint and Saviynt IGA implementation and migration
- CyberArk and BeyondTrust privileged access deployments
- Microsoft Entra ID, Entra ID Governance, and conditional access design
- Customer identity (CIAM) on Okta, Ping, and ForgeRock
- Zero-trust architecture and OT security advisory
- SOX, NIST CSF, ISO 27001, NERC CIP, and DORA controls advisory
- Incident response, threat intelligence, and breach investigation
- Managed identity and access certification operations from EY GDS
- Privacy programme, GDPR, and consent management advisory
Typical Engagement
| Engagement Type | Model | Typical Range |
|---|---|---|
| IAM strategy and target state design | Fixed-fee project | $220K–$950K (6–12 weeks) |
| IGA or PAM implementation | Fixed-fee or T&M | $1.6M–$8.5M (8–18 months) |
| Enterprise identity transformation | Multi-year outcome contract | $8M–$40M+ (24–42 months) |
| Managed identity services | Monthly retainer | $65K–$750K per month |
| Staff augmentation (Certified IAM) | Hourly bill rate | $170–$320/hour blended |
Pricing ranges verified May 2026 from public procurement records, identity vendor channel benchmarks, and reference checks. EY GDS centres in India, Poland, and the Philippines lower blended rates by 25–35%.
Strengths
- Deepest Big Four identity assets for oil and gas, power and utilities, and life sciences
- Strong OT and IT identity convergence advisory for industrial buyers
- EY Global Delivery Services (GDS) deliver competitive blended IGA platform rates from India and Poland
- Top-tier alliance with SailPoint, Saviynt, CyberArk, Microsoft Entra, Okta, and ForgeRock
- Mature regulatory advisory bench across DORA, NIS2, NERC CIP, FERC, and FDA 21 CFR Part 11
- Audit-aligned controls testing methodology for SOX, SOC2, and ISO 27001
Limitations
- Premium pricing — partner rates frequently exceed US$385/hour onshore
- Audit-client independence rules restrict the addressable buyer base in the US for non-audit clients only
- Methodology rigidity can slow product-led IGA work compared with specialist firms
- Project Everest split cancellation in 2023 caused episodic senior consultant departures still affecting bench depth
- Lighter retail and consumer goods footprint than Deloitte and PwC for identity-specific work