TL;DR: Large enterprises with SAP, Oracle, and mainframe-heavy governance needs may find SailPoint strongest, but its licensing, services, and deployment model can add 30% to 60% in first-year overhead and extend implementations into months or years, according to Zluri. The real decision is whether your identity programme needs legacy depth or faster governance across SaaS, cloud, and non-human identities.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Zluri's blog post: SailPoint remains strongest for ERP-heavy, specialist-led identity governance, while Zluri is positioned for faster governance across SaaS, cloud, and non-human identities.
Why it matters: IAM teams need to test whether their real requirement is deep legacy entitlement control or broader, faster identity governance that can keep pace with modern SaaS and NHI estates.
By the numbers:
- Professional services for setup, integration, and custom workflow development typically add 30% to 60% on top of first-year licensing.
- A 36-month, 2,500-identity contract was benchmarked at roughly $825,000 total.
- Annual maintenance and support typically run 18% to 22% of license value for on-premise deployments.
Context
The article is a comparative identity governance analysis, not a product review in the promotional sense. Its core question is whether a programme needs legacy ERP-native depth or faster governance across SaaS, cloud, and non-human identities.
For IAM and IGA teams, the real issue is governance operating model. One path assumes specialist staff, long implementation cycles, and heavy customisation. The other assumes faster rollout, broader coverage of modern identity sprawl, and less dependence on bespoke engineering.
Key questions
Q: How should teams choose between SaaS-first and ERP-first identity governance models?
A: Choose the model that matches the dominant risk surface in your environment. SaaS-first governance usually fits organisations with many cloud apps, shadow IT, and fast policy change needs. ERP-first governance fits teams that must enforce deep entitlement-level SoD in SAP or Oracle. The wrong choice creates either blind spots or unnecessary operational drag.
Q: When does legacy IGA create more overhead than value?
A: It becomes overhead when the organisation does not have the specialist team, timeline, or customisation budget that the platform assumes. That is common when governance is needed across modern SaaS environments but the programme is still built around multi-year implementation patterns and heavy services dependency.
Q: What are the signs that identity governance is too dependent on manual expertise?
A: Look for workflows that require consultants or certified admins for routine changes, integrations that need scripting to stay stable, and certification campaigns that rely on reviewer memory more than live data. Those are signs the programme is operating as a specialist service rather than a scalable control.
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.
Technical breakdown
Why legacy IGA programmes take months to operationalise
Legacy IGA platforms often reflect an older enterprise reality: thousands of identities, deeply nested ERP roles, and integration patterns that depend on specialist configuration. In practice, this means role mining, entitlement mapping, certification design, and segregation of duties logic all need to be built around the organisation rather than switched on. That architecture can be powerful for SAP- and Oracle-centric estates, but it creates a long dependency chain on implementation partners, internal IAM specialists, and custom workflows. The result is not just higher cost. It is slower feedback between risk discovery and governed access decisions.
Practical implication: Treat deployment model as a control decision, not only a procurement decision, because implementation speed affects when governance starts working.
How modern identity graphs change governance coverage
A modern identity graph links human and non-human identities across SaaS, cloud, and on-prem systems so access can be understood as a relationship model rather than a flat permission list. That matters because service accounts, bots, API tokens, and AI agents do not fit neatly into human-style review workflows. Discovery becomes the first control layer: if the programme cannot inventory the identity surface, it cannot govern lifecycle, ownership, or access change with confidence. The shift is from periodic certification to continuous identity visibility and actionability.
Practical implication: Prioritise identity discovery that includes NHI and AI-adjacent identities before expanding review or request workflows.
Why segregation of duties behaves differently in SaaS and ERP
Segregation of duties is mature in ERP environments because the business processes and conflict rules are relatively stable and well understood. In SaaS-heavy estates, those same controls are harder to model because permissions are distributed across many applications, each with different role structures and API behaviour. What looks like the same control often becomes a custom rule set, a connector problem, or an ongoing tuning exercise. That is why teams evaluating governance platforms need to ask whether their SoD problem is fundamentally ERP-native or whether it now spans a broader SaaS control plane.
Practical implication: Map where SoD conflicts actually live before choosing a governance approach, because ERP assumptions do not translate cleanly to SaaS.
Threat narrative
Attacker objective: The objective is to extract insurance claim documents through valid-looking portal access rather than through direct infrastructure compromise.
- Legitimate access is established through an external user login, likely using stolen credentials.
- The session is abused to reach insurance claim documents that sit behind an identity boundary but not a strong enough governance boundary.
- Sensitive documents are collected from the portal and removed from the intended access model.
Breaches seen in the wild
- Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Legacy IGA and modern identity security now solve different operating problems: the former is built for deep enterprise entitlement governance, while the latter must cover SaaS sprawl, cloud access, and non-human identities at the speed the business changes. The article makes the contrast plain: implementation model, not just feature list, now determines whether governance can keep up. Practitioners should evaluate identity platforms against their actual operating tempo, not the vendor category label.
Identity graph coverage is becoming the dividing line between visibility and governance: permission lists can tell you who exists, but they do not show how access spreads across systems or which identities have become risky through accumulation. That matters most for service accounts, bots, and AI agents, which sit outside the assumptions of older human-centric governance workflows. The practitioner conclusion is simple: if the inventory is incomplete, the governance model is already behind.
Segregation of duties is no longer a single control pattern: ERP-native SoD, SaaS SoD, and NHI access governance are related but not interchangeable. The article shows why a programme can look mature in one domain and still require customisation or redesign in another. Teams should separate the control objective from the system assumptions that originally shaped it.
Deployment speed is itself a security variable: when governance takes months or years to go live, risk accrues before controls do. That is especially relevant for organisations that are adding SaaS platforms faster than they are rationalising legacy systems. The practical takeaway is that the time to value for identity governance should be assessed as part of the security architecture, not after procurement.
Non-human identity governance is now a mainstream selection criterion: the article treats service accounts, bots, and AI agents as part of the same governance surface as human access. That aligns with the direction the market is heading, where identity programmes are judged by whether they can govern every identity type without fragmenting policy and operations. Practitioners should expect NHI coverage to move from optional enhancement to baseline requirement.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
- Read next: NHI Lifecycle Management Guide
What this signals
Identity governance is moving from suite selection to operating-model selection: programmes that need ERP-grade depth should not be forced into SaaS-first assumptions, and SaaS-heavy environments should not inherit the implementation burden of legacy IGA. The practical question is whether governance can start reducing exposure this quarter, not after a long services project.
Non-human identities are now part of the core governance boundary: service accounts, bots, and AI agents are no longer peripheral exceptions. If a platform cannot discover and govern them alongside human accounts, its view of identity is incomplete by design.
For practitioners
- Assess your dominant identity substrate Determine whether your environment is primarily ERP-heavy, SaaS-heavy, or a hybrid estate, because the governance model that fits one can create unnecessary friction in the other.
- Inventory non-human identities alongside human accounts Include service accounts, API tokens, bots, and AI agents in the same discovery process so lifecycle ownership and access review do not stop at employee accounts.
- Separate certification design from entitlement complexity Use different control designs for periodic access review, ERP segregation of duties, and continuous posture monitoring instead of assuming one certification process fits every system.
- Test implementation effort as part of security fit Estimate the internal specialist time, integration effort, and workflow tuning required before committing to a platform, because rollout speed changes when governance actually starts reducing risk.
Key takeaways
- The article frames legacy IGA and modern identity security as different answers to different operating models, not interchangeable labels.
- Its central evidence is that cost, services dependency, and implementation time can materially change the real price of governance.
- Practitioners should evaluate whether their current identity programme is built for deep ERP control or for broader, faster governance across SaaS and non-human identities.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The comparison repeatedly centres on identity sprawl and access scope across human and non-human identities. |
| NHI-10 — Human Use of NHI | The article highlights service accounts, bots, and AI agents that need governance as identities, not tools. | |
| Recommendation — Map governance coverage to NHI-05 and verify that every identity type has scoped, reviewable access. Apply NHI-10 controls to stop human processes from obscuring ownership of non-human identities. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about entitlement governance and access review across modern identity estates. |
| Recommendation — Use PR.AA-05 to align access reviews and entitlement management with actual business need. | ||
| CIS Controls v8 | CIS-5 — Account Management | The piece compares operational account governance approaches across human and non-human identities. |
| Recommendation — Apply CIS-5 to keep account inventories, access changes, and removals tied to lifecycle events. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article’s cost and speed argument depends on how effectively least privilege can be enforced at scale. |
| Recommendation — Use AC-6 to reduce entitlement breadth before expanding access review scope. | ||
Key terms
- Identity Graph: An identity graph is a relationship map that connects identities, assets, data, and permissions so teams can see how access actually flows. In NHI programmes, it helps explain which agent is related to which owner, which system, and which policy boundary.
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 27, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org