TL;DR: Gartner’s new Identity Visibility and Intelligence Platform category formalises a layer for aggregating identity, entitlement, and activity data across fragmented environments, with Oleria listed as a Representative Provider, according to Oleria Security. The practical shift is that continuous visibility and action on human, non-human, and AI identities is becoming a governance requirement, not an optional IAM add-on.
At a glance
What this is: Gartner’s new IVIP category frames identity visibility, intelligence, and action as a dedicated layer for unifying fragmented identity data across human, non-human, and AI access.
Why it matters: IAM teams need this framing because governance breaks down when identity, entitlement, and activity data live in separate systems that cannot answer who has access, why, and whether it is acceptable now.
Context
Identity visibility and intelligence is the problem space that emerges when identity data is scattered across IGA, PAM, cloud IAM, ITDR, and disconnected spreadsheets. In that environment, teams can certify access or provision users, but they still cannot answer the operational question that matters: who has access to what, why do they have it, and is it acceptable right now.
Gartner’s IVIP category gives that gap a name by defining a layer that aggregates and normalizes identity, access, entitlement, and control data, then applies intelligence so teams can act. For IAM programmes, the point is not another point product but a governance layer for environments where human, non-human, and AI identities are all part of the active identity graph.
The article argues that the market has outgrown light IGA because fragmented identity estates now change too quickly for periodic review models to keep up. That starting point is typical of modern enterprises, not an edge case.
Key questions
Q: What breaks when external identity data is spread across multiple systems?
A: When external identity data is fragmented, teams lose a reliable view of who has access, who approved it, and whether the relationship is still active. That creates duplicate identities, certification gaps, and delayed offboarding. A central system of record reduces those failures by giving IAM, GRC, and sponsors one place to work from.
Q: When should organisations prioritise discovery over access reviews?
A: Discovery should come first whenever the team cannot confidently map all applications, identities, and entitlements in scope. If the review population is incomplete, certification becomes a documentation exercise instead of a control. Prioritise discovery before the next major audit, offboarding cleanup, or recertification cycle.
Q: How do IAM teams know whether identity governance is actually working?
A: Look for low numbers of orphaned accounts, timely rotation of credentials, clear ownership for every identity type, and access reviews that result in real removals rather than exceptions. If the programme can only prove sign-ins, but not closure, it is measuring activity rather than governance.
A: Security teams should treat non-human IAM as a distinct programme, not a side effect of human identity management. Start by inventorying workload identities, replacing hard-coded secrets and manual sharing, and standardising rotation and access policies. In hybrid and multi-cloud environments, consistent governance matters most because fragmentation creates blind spots, over-privilege, and inconsistent enforcement across critical systems.
Technical breakdown
Why fragmented identity graphs break traditional IGA
Traditional IGA assumes the identity universe is stable enough to onboard, certify, and review on a periodic cadence. IVIP starts from a different architectural reality: identities, entitlements, and activity signals are spread across systems that were never designed to be read together. That means the core issue is not only provisioning workflows, but the inability to construct a reliable identity graph from cloud consoles, SaaS platforms, PAM stores, and unmanaged control planes. When identity data remains fragmented, governance decisions are made from partial evidence. Practical implication: treat identity visibility as a prerequisite for governance rather than a reporting add-on.
Practical implication: establish a unified identity graph before expecting access reviews or least privilege controls to work consistently.
Activity data versus entitlement data in risk decisions
Entitlement data shows what access exists on paper, but activity data shows what is actually used. That distinction matters because many identity programmes overstate risk when they only see assigned access, and understate risk when they cannot observe dormant, excessive, or unusual usage. IVIP’s intelligence layer is built to reconcile those two views so governance is based on evidence, not just configuration state. In practice, this changes how teams decide what to revoke, what to certify, and what to watch. Practical implication: risk scoring should be grounded in actual access use, not only assigned permissions.
Practical implication: combine entitlement review with activity telemetry so revocation decisions reflect real exposure, not theoretical access.
Identity visibility and intelligence for AI agents and non-human identities
AI agents and other non-human identities expand the identity graph beyond a human workforce model. They are not just additional accounts to list; they can create, combine, and use access in ways that change hourly and are difficult to govern through annual review cycles. That is why the article places human, non-human, and AI identities in the same visibility layer. The technical point is not autonomy by default, but the need to normalize identity signals across actor types before intelligence can meaningfully assess risk. Practical implication: identity control planes must be designed for mixed actor populations, not workforce-only assumptions.
Practical implication: build governance controls that can see and score human, machine, and AI identities in one operational view.
Threat narrative
Attacker objective: The objective is to exploit governance blind spots created by fragmented identity data so excessive access survives longer than intended.
- Entry begins when identity data is dispersed across multiple control planes, making authoritative access visibility incomplete and easy to misread.
- Escalation occurs when entitlement review, activity monitoring, and control enforcement are separated, allowing excessive access to persist without a single decision point.
- Impact follows when teams cannot reliably answer who has access, why access exists, or whether that access is acceptable at the moment it is used.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- AI agent retail card theft campaign 2026: AI agents breached 27+ retailers for about $25 each, used cloud keys and a Secrets Manager dump, and stole 600,000+ payment cards.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity visibility is becoming the missing governance layer above IGA, PAM, and cloud IAM: the article captures a structural shift, not a product trend. When identity data is split across systems that were never designed to be jointly interpreted, certification and provisioning alone cannot establish governance certainty. The implication is that teams need an operational layer that turns fragmented identity signals into a usable control plane.
IVIP formalises what many security teams have been approximating with spreadsheets and tool overlap: the value is not another dashboard, but a way to normalize identity, entitlement, and activity evidence into a single decision model. That matters because governance fails when each control sees only part of the identity estate. The practitioner conclusion is that evidence quality now defines identity programme maturity.
Activity-aware governance is the real change in this category: entitlement-only thinking cannot distinguish theoretical access from exploitable access. By elevating actual use into the governance model, IVIP shifts identity security from static authorisation management to continuous operational validation. Teams should treat this as a category boundary, not a feature checklist.
AI agents and non-human identities make the legacy review model structurally incomplete: the identity estate is no longer a headcount with a few service accounts attached. That assumption was designed for slower-moving populations; it fails when machine and agent identities expand the graph faster than periodic review cycles can capture it. The implication is that identity governance has to move closer to issuance and runtime usage.
Identity visibility debt: fragmented identity estates create a compounding governance deficit where each disconnected system increases the cost of answering basic access questions. That debt is no longer optional to carry in cloud-first and AI-heavy environments. Practitioners should treat the reduction of identity visibility debt as a programme objective alongside certification and privilege reduction.
From our research library:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- Read next: Identity Visibility and Intelligence Platforms (IVIP) Guide
What this signals
Identity visibility debt: the longer identity, entitlement, and activity data stay split across control planes, the more expensive it becomes to answer basic governance questions with confidence. That debt now sits at the centre of IAM modernisation because disconnected systems force teams to make access decisions from incomplete evidence.
IVIP should be read as a programme signal, not a category label. IAM teams will increasingly be judged on whether they can see all identity types, distinguish used access from granted access, and take action without building a new integration project for every exception.
70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey. That gap shows why visibility and evidence now matter as much as authorisation policy.
For practitioners
- Map your identity graph across all control planes Inventory where identity, entitlement, control, and activity data currently lives across IGA, PAM, cloud IAM, SaaS, and any AI agent control points. The goal is to identify where no system can currently answer access questions end to end.
- Use activity data in governance decisions Require actual usage evidence alongside entitlement data when prioritising revocation, recertification, and exception handling. This reduces reliance on theoretical access and exposes dormant privilege that paper-based reviews miss.
- Test whether current controls see non-human identities Validate that service accounts, workloads, AI agents, and other non-human identities appear in the same operational view as human users. If they do not, the governance model is still workforce-centric.
- Define continuous action paths for excess access Ensure that visibility findings can trigger revocation or restriction without opening a separate integration project each time. If action still depends on manual stitching between tools, the control is not continuous.
- Reassess annual review cycles for fast-moving identities Check whether annual or quarterly access reviews are still meaningful for identities that can change faster than the review cadence. Where identity state changes hourly, governance must shift toward continuous monitoring and response.
Key takeaways
- Fragmented identity data is now the limiting factor in governance, not the number of point tools in the stack.
- The new IVIP framing centres continuous visibility, intelligence, and action across human, non-human, and AI identities.
- IAM teams should test whether they can see real activity and act on it without additional integration work.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article focuses on excessive access across non-human and AI identities. |
| NHI-08 — Environment Isolation | Fragmented identity data spans environments that are not governed together. | |
| Recommendation — Audit non-human and AI identities for access that exceeds their operational need. Separate identity visibility domains enough to preserve control, but unify them for governance decisions. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing entitlements across a fragmented identity estate. |
| Recommendation — Review entitlements against PR.AA-05 using a single operational view of identity data. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Identity blind spots increase the chance that excessive access can be abused and moved across systems. |
| Recommendation — Map identity visibility gaps to credential-access and lateral-movement paths in your detections. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | The category directly concerns cloud identity governance across multiple domains. |
| Recommendation — Apply IAM-domain controls to unify identity evidence across cloud services and control planes. | ||
Key terms
- Identity Visibility and Intelligence Platform: An Identity Visibility and Intelligence Platform is a layer that correlates identity data across multiple tools into one risk picture. It does not replace existing controls. It makes them more useful by connecting events, relationships, configuration, and posture so teams can prioritise what matters.
- Identity Graph: An identity graph is a relationship map that connects identities, assets, data, and permissions so teams can see how access actually flows. In NHI programmes, it helps explain which agent is related to which owner, which system, and which policy boundary.
- Identity visibility debt: The gap that appears when an organisation can list its assets but cannot reliably link them to owners, entitlements, or activity. It creates a false sense of control because inventory looks complete while access relationships remain hidden, stale, or unreviewed.
- Actor-Aware Governance: Actor-aware governance means applying different control expectations based on whether the subject is a human, an NHI, or an autonomous system. It treats identity type as an operational variable, so access reviews, revocation, approval, and evidence collection match how the actor actually behaves.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on September 22, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org