TL;DR: Pathlock was featured as an Overall Leader in KuppingerCole Analysts AG’s 2026 Leadership Compass for Business Application Risk Management, which evaluates how vendors manage entitlements and enforce SoD policies across heterogeneous enterprise applications such as SAP, Salesforce, Workday, Oracle, and Microsoft Dynamics. The practical shift is that IGA programmes must govern access across business application estates, not just directory-centric identity controls.
At a glance
What this is: This is an analyst evaluation of business application risk management tools, and its key finding is that cross-system IGA now matters more than directory-only control in heterogeneous enterprise application estates.
Why it matters: It matters because IAM and IGA teams responsible for business applications need governance that spans entitlement visibility, segregation of duties, and operational consistency across multiple platforms.
Context
Business application risk management is the discipline of governing entitlements and segregation of duties across the systems where work actually happens, not just in the directory. In this report, that means managing access across SAP, Salesforce, Workday, Oracle eBusiness Suite, Microsoft Dynamics, and other line-of-business applications with a single governance model.
The core problem is fragmentation. When entitlements, approvals, and SoD checks sit in separate systems, governance becomes inconsistent and audit evidence becomes harder to trust. Pathlock is the publisher cited in the report, but the real issue is whether cross-system IGA can keep pace with increasingly cloud-centric business application estates.
Key questions
Q: How should teams govern access across multiple sites and business units?
A: Use one lifecycle model for all sites, then vary access by role, location and relationship. The goal is to make onboarding and offboarding consistent enough that expansion does not create local exceptions that outlast their business purpose.
Q: Why do segregation of duties controls break down in hybrid and multi-application environments?
A: They break down because access governance is often built around one system at a time, while real users and service identities operate across several platforms. A role that looks harmless in one application can complete an incompatible workflow when combined with another entitlement elsewhere. SoD fails when the control model stops at the platform boundary.
Q: What are the signs that business application IGA is too fragmented?
A: Common signs include inconsistent entitlement inventories, manual evidence gathering, delayed certification cycles, and SoD exceptions that are discovered only during audit preparation. Those symptoms show that the governance model is tracking applications separately instead of managing risk across them.
Q: How do IAM and IGA teams decide whether to prioritise cross-system coverage?
A: Prioritise the applications that carry the highest entitlement risk and the most important business transactions, then expand coverage where control gaps or audit pain are greatest. If critical workflows span multiple platforms, cross-system governance should be treated as a programme baseline, not a later enhancement.
Technical breakdown
Why cross-system entitlement governance is harder than directory control
Directory-centric IAM assumes a relatively small number of identity stores and a clean path from authentication to access decision. Business application risk management is different because entitlement data lives inside operational applications, often with unique roles, custom permissions, and application-specific SoD rules. The control problem is not just who can log in, but what business functions they can execute once inside each platform. That is why a toolset must normalize access data across heterogeneous systems before it can govern risk consistently.
Practical implication: Map entitlement sources across each business application before you try to standardise access reviews or SoD enforcement.
How SoD enforcement changes in heterogeneous LoB applications
Segregation of duties only works when the policy engine can see conflicting entitlements across the systems that actually execute transactions. In a multi-application estate, SoD risk may emerge from combinations of roles that are harmless in isolation but toxic together across ERP, CRM, and HR platforms. The technical challenge is correlation, not just rule definition. Governance tools need a shared entitlement model and reliable transactional identity data so that conflicts are detected at the business process level rather than only inside one application silo.
Practical implication: Correlate entitlements and transactional activity across applications before relying on SoD reporting for control assurance.
Why interoperability and ecosystem support matter in IGA architecture
Cross-system IGA depends on connectors, schema mapping, and stable integrations with both cloud-centric and legacy business systems. Without that interoperability, entitlement ingestion becomes partial, delayed, or overly manual, which weakens the governance model and limits auditability. Ecosystem support matters because business applications change continuously, and identity controls have to keep up without redesigning the governance stack for every system update. In practice, the architecture must treat application coverage as a control requirement, not a deployment convenience.
Practical implication: Prioritise coverage for the applications that hold the highest entitlement risk and verify how quickly connectors adapt when business systems change.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Business application risk management has become a cross-system IGA problem, not an application-by-application exercise. The report’s central signal is that entitlements now need to be governed across heterogeneous business platforms, because risk emerges in the joins between systems rather than inside any single app. That shifts programme design away from isolated access control toward federated entitlement visibility and policy consistency across the business stack.
SoD control breaks down when entitlement data is fragmented across operational systems. A segregation conflict is only visible if the governance layer can correlate roles, permissions, and transactional context across ERP, CRM, HR, and finance applications. That is why entitlement normalisation becomes a control requirement, not just a reporting feature. Practitioners should treat cross-application correlation as the core of business application governance.
Wide application coverage is now a governance baseline, not a differentiator. KuppingerCole’s evaluation criteria reflect a market where enterprise buyers care about interoperability, ecosystem support, and consistency across cloud-centric application estates. That implies the market is moving toward platforms that can govern access risk across many business systems without forcing separate control models for each one. IGA teams should re-evaluate whether their tooling still assumes a single-system access view.
Transactional identity data is becoming the missing link between access administration and audit readiness. If a governance platform can ingest and analyse transactions across business systems, it can show not only what access exists but how that access is exercised. That matters because compliance teams need evidence that access controls align with real business activity, not just with provisioning records. The practical conclusion is that entitlement governance and operational evidence must be designed together.
What this signals
Cross-system entitlement governance is becoming the control boundary that matters most. Business application estates spread risk across ERP, CRM, HR, and finance systems, so the governance model has to move beyond application-by-application administration. The practical implication is that identity teams need entitlement visibility and certification logic that follows the business process, not the platform silo.
Transactional identity data is the differentiator for audit-ready IGA. When governance tools can analyse how access is exercised across systems, they can connect provisioning records to real business activity and expose SoD conflicts earlier. That makes entitlement governance a control evidence problem as much as an access administration problem.
For practitioners
- Map entitlement coverage across business applications Inventory where roles, permissions, and privilege assignments actually live across SAP, Salesforce, Workday, Oracle, Microsoft Dynamics, and other core systems. Use that map to identify where access reviews currently miss application-specific entitlements.
- Define SoD rules at the business process level Translate segregation conflicts into business-process terms so the same control can evaluate combinations of entitlements across multiple applications instead of only within one product.
- Validate connector depth before standardising governance Check whether each application integration captures the entitlement and transactional fields needed for audit evidence, not just basic user records.
- Align access certification with transaction evidence Use transaction-level identity data to confirm that access granted in one system is not undermining controls in another, especially where financial or regulated workflows span multiple apps.
Key takeaways
- Business application risk management now depends on cross-system visibility into entitlements and SoD conflicts, not just directory-linked access control.
- The report’s signal is that heterogeneous enterprise apps create governance gaps when roles and permissions are reviewed in isolation.
- IGA teams should treat entitlement correlation, connector depth, and transaction evidence as core controls for business application estates.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack surface, NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing entitlements consistently across business applications. |
| Recommendation — Apply PR.AA-05 to standardise entitlement visibility and certification across your business application estate. | ||
| CIS Controls v8 | CIS-5 — Account Management | Cross-system IGA depends on accurate account and entitlement governance across applications. |
| Recommendation — Use CIS-5 to inventory accounts and revoke or certify business application access on a controlled cadence. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The report centres on limiting access through entitlement governance and SoD enforcement. |
| Recommendation — Apply AC-6 to limit business application privileges to the minimum needed for each role. | ||
| ISO/IEC 27001:2022 | A.8.2 — Privileged Access Rights | Business application governance must control elevated rights across heterogeneous enterprise systems. |
| Recommendation — Treat privileged business application access as a governed asset and review it across systems. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The same overprivilege pattern appears when service and workload identities are embedded in business workflows. |
| Recommendation — Reduce overprivileged non-human access where business applications rely on service accounts or automation. | ||
Key terms
- Business Application Risk Management: Business Application Risk Management is the discipline of identifying and controlling access risk inside ERP, CRM, and other operational platforms. It looks at the real actions an application allows, then evaluates whether combinations of entitlements, workflow steps, and exceptions create audit or security exposure.
- Entitlement normalisation: Entitlement normalisation is the process of translating many application-specific permission models into one consistent governance view. It matters because access reviews and SoD checks cannot be trusted when the same privilege is represented differently across systems.
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
- Transactional Identity Data: Identity-related activity data that shows what an identity actually did, not just what it was allowed to do. It strengthens governance by helping teams prioritise reviews, detect unusual access patterns, and connect entitlement decisions to real business behaviour.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org