TL;DR: Identity governance platform selection should start with weighted requirements, then prove connector coverage, lifecycle automation, certification depth, and source-level remediation against the hardest application, because credential abuse appears in 39% of breaches, according to Oak. The useful standard is evidence of governance depth across service accounts, machine identities, and AI agents, not a polished sandbox demo.
At a glance
What this is: This checklist shows how to evaluate an identity governance platform by weighting requirements, testing real connectors, and demanding source-level remediation across people and non-human identities.
Why it matters: It matters because IAM teams need a selection process that exposes weak governance foundations before they become audit gaps, residual access, and breach exposure.
By the numbers:
- Credential abuse appears in 39% of breaches, according to the 2026 Verizon Data Breach Investigations Report cited by Oak.
Context
Choosing an identity governance platform is really about deciding whether your programme can prove access, ownership, and revocation across the systems that matter. The evaluation fails when teams score demos instead of the identity sources, entitlements, and lifecycle events that drive real governance.
A practical buying process starts with a weighted rubric, then tests the shortlist against the hardest application in the estate. That forces the vendor conversation onto connector depth, entitlement quality, and whether remediation happens at the source rather than in a report.
Modern IGA no longer stops at employees and contractors. It has to cover service accounts, machine identities, and agent identities in the same governance model, because those identities often carry the access that reviewers miss.
Key questions
Q: What should teams do first when choosing an identity governance platform?
A: Start by writing and weighting the requirements before any vendor demo. Use the hardest application in your estate as the test case, because that is where connector weaknesses, entitlement gaps, and revocation failures will surface. A platform that only looks strong in a clean sandbox is not ready for operational governance.
Q: Why do credential and entitlement gaps matter so much in identity governance selection?
A: Because governance is only real when the platform can see and change the access that exists. If connectors miss systems or entitlements, reviews become incomplete and revocation becomes partial. That leaves standing access in place even when the process appears to have succeeded.
Q: What are the signs that identity governance is too shallow for modern environments?
A: The strongest signs are opaque delegation chains, slow revocation, unmanaged non-human identities, and trust decisions that are only checked at login or provisioning time. If workloads or agents can inherit authority without clear sponsorship and audit trails, governance is not keeping up with the control plane the article describes.
Q: How should organisations balance identity provider governance modules and dedicated IGA platforms?
A: Use the identity provider's module only when the estate is small, simple, and mostly aligned to that provider's own applications. Once you have on-prem systems, strict audit demands, or many service accounts and AI agents, a dedicated IGA platform usually becomes necessary to govern access across the full estate.
Technical breakdown
Why connector coverage and identity data quality decide the outcome
Identity governance only works when the platform can ingest authoritative identity data and fine-grained entitlements from the systems that actually hold access. Connector coverage is not a checkbox because the quality of the connector determines whether reviews, lifecycle events, and revocations operate on real permissions or on a partial view. Weak ingestion produces governance theatre: the platform looks centralised while the underlying access remains fragmented. In practice, data quality is part of the control surface, not just an implementation detail. See the NHI Lifecycle Management Guide.
Practical implication: Treat connector depth and entitlement fidelity as the first technical gate in any selection process.
How lifecycle automation changes JML from administration to governance
Joiner-mover-leaver automation matters because access risk accumulates when grants and revocations depend on manual execution. Administration can create and remove accounts, but governance needs the event logic to trigger changes reliably across systems, including those outside the identity provider's native reach. If the leaver step is incomplete, standing access persists and certification becomes a retrospective exercise. The operational test is whether the platform can consume HR or authoritative source events and drive full revocation in the applications that matter.
Practical implication: Verify that JML flows end in complete revocation, not just ticket creation or status updates.
Why remediation at the source matters more than alerting
Detection tells you that access is risky. Remediation at the source proves the platform can actually change the entitlement state where the permission lives. That difference matters because many governance products can flag overprovisioning, but only some can revoke it in the originating system and return evidence that the change succeeded. Without that proof, the programme measures risk without reducing it. For auditors and responders, the evidence trail is as important as the revocation itself.
Practical implication: Require proof that the entitlement changed in the source system, not just a queued remediation event.
Threat narrative
Attacker objective: The objective is to use legitimate credentials to move through trusted systems, reach protected data or functions, and avoid noisy exploit signatures.
- Credential abuse begins when attackers obtain valid access rather than exploiting a vulnerability, which is why identity hygiene becomes part of the attack surface.
- Standing permissions and weak lifecycle controls let compromised identities retain reach into systems long after they should have been removed.
- Once access persists across applications, attackers can move through the identity graph, collect sensitive data, or expand to additional systems.
- The end state is broader compromise with reduced detection value, because the activity looks like legitimate identity use until the damage is done.
Breaches seen in the wild
- Snowflake breach: Snowflake breach compromised Ticketmaster, Santander and others via cloud credential abuse.
- Canvas Instructure Data Breach: ShinyHunters exploits Canvas LMS platform to expose millions of student records via third-party NHI credential abuse.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Weighted evaluation beats demo-driven selection: Identity governance platforms fail most often at the point where purchasing teams reward presentation quality instead of control depth. A weighted rubric forces the real question: can the platform ingest the systems that hold access, not just the ones that are easy to connect? The implication is that programme owners should treat selection as a governance exercise, not a procurement spectacle.
Connector coverage is the control, not the integration: A platform that cannot reach the hard systems in an estate cannot govern the estate. That is especially true where service accounts, machine identities, and application-specific entitlements live outside clean directory structures. The buying decision should therefore start with what the platform cannot see, because unseen access is unmanaged access.
Remediation without source authority is cosmetic: A governance tool that only reports risk leaves the entitlement state untouched. That is a critical failure mode because review depth means little if the platform cannot revoke access where the permission actually exists. The practical consequence is that organisations should reject alert-only governance as incomplete control, not just incomplete workflow.
Service accounts and AI agents are now selection criteria, not edge cases: Modern IGA programmes break when they assume human ownership models cover all identities. Non-human access often has no obvious manager, no clean lifecycle owner, and far more privileges than it uses. The result is a governance blind spot that turns identity sprawl into operational risk, not just administrative noise.
Identity blast radius is the real selection metric: The most useful question is not whether a platform can list access, but whether it can reduce the blast radius of excess access quickly enough to matter. That shift turns entitlement visibility, source revocation, and reviewer context into one control story. Teams should judge platforms by how much residual risk they can actually remove.
From our research library:
- Credential abuse across the entire attack chain, not just initial access, appears in 39% of all breaches, according to the 2026 Verizon Data Breach Investigations Report.
- Read next: NHI Lifecycle Management Guide
What this signals
Identity governance now has to be measured by reach, not brochure coverage: Teams should assume that any platform which cannot govern hard-to-connect systems will understate residual access risk. The selection conversation should therefore move from feature lists to evidence of reach, revocation, and reviewer context across the estate.
The governance boundary now extends to service accounts and AI agents because those identities can hold access that human-centric workflows never touch. If ownership, entitlement visibility, and source revocation are not explicit for non-human identities, the programme is only partially governing the estate.
Connector depth is becoming the hidden differentiator in IGA selection. A platform that cannot ingest the real application graph cannot produce trustworthy certification outcomes, no matter how strong the UI or workflow layer appears.
For practitioners
- Write a weighted selection rubric Score every vendor on connector coverage, lifecycle automation, certification depth, non-human identity coverage, and source-level remediation before any demo. See the IGA Buyer's Guide.
- Test the hardest application first Use the messiest system in your estate as the proof-of-concept target, because that is where connector gaps and entitlement problems surface fastest.
- Verify revocation at the source Require evidence that flagged access is removed in the originating application or system, not merely queued for follow-up or reported for review.
- Include non-human identities in ownership mapping Identify who owns service accounts, machine identities, and AI agent identities before certification begins, so reviews do not depend on guesswork.
- Model total cost beyond licence fees Add implementation effort, connector development, and internal staffing to the purchase decision, because those costs often determine whether the programme is sustainable.
Key takeaways
- Identity governance selection fails when teams optimise for demos instead of proof, because the real control is whether the platform can reach and change the access that exists.
- The article ties credential abuse to 39% of breaches, which keeps access governance squarely in the breach-reduction conversation.
- Service accounts, machine identities, and AI agents now belong in the selection checklist because human-only governance leaves major access paths outside review.
Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · IGA Buyer's Guide · Identity Threat Detection and Response (ITDR) Guide · Top 10 NHI Issues
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article centers on governing service accounts and AI agents with excess access. |
| NHI-01 — Improper Offboarding | Leaver-step failures are a core risk in the lifecycle discussion. | |
| Recommendation — Inventory non-human identities with excess access and reduce privilege scope before certification begins. Close offboarding gaps so identity revocation reaches the systems where access actually lives. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The checklist is fundamentally about validating and governing entitlements across systems. |
| Recommendation — Validate that entitlements are discoverable, reviewable, and revocable across the estate. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The selection criteria aim to expose excess access and reduce it at source. |
| Recommendation — Enforce least privilege by removing unused and excessive permissions in the source applications. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article cites credential abuse as the attack chain that good governance should reduce. |
| Recommendation — Map identity governance gaps to credential access and lateral movement risks in your detections. | ||
Key terms
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
- Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
- Connector coverage: Connector coverage is the extent to which an identity platform can integrate with the systems where real access decisions exist. It matters because governance controls only work when the platform can see entitlements, roles, and conflicts in the applications that actually hold risk.
- At-The-Source Remediation: At-the-source remediation means fixing data risk where the sensitive content resides instead of only creating tickets or alerts. Typical actions include labeling, redacting, revoking access, quarantining, deleting, or blocking data so exposure is reduced immediately and the control outcome is measurable.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on October 21, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org