G2 rankings show Josys gaining ground in identity governance

At a glance

What this is: Josys reports stronger G2 visibility across SaaS management and IAM, with a first-time IAM category appearance and four new badges in the Fall 2026 cycle.

Why it matters: For IAM and IGA teams, this matters because SaaS governance, provisioning, and access oversight are increasingly being bought and judged together rather than as isolated point functions.

By the numbers:

• Josys maintained an overall G2 Review rating of 4.3/5 based on 131 reviews as of August 28th, 2026.
• Josys was recognized and ranked across 93 reports and awarded 26 badges.

Context

Josys' Fall 2026 G2 results are primarily about category movement, not a product deep dive. The article says the platform reached #1 in G2's Momentum Grid for SaaS Management Platforms for the fourth consecutive cycle, rose to #1 in the SMB grid, and appeared in G2's IAM category for the first time.

For identity teams, the meaningful issue is the convergence of SaaS governance and IAM evaluation. The article frames access provisioning, deprovisioning, shadow IT discovery, MFA enforcement, and access review execution as part of a single operational control plane rather than separate operational silos.

Key questions

Q: What breaks when SaaS change management is separated from IAM processes?

A: When SaaS change management is separated from IAM, teams lose visibility into who should still have access after a change, which accounts or integrations are obsolete, and whether approvals match current state. That separation typically produces orphaned access and incomplete audit trails. A unified process is needed to keep operational change and identity governance aligned.

Q: Why do shadow IT apps create identity and spend risk at the same time?

A: Shadow IT creates two problems at once. First, it hides recurring cost and duplicate licensing. Second, it creates accounts, tokens, and delegated access that may never be reviewed or revoked. When the application is invisible to governance, the identities attached to it are usually invisible as well, which turns a finance issue into an access-control problem.

Q: How can security teams tell whether helpdesk-led access governance is working?

A: Look for short approval cycles, low backlog in access tickets, clean audit evidence, and fast removal of access when roles change. If requests remain open too long or exceptions are common, the process is not controlling identity state well enough. The health of the helpdesk should reflect the quality of access governance.

Q: How should teams govern SaaS access when bots and AI agents are also active?

A: Treat bots and AI agents as governed identities, not exceptions inside the SaaS stack. Assign ownership, lifecycle rules, and revocation paths for each non-human actor, then make sure review workflows can surface them separately from employee access. If the platform cannot distinguish those actors, governance is incomplete.

Technical breakdown

Why SaaS management and IAM are converging in buying criteria

SaaS management platforms are no longer judged only on license visibility or app inventory. The Josys article shows the market rewarding products that connect app discovery, access governance, and identity-linked enforcement in one workflow. That convergence matters because teams rarely experience SaaS risk as a single control failure. They experience it as a chain that starts with who can see the app, continues through who can provision it, and ends with whether access can be removed quickly and audited cleanly. When G2 moves a platform into IAM as well as SaaS management, it signals that buyers are already treating these as overlapping governance domains.

Practical implication: Practitioners should evaluate SaaS governance tools by how well they integrate provisioning, deprovisioning, and review evidence with identity controls.

What autonomous governance claims change in practice

Josys describes an autonomous model in which policy-led governance can surface risk and remediate identity issues without manual oversight. That claim matters less as a feature label and more as a governance question: which identity decisions can safely be automated, and which still require human approval or exception handling? In an IAM programme, automation becomes credible only when policy boundaries, risk thresholds, and auditability are explicit. Otherwise, 'autonomous' can blur the line between continuous enforcement and uncontrolled delegated access. For practitioners, the real test is whether automation shortens exposure windows while preserving accountable governance records.

Practical implication: Define which access events may be auto-remediated and require evidence that every automated action is reviewable afterward.

Why shadow IT and role-based access mapping remain identity problems

The article highlights shadow IT discovery, RBAC mapping, and automatic provisioning and revocation as related functions. That is important because unmanaged SaaS sprawl is not just an asset inventory issue. It becomes an identity governance issue when every new app creates a new access path, a new review obligation, and a new offboarding dependency. The technical value is in joining discovery to entitlement control so that the organisation can tell not only what exists, but who is authorised to use it and under what role. Without that linkage, security teams lose both control and evidence.

Practical implication: Tie SaaS discovery to entitlement records so app ownership, access scope, and offboarding are governed together.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Category convergence is now the story, not standalone SaaS administration. Josys' G2 movement shows that practitioners are evaluating SaaS management through an identity lens, not a software inventory lens. That shift matters because access governance, app discovery, and offboarding now sit in the same operational queue. The practical conclusion is that teams should treat SaaS governance as an identity control surface, not a back-office license exercise.

Autonomous remediation only works when policy boundaries are explicit. The article's language about autonomous governance points to a broader market move toward self-actuating identity controls. That is useful only when the organisation can define what may be auto-approved, what must be escalated, and what must remain human-reviewed. The implication is that IAM programmes need automation criteria as much as they need access policy definitions.

Shadow IT discovery and access reviews are becoming one governance motion. Josys links shadow IT visibility, RBAC mapping, and access review execution into the same workflow. That is a meaningful signal because dormant apps, orphaned accounts, and undocumented entitlements usually fail together. The practitioner takeaway is that discovery without entitlement context leaves the control plane incomplete.

First-time IAM category entry suggests the market is rewarding identity-linked SaaS governance. G2 category movement is not just a badge count story; it signals where buyers are drawing the perimeter of identity work. When a platform is measured in both SaaS management and IAM, the market is acknowledging that app access, user provisioning, and review evidence belong in one operational model. The conclusion for practitioners is to review whether their own tooling boundaries still reflect old category lines.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Top 10 NHI Issues

What this signals

Identity governance is absorbing SaaS administration. The practical boundary is shifting from 'application management' to 'who can access which app, under what role, and who can revoke it'. That is why platforms that connect inventory, provisioning, and review evidence are increasingly judged as governance systems rather than admin consoles.

Access review programmes will be measured by workflow compression, not just policy coverage. When discovery, RBAC mapping, and offboarding sit in one loop, the question becomes whether the organisation can prove revocation and certification at the same pace as business change. That is the operating standard practitioners should prepare for.

For practitioners

• Map SaaS discovery to identity ownership Build a governed inventory that links every discovered application to an owner, an access model, and a recertification cadence. Without that join, shadow IT and orphaned entitlements remain separate problems instead of one controllable workflow.
• Separate auto-remediation from human exception handling Define which access changes can be enforced automatically and which require approval, escalation, or post-action review. Keep the policy boundary explicit so autonomous workflows remain auditable.
• Use RBAC mappings to compress review scope Translate app roles into role-based access control groups so access reviews assess meaningful entitlement clusters instead of individual app accounts. That makes certification faster and more defensible.
• Measure offboarding against access revocation latency Track how quickly access is removed when a user, department, or contractor relationship changes. If revocation lags behind the business event, the governance gap is in lifecycle execution rather than visibility.
• Treat AI agents and bots as governed identities Extend the same inventory and review discipline to bots and AI agents that touch SaaS systems. If the platform can surface them, the governance model should decide whether they are approved, constrained, or removed.

Key takeaways

• Josys' G2 movement reflects a broader market shift toward treating SaaS visibility and identity governance as one operational problem.
• The article signals that buyers now expect provisioning, deprovisioning, shadow IT discovery, and review evidence to work together.
• Practitioners should test whether their own tooling can prove access ownership and revocation without manual stitching across systems.

Key terms

• SaaS Lifecycle Governance: SaaS lifecycle governance is the set of controls that manage applications from onboarding through access assignment, renewal, and decommissioning. It matters because the security value of SaaS management depends on whether the organisation can prove ownership, revoke access, and retire unused tools on demand.
• Access Recertification: Access recertification is the periodic review of user or account permissions to confirm that access is still justified. It is useful, but it is not enough on its own because it reacts after entitlements already exist, which is why lifecycle governance must reduce the volume of exceptions before review time.
• Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
• Autonomy Governance: The set of controls that determine whether an automated system can act, how its actions are approved, and how those actions are explained and audited. In SOC automation, it matters because response workflows may trigger identity, containment, or remediation steps that need clear accountability.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.