Qiddiya Investment Company builds a secure identity foundation for a city in the making

Building a city from the ground up

Qiddiya is Saudi Arabia’s premier destination for entertainment, sports, and culture, and one of the most prominent giga-projects in the Kingdom. The scale of this initiative is unprecedented: the organization is not merely developing a destination but constructing an entire city from scratch and establishing a major new enterprise in parallel. Starting from zero gave Qiddiya’s leadership both complete freedom and immense responsibility.

From day one, the destination had to operate at global standards. For an enterprise growing this fast, with operations this complex, digital identity is not a peripheral concern; it is the foundational control layer that everything else depends on. Identity security is a strategic imperative because it underpins the security, compliance, and velocity of the entire enterprise.

The challenge of hyper-growth and legacy boundaries

In today's digital landscape, Identity itself has become the primary security perimeter. Every employee, contractor, machine, and even AI agent has an identity, and each represents a potential point of exposure that cannot be managed manually.

As Qiddiya scaled, its workforce model became increasingly complex. The organization consists of multiple legal entities, with a large ecosystem of full-time employees working alongside contractors and partners. Managing user personas and digital identities independently across these entities, with no consistent governance or consolidated visibility, presented a major hurdle. Fragmented processes and manual access controls simply could not keep pace with hiring demand. Not knowing definitively who had access to what, and whether they should, was a real and pressing business risk.

A strategic decision, not an IT upgrade

Qiddiya's leadership chose not to carry these risks into the next phase of growth, and treated identity modernization as an enterprise-wide transformation from the start.

Securing executive sponsorship from the outset changed everything. By elevating identity to a board-level strategic priority, Qiddiya established the mandates necessary to overcome systemic silos and maintain tight delivery timelines. This positioned the security program as a business enabler rather than an obstacle, giving leadership the confidence to make rapid decisions knowing that risk was being systematically managed in the background.

Why SailPoint and Accenture were the right fit

Qiddiya was not looking for a temporary tool; it was looking for a long-term capability and a robust partnership that could scale alongside its ambitions. As a platform-agnostic organization, Accenture evaluated options based strictly on Qiddiya's long-term business goals. To avoid adding technical debt, they required a "best-of-breed" solution with strong, native AI capabilities that could support future requirements.

SailPoint Identity Security Cloud emerged as the natural choice. The combination of Accenture’s implementation discipline and business acumen with SailPoint's mature identity security platform proved highly effective. Throughout the deployment, the Accenture and SailPoint teams operated seamlessly as a single, cohesive unit. Technical depth and execution expertise came together to transform Qiddiya’s complex, multi-entity requirements into clean, automated workflows. This partnership established a robust architecture that supports "zero-day productivity," ensuring that new hires are ready to contribute from their first minute on the job.

Delivering measurable outcomes

SailPoint Identity Security Cloud has transformed Qiddiya's operations. By establishing a single governing layer, the organization unified 20 distinct entities under one set of standards, regardless of the identity type or work profile. This consolidation has reduced identity-related administrative overhead by approximately 40%, shifting IT resources away from manual ticket resolution and toward strategic, high-value work.

Onboarding velocity has also improved dramatically. Previously, granting a new hire the correct access across multiple entities took several days and required extensive manual intervention. Using SailPoint's out-of-the-box connectors, the time required to provision new users into core SAP modules dropped from several days to minutes. This ensures 100% Day One readiness, helping the business maintain operational momentum during rapid hiring phases.

Qiddiya's complex ecosystem of partners, vendors, and third-party contractors is now securely managed. Through Non-Employee Risk Management (NERM), Qiddiya achieved 100% visibility into its non-employee workforce, ensuring access is strictly temporary and aligned with active contract terms. On the security front, Cloud Infrastructure Entitlement Management (CIEM) mapped and governed over 90% of cloud entitlements, minimizing the attack surface. Finally, NCA compliance has been streamlined: automated evidence collection has halved the time and effort required for audits.

Looking to an AI-driven future

With a secure, scalable foundation now established, Qiddiya is well-positioned to navigate future growth and evolving regulatory landscapes. Organizations that implement strong identity governance early in their lifecycle gain a lasting competitive advantage, allowing them to innovate faster and adapt to change with confidence.

The next phases of the program will focus on expanding governance capabilities. Qiddiya plans to implement broader access controls, automate policy enforcement, and increase business ownership of access decisions. Over time, AI-driven governance will extend across all categories of digital identity within the Qiddiya ecosystem, ensuring security remains a foundation for innovation.