TL;DR: Organizations say their biggest identity pain points are classic IGA and PAM problems, yet only 42% have deployed standard IGA tools, according to Oleria Security. The adoption gap shows governance still fails when deployment cost, operating complexity, and hybrid visibility do not match how enterprises actually run identity.
At a glance
What this is: This analysis says enterprises still treat IGA as a core identity problem, but adoption remains low because legacy implementations are expensive, slow, and operationally heavy.
Why it matters: It matters because IAM, IGA, PAM, and NHI programmes all break down when governance cannot be deployed and sustained at enterprise scale across hybrid environments.
By the numbers:
- Only 42% have deployed standard IGA tools.
Context
Enterprises still describe privileged access, employee access, developer and admin accounts, and access reviews as their biggest identity pain points. Those are exactly the kinds of issues IGA and PAM are meant to govern, yet the article argues that many organisations still cannot absorb the deployment burden of legacy tooling.
The governance gap is therefore not a lack of need but a mismatch between control ambition and operating model. In hybrid identity estates, review quality, provisioning, and offboarding depend on broad visibility and practical maintenance, and that is where older IGA implementations often become too costly to sustain.
Key questions
Q: Why do legacy IGA programmes take so long to deliver value?
A: Legacy IGA often depends on custom connectors, specialist consultants, and extensive tuning before it produces usable governance. That means organisations pay the implementation cost up front while value arrives late and inconsistently. In practice, the delay makes many programmes harder to justify than the identity problems they are meant to solve.
Q: When does user access review become ineffective?
A: User access review becomes ineffective when reviewers do not understand the business purpose of the access they are approving. If certifications are reduced to checking boxes, stale and excessive permissions stay in place. Reviews work best when they are tied to clear role definitions, exception handling, and remediation workflows that remove access, not just record it.
Q: What breaks when governance only covers one identity ecosystem?
A: Governance breaks when it cannot see access consistently across cloud, on-premise, and SaaS systems. Single-ecosystem coverage creates blind spots, partial provisioning, and incomplete offboarding, which means the organisation can certify access in one place while missing exposure elsewhere.
Q: Why do headless identity models matter for NHI and AI agent governance?
A: Headless models matter because non-human actors do not wait for screens, tickets, or helpdesk workflows. If identity governance remains tied to human presentation layers, agents will bypass the actual control plane. API-native access makes the governance layer reachable at runtime, where the decision is made.
Technical breakdown
Why legacy IGA deployments stall
Traditional IGA often fails at the implementation layer rather than the policy layer. The article describes deployments that take 12 to 24 months and require heavy consulting, custom connectors, and specialised expertise before they produce value. That creates a classic adoption bottleneck: the control exists in theory, but the operational cost is so high that teams delay or avoid it. The result is not just slower rollout. It is a governance model that cannot keep pace with the identity estate it is meant to control.
Practical implication: evaluate IGA through deployment friction, not feature depth, because implementation burden is itself a control failure.
Why access reviews become checkbox exercises
Access reviews only work when reviewers have enough context to make a meaningful decision. The article says light integrations and shallow visibility reduce reviews to rubber-stamping because reviewers cannot see usage patterns, risk signals, dormancy, or peer context. That is a governance quality problem, not just a workflow problem. When the data model is thin, the review process still happens, but the decision quality collapses and bad access persists under the appearance of control.
Practical implication: treat review quality as a data and visibility problem, not a recertification cadence problem.
Why platform-native governance often stays incomplete
Platform-native governance features can reduce deployment friction, but they often inherit ecosystem boundaries. The article notes that single-platform tools and pre-built connectors create blind spots across hybrid environments, while SCIM and API dependencies make multi-system integration harder than it first appears. That means the governance layer may cover one domain well but still miss the broader estate. In practice, completeness matters more than convenience when the goal is to manage access across cloud, on-premise, and SaaS environments.
Practical implication: test whether governance visibility actually spans the full identity estate before assuming a lighter tool will close the gap.
NHI Mgmt Group analysis
Legacy IGA has become an adoption tax, not just a tooling category. The article shows that the barrier is no longer whether organisations understand governance, but whether they can justify the time, cost, and specialist effort required to deploy it. When a control takes quarters to operationalise and still needs constant tuning, many teams will live with unmanaged access rather than absorb the implementation burden. The practitioner conclusion is simple: governance that cannot be deployed at enterprise speed becomes an exception process, not a control.
Access review quality is limited by context, not by the existence of a review workflow. Rubber-stamped certifications are a predictable outcome when reviewers lack usage history, peer comparison, and risk context. That makes review failure a data-model problem as much as a process problem. The practitioner conclusion is to measure whether governance decisions are informed enough to change access, not merely whether a review campaign was completed.
Unified visibility is now the dividing line between real governance and fragmented control. Hybrid environments expose the weakness of single-ecosystem governance, because the most important entitlements often sit across clouds, on-premise systems, and SaaS platforms. Hybrid visibility gap: the control assumption that one connector model can cover the identity estate fails when access is distributed across multiple administrative planes. The practitioner conclusion is to judge governance by estate coverage, not by platform convenience.
IGA must be assessed as an operating model problem, not a license problem. If maintenance, connector management, and specialised administration consume the value of the control, then the programme never gets to stable governance. That is especially true when identity now includes service accounts, API keys, machine identities, and AI agents, which legacy IGA architectures were never designed to govern at machine speed. The practitioner conclusion is to align governance architecture with the identities actually in scope.
Modern governance has to move burden from the customer to the platform. The article argues that what organisations want is not reduced governance, but less implementation pain around the same core controls. That is a meaningful market signal: future identity governance will be judged by how much integration, modelling, and operational overhead the platform absorbs up front. The practitioner conclusion is to favour architectures that reduce customer stitching and preserve decision quality.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
What this signals
Hybrid identity coverage is becoming the real test of governance maturity. Organisations no longer fail because they lack a review process in theory. They fail when access lives across multiple administrative planes and the governance layer cannot see enough of the estate to make a defensible decision.
Context-rich certification is the difference between control and theatre. If reviewers cannot see actual usage, dormancy, and risk context, certification becomes a clerical task. That weakens the whole IGA programme because approval noise replaces access intelligence.
For practitioners
- Benchmark IGA against deployment friction Measure time-to-value, integration effort, and specialised staffing demand before accepting a governance platform. If the control cannot be operationalised in a realistic window, it will not scale beyond a pilot.
- Upgrade access review context Require usage history, dormancy signals, peer comparison, and risk context in every certification workflow so reviewers can make a real decision instead of clicking approve.
- Map governance coverage across hybrid estates Validate whether the control plane sees cloud, on-premise, and SaaS access consistently, or whether pre-built connectors leave blind spots that undermine certification and provisioning.
- Include NHI and AI agent identities in scope Extend governance planning beyond employees and contractors to service accounts, API keys, machine identities, and AI agents so machine-speed access does not sit outside the programme.
- Reprice total cost of ownership Count consulting, connector work, ongoing tuning, and internal team time alongside licensing so you can decide whether the programme is sustainable before procurement.
Key takeaways
- The article frames low IGA adoption as a cost and complexity problem, not a lack of awareness about governance.
- The practical failure mode is shallow visibility, which turns access reviews into box-ticking rather than decision-making.
- The strongest response is to judge governance by deployability, coverage, and review quality across the full identity estate.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centers on access governance, certification quality, and entitlement visibility. |
| Recommendation — Apply PR.AA-05 to make access decisions based on complete entitlement visibility and review context. | ||
| CIS Controls v8 | CIS-5 — Account Management | The piece focuses on account governance, provisioning, reviews, and offboarding across identity estates. |
| Recommendation — Use CIS-5 to govern account lifecycle, access review, and deprovisioning across all identity types. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article's governance gap is ultimately about maintaining appropriate access with workable operational overhead. |
| IA-5 — Authenticator Management | IGA implementation and lifecycle issues intersect with credential and account management at scale. | |
| Recommendation — Apply AC-6 to align entitlement scope with actual need and reduce standing access over time. Use IA-5 to keep account and authenticator lifecycles under governed control rather than ad hoc administration. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article notes incomplete offboarding as one of the governance flaws that persist when controls are weak. |
| NHI-05 — Overprivileged NHI | The governance gap includes control over service accounts and other non-human identities with excessive access. | |
| Recommendation — Audit NHI offboarding paths so access is revoked cleanly when identities leave scope. Review NHI privileges regularly and remove access that exceeds the identity's operational need. | ||
Key terms
- Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
- Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
- Total Cost Of Ownership: Total cost of ownership is the full cost of acquiring, operating, supporting, and retiring a tool across its life. In identity programmes, it includes onboarding, integration, training, troubleshooting, and audit effort, not just licence fees. It is the clearest way to compare tools that look cheap but create ongoing operational drag.
- Hybrid Identity Estate: A hybrid identity estate combines cloud and on-premises identity systems under one operational environment. For NHIs, this usually means certificates, service principals, and service accounts are distributed across tools and teams, which makes visibility and lifecycle enforcement harder unless controls are centralised.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on August 14, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org