Overview
Protiviti is a global business consulting firm founded in 2002 from former Arthur Andersen partners and consultants after Andersen's collapse. The firm is a wholly owned subsidiary of Robert Half International (NYSE: RHI), reporting approximately US$1.9 billion in FY2024 revenue across roughly 10,000 employees in 25 countries. Joseph Tarantino serves as President and CEO. Cyber and identity sit within the Security & Privacy practice, which has expanded materially over the past five years through acquisitions including iBoss Tactics (2021) and select boutique IAM firms.
Within identity and security consulting, Protiviti is best known for the depth of its GRC, internal audit, and SOX heritage, which differentiates the firm on access controls, segregation-of-duties remediation, and audit-aligned identity programmes. Protiviti holds partnerships with SailPoint, Saviynt, CyberArk, Okta, and Microsoft, and delivers IGA, PAM, and customer identity work. The firm runs a meaningful managed identity bench focused on access certification operations, SoD remediation, and IAM controls testing for SOX-compliant organisations. Industry depth is strongest in financial services, healthcare, and consumer products.
Protiviti is typically a fit for mid-to-large enterprises that want identity work bundled with internal audit, SOX controls testing, or risk advisory under a single contract, or for buyers wanting Big Four-grade methodology at materially lower pricing. The firm is smaller than the Big Four and tier-one SIs, and its identity platform implementation depth is below that of Optiv, Accenture, and the Big Four for complex multi-vendor programmes. Smaller single-platform IGA deployments under US$200,000 are usually better served by SailPoint Professional Services or a regional specialist.
Services Offered
- Identity strategy, IAM operating model, and roadmap
- SailPoint and Saviynt IGA implementation
- CyberArk privileged access deployments and audit-aligned PAM
- Segregation-of-duties (SoD) analysis and remediation
- Microsoft Entra ID, Entra ID Governance, and conditional access design
- SOX, SOC2, ISO 27001, and PCI-DSS controls advisory
- Cyber programme strategy, NIST CSF, and risk assessments
- Incident response, threat hunting, and tabletop exercises
- Managed identity services and access certification operations
- Privacy programme, CCPA, and GDPR advisory
Typical Engagement
| Engagement Type | Model | Typical Range |
|---|---|---|
| IAM strategy and target state design | Fixed-fee project | $150K–$500K (6–10 weeks) |
| IGA or PAM implementation | Fixed-fee or T&M | $800K–$4.5M (8–14 months) |
| Enterprise identity transformation | Multi-year outcome contract | $4M–$10M+ (18–36 months) |
| Managed identity services | Monthly retainer | $40K–$450K per month |
| Staff augmentation (Certified IAM) | Hourly bill rate | $135–$265/hour blended |
Pricing ranges verified May 2026 from public procurement records, identity vendor channel benchmarks, and reference checks. Protiviti India delivery centre lowers blended rates by 20–30%.
Strengths
- Deepest SOX and internal audit DNA among the non-Big-Four identity practices
- Strong SoD analytics, role mining, and access controls remediation capability
- 15 to 25% lower pricing than Big Four equivalents for comparable scope
- Owned by Robert Half — quick access to contract IAM resources for scaling delivery
- Mature managed identity services for SOX-aligned access certification operations
- No audit-conflict restrictions in the US, broadening the addressable buyer base
Limitations
- Identity platform implementation bench is materially smaller than Optiv, Accenture, and the Big Four
- Limited delivery footprint outside North America, the UK, and India compared with global SIs
- Multi-vendor depth is thinner — strongest on SailPoint and CyberArk, lighter on Okta, Saviynt, Ping
- Customer identity (CIAM) capability is limited compared with Accenture, Deloitte, or Optiv
- Brand recognition for identity work outside North America is below tier-one SIs and the Big Four