TL;DR: Nexis says Gartner’s 2026 Innovation Insight shows IVIP vendors are adding access certifications, continuous access evaluation and least-privilege enforcement, signalling that light IGA is no longer enough for complex, regulated environments. Governance now depends on visibility that can drive decisions, not just document access.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Nexis's blog post: IVIP is absorbing core IGA functions because visibility without governance no longer scales in complex identity environments.
Why it matters: IAM, IGA and NHI teams need shared visibility across people, service accounts, workloads and AI agents before they can certify, reduce and document access with confidence.
👉 Read Nexis's analysis of how IVIP is reshaping light IGA
Context
Light IGA breaks down when identity data is fragmented across directories, PAM, cloud services, SaaS and legacy systems. In that environment, access governance cannot rely on a single system of record because the review process is already working from partial truth.
The governance gap is not simply complexity. It is that certification, segregation of duties and lifecycle decisions depend on an accurate view of who or what has access, why it exists, and whether it is still justified. Identity visibility and intelligence becomes the starting point when that view is missing.
Key questions
Q: How does IVIP differ from light IGA for access governance?
A: IVIP adds identity visibility, analytics and relationship mapping that light IGA often lacks, so it can expose access patterns across multiple systems instead of managing only local workflows. That broader view matters when certifications, segregation of duties and remediation depend on reconciling evidence from cloud, SaaS, PAM and legacy platforms.
Q: How should teams govern access when identity data is fragmented?
A: Govern access with a reconciled identity view that links each person, account and entitlement to a single authoritative record, then use lifecycle rules, access reviews and conflict detection against that joined data. Fragmented identity data causes duplicate accounts, missed joiner mover leaver events and wrong entitlement ownership, so governance depends on matching identities across directories, SaaS, HR and privileged systems before decisions are made.
Q: What is the best way to reduce overprovisioned access across systems?
A: The best way is to combine visibility, review and remediation in a single entitlement governance process. First inventory accounts, roles and direct grants across systems, then certify access against job function and activity, and finally remove stale, duplicate or excessive entitlements through automated revocation and role cleanup. Overprovisioning persists when entitlement data is incomplete or reviews are not tied to actual system permissions.
Q: Why do segregation of duties conflicts persist in complex identity estates?
A: Segregation of duties conflicts persist because entitlements are often scattered across applications, roles, groups and privileged paths that do not share a common model. You have to correlate those relationships across systems, including inherited access and temporary elevation, before you can detect toxic combinations. Without that correlation, SoD rules miss hidden privilege chains, duplicate accounts and permissions that only become conflicting when combined.
Technical breakdown
Why light IGA reaches a limit in distributed identity estates
Light IGA is designed to cover essential governance workflows such as provisioning, deprovisioning, approvals and certifications without the overhead of a full enterprise platform. The limit appears when identity state is scattered across multiple control planes and business systems, because the platform can only govern what it can see and reconcile. Once access entitlements, roles and ownership are split across cloud, SaaS, PAM and custom applications, governance decisions become incomplete by design. See the NHI Lifecycle Management Guide.
Practical implication: Treat fragmented identity inventory as a governance constraint, not just a data-quality issue, because incomplete visibility weakens every downstream certification decision.
How identity visibility becomes governance intelligence
Identity visibility platforms do more than inventory accounts. They correlate identities, roles, entitlements and relationships so governance teams can detect excessive access, anomalous connections and segregation of duties conflicts. The architectural difference is important: visibility is not the end state, it is the analytical layer that turns raw identity data into governance context. Without that layer, access reviews become a procedural exercise instead of a decision process informed by evidence. See the Identity Visibility, Posture and Threat Detection Guide.
Practical implication: Use correlated identity data to drive review, remediation and policy decisions from one evidence base instead of separate system-by-system checks.
Why continuous access evaluation matters more than periodic reviews
Periodic access certification assumes access patterns stay stable long enough to be reviewed on a schedule. Continuous access evaluation changes the model by checking whether access remains appropriate as relationships, roles and context change. That matters in environments where access drift accumulates faster than annual or quarterly reviews can correct it. The technical shift is from snapshot governance to ongoing assessment of privilege state and policy fit. See the Access Reviews and Certification Guide.
Practical implication: Move high-risk access from review-only governance toward continuous evaluation when identity relationships change faster than scheduled recertification can catch them.
NHI Mgmt Group analysis
Visibility is becoming the governance substrate, not a supporting feature. In complex identity estates, the first problem is not certification volume but data fragmentation across IGA, PAM, cloud, SaaS and legacy platforms. When the governance layer cannot assemble a coherent access picture, every downstream decision rests on partial evidence. The practitioner conclusion is that governance architecture now starts with identity visibility, not with process automation.
Light IGA reaches its boundary when identity relationships span too many systems to govern from a narrow workflow stack. Provisioning and access requests are useful, but they do not solve the harder problem of reconciling ownership, entitlements and SoD conflicts across disconnected environments. That is why the market is shifting toward platforms that combine discovery, correlation and governance action. The practitioner conclusion is to judge tooling by its ability to govern cross-domain access, not by workflow simplicity alone.
Continuous access evaluation is the clearest sign that snapshot-based governance is losing authority. Periodic access reviews assume privilege remains legible long enough to be certified on a timetable. That assumption weakens as environments add service accounts, workloads and AI agents alongside human users, because entitlement state changes faster than review cycles. The practitioner conclusion is that access governance is moving from calendar-driven assurance to state-driven control.
Cross-application segregation of duties is the named concept this market shift clarifies. SoD conflicts are no longer confined to one business application or one privileged platform; they emerge when identity evidence is spread across multiple control planes. A governance model that cannot reconcile those relationships will miss conflicts that matter to audit and operational risk. The practitioner conclusion is to treat cross-application SoD as an identity visibility problem before it is a policy problem.
Visibility without remediation still leaves governance incomplete. A unified view can expose over-provisioning, anomalies and policy conflicts, but the control only matters when those findings flow into recertification, role adjustment or access removal. That is the point where analytics stops being descriptive and becomes operational. The practitioner conclusion is to measure governance tools by whether they close the loop from finding to action.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Identity Visibility, Posture and Threat Detection Guide
What this signals
Identity visibility is becoming the control point that determines whether governance can keep pace with distributed access. As enterprises add more non-human identities and more fragmented control planes, snapshot reviews lose precision. The operational shift is toward a model where entitlement state is continuously correlated, not periodically rediscovered.
Cross-application SoD will matter more as access spans business systems, privileged tooling and machine identities. The governance issue is no longer isolated permissioning inside one platform, but whether the programme can see relationships that cut across platforms before they become audit findings or control exceptions.
Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs. That gap means practitioners should expect governance blind spots to persist unless identity visibility is treated as a prerequisite for certification and remediation, not a reporting feature.
For practitioners
- Map identity sources before expanding governance scope Catalogue where identity truth lives across IGA, PAM, directories, cloud platforms, SaaS and custom systems before deciding which governance workflows to automate.
- Prioritise access certification for cross-system entitlements Focus recertification first on access that spans multiple platforms, because those entitlements are least likely to be correctly reviewed from a single system view. See the Access Reviews and Certification Guide.
- Track segregation of duties beyond one application Test SoD rules across business systems and privileged environments together, not just inside isolated applications where conflicts can stay hidden.
- Use lifecycle controls to remove stale access Tie joiner, mover and leaver processes to the same identity data set used for governance so access removal follows role change and offboarding consistently.
Key takeaways
- Identity governance is shifting toward visibility-led decisioning because fragmented identity data makes workflow-only governance too shallow for complex environments.
- The key pressure point is cross-system correlation, where access reviews and segregation of duties controls fail if the programme cannot assemble a complete identity picture.
- Practitioners should tie visibility to remediation, lifecycle management and certification so governance findings change access instead of simply documenting it.
Related NHI Mgmt Group resources: Identity Visibility and Intelligence Platforms (IVIP) Guide · Identity Visibility, Posture and Threat Detection Guide · NHI Lifecycle Management Guide · Access Reviews and Certification Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Overprovisioned service accounts and machine access are part of the visibility gap Nexis describes. |
| Recommendation — Track machine and service-account entitlements for overprivilege and remove unused access paths. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The post centers on governing who or what has access and whether those entitlements remain appropriate. |
| Recommendation — Review entitlements continuously and validate that access permissions still match current need. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle and review discipline are central to the governance gaps discussed here. |
| Recommendation — Maintain authoritative account inventory and retire stale accounts and entitlements promptly. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article ties governance maturity to enforcing least privilege across fragmented identity estates. |
| Recommendation — Apply least-privilege policy to reduce entitlements that exceed business need. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Excess access and weak governance create the conditions attackers exploit for credential access and movement. |
| Recommendation — Map entitlement excess to credential access and lateral movement risk in threat hunting. | ||
Key terms
- Light IGA: Light IGA is a reduced identity governance model that covers the essentials of access lifecycle and request handling. It usually trades depth for simplicity, offering faster deployment and lower administration overhead, but less flexibility for complex entitlements, nuanced policy, and audit-grade evidence.
- Identity Visibility: Identity visibility is the ability to see which identities exist, what they can access, and how those access paths relate across systems. In NHI programmes, it means correlating service accounts, tokens, certificates, and agents into one operational view so governance decisions are based on evidence, not assumptions.
- Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
What's in the full article
Nexis's full blog post covers the operational detail this post intentionally leaves for the source:
- How the NEXIS Platform translates identity grids and matrix views into governance workflows
- How explainable AI is used during recertification to add context to review decisions
- How cross-application segregation of duties controls are modelled and validated in practice
- How remediation and policy modelling are connected after an access issue is identified
Deepen your knowledge
NHI governance, identity lifecycle management, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org