TL;DR: Saviynt says KuppingerCole named it an Overall Leader across four evaluations spanning IGA, PAM, SAP access control and business application risk management, while also ranking highest in Product Leadership for IGA. The broader signal is that identity governance is moving from user access administration toward unified control of privileged, non-human and AI identities across enterprise systems.
At a glance
What this is: This is a vendor announcement about KuppingerCole recognition that frames identity governance as spanning IGA, PAM, SAP access control and business application risk management.
Why it matters: It matters because IAM teams are being pushed to govern human, privileged, non-human and AI identities as one control surface rather than as separate programmes.
Context
Identity governance no longer sits only in the human access-review lane. In this announcement, Saviynt uses KuppingerCole recognition to argue that the governance problem now spans privileged access, SAP controls, business application risk, machine identities and AI-driven access patterns.
For IAM and PAM teams, the practical question is not whether identity governance is broadening, but how far the governance model has to extend across hybrid environments. The article points to a market shift toward unified control over access, privilege and application risk, especially where non-human and AI identities carry elevated access.
Key questions
Q: How should IAM teams govern human, non-human, and AI identities together?
A: Start by separating the identity types in policy, ownership, and review cadence, then define where controls can be shared and where they must remain distinct. Human users, service identities, and AI systems do not fail in the same way, so the governance model has to preserve that difference while still producing one audit trail.
Q: Why do PAM and IGA need to be aligned more closely now?
A: Because privileged access no longer sits only at the admin edge. In modern environments it is embedded in applications, workflows and machine accounts, so PAM decisions affect governance outcomes and IGA decisions affect privilege exposure. Separating the two leaves blind spots in entitlement and exception handling.
Q: What breaks when access reviews do not include machine and AI identities?
A: Review cycles miss the identities that often move the most data and inherit the most privilege. As a result, excessive access can persist in service accounts, pipelines, and AI-connected workflows even when human user access looks clean. The control fails because the review scope is too narrow for the actual access graph.
Q: What should identity teams prioritise when their scope includes SAP and business applications?
A: Prioritise control consistency across enterprise applications, not just policy coverage in one system. The goal is to keep ownership, entitlement changes and review evidence aligned so that application risk does not get managed in isolation from broader identity governance.
Technical breakdown
Why identity governance is being pulled beyond classic IGA
Traditional identity governance was built around joiner-mover-leaver processes, access certifications and role visibility for human users. That model still matters, but the article reflects a wider reality: enterprise access now includes privileged accounts, application entitlements, SAP workflows, service identities and AI-related access paths. The technical challenge is not just reviewing access after the fact. It is maintaining a governable picture of who or what can act, where those privileges live, and how they are approved across cloud and on-premises systems.
Practical implication: treat identity governance as a cross-domain control plane, not a standalone attestation workflow.
How PAM changes when it is linked to governance
Privileged access management traditionally focused on controlling elevated credentials and reducing standing privilege. When PAM is integrated with identity governance, it becomes part of a lifecycle and policy model rather than a separate vault-and-review function. That matters because privileged access is often the point where human, non-human and application identities converge. The article’s emphasis on contextual access management points to a model where privilege is governed alongside entitlement, application risk and business context instead of being handled as an isolated admin problem.
Practical implication: align PAM policy, entitlement reviews and privileged session governance under one operating model.
Why AI-era identity security depends on non-human identity controls
AI-era identity security is not about AI as a tool category alone. It is about the access patterns created when machine identities, service accounts, tokens and AI-enabled workflows gain reach into enterprise systems. The article positions governance as extending to non-human and AI identities because those subjects can hold persistent or elevated access across hybrid environments. That creates a need for lifecycle visibility, scoped authorization and offboarding discipline that was once applied mainly to people.
Practical implication: inventory and govern machine and AI identities with the same rigor applied to privileged human access.
NHI Mgmt Group analysis
Identity governance is becoming a unified control problem, not a human-access discipline. The article reflects a market shift that many programmes have not yet fully absorbed: IGA, PAM, SAP access control and business application risk are converging into one operational governance surface. That convergence is driven by hybrid estates, privileged workflows and non-human access paths that no longer fit cleanly into separate teams. Practitioners should expect governance scope to keep expanding until entitlement, privilege and application risk are handled together.
Non-human identity governance is now part of the mainstream identity conversation. When a vendor announcement explicitly includes machine and AI identities in its core messaging, it signals that the category has moved beyond edge cases. The important point is not the branding, but the underlying governance requirement: non-human identities can carry persistent, delegated or elevated access that must be inventoried, reviewed and retired with lifecycle discipline. Practitioners need to stop treating NHI governance as a niche add-on.
Privileged access and identity governance are collapsing into the same decision layer. The old model assumed PAM was for break-glass and admin control, while IGA handled broader access oversight. That separation is increasingly artificial in enterprise environments where privilege lives inside applications, cloud platforms and business workflows. The implication is straightforward: teams that keep PAM, IGA and application risk management separate will continue to miss cross-domain exposure.
AI-era identity security: the field now assumes that access subjects are stable, reviewable and human-paced. That assumption weakens when governance must extend to AI-driven and machine identities that operate across cloud and enterprise systems with different lifecycle patterns. The implication is that identity governance architectures have to be redesigned around subject type, not only around entitlement type.
The market is rewarding breadth, but breadth only matters if governance stays operational. Recognition across multiple KuppingerCole evaluations suggests buyers are looking for identity platforms that can span governance, privilege and application risk. That does not remove the need for discipline around ownership, policy design and offboarding. The practitioner takeaway is to judge platform scope against governance outcomes, not category labels.
From our research library:
- 49% of IT professionals would prioritise improving privileged access management if the decision were theirs alone, according to Netwrix's 2023 Hybrid Security Trends Report.
- Read next: Privileged Access Management Guide
What this signals
Identity governance programmes will be judged on scope convergence, not control count. The useful question is no longer whether a team has access reviews, PAM and role management in place. It is whether those controls operate over the same identity subjects, the same ownership model and the same exception process. That is where governance breaks down when human, machine and AI identities are managed separately.
Privileged access management is becoming a governance dependency rather than a stand-alone security function. When elevated access spans applications, workflows and non-human identities, PAM decisions affect certification, auditability and offboarding. Teams should expect more pressure to show that privileged paths are visible in the same governance model as standard entitlements.
For practitioners
- Map governance scope across identity domains Inventory where IGA, PAM, SAP access and business application risk are managed today, then identify overlaps and gaps in ownership, review cadence and policy enforcement.
- Extend lifecycle controls to non-human identities Add machine identities, service accounts, tokens and AI-driven access paths to access reviews, offboarding and recertification processes instead of leaving them in separate technical queues.
- Reconcile privileged access with entitlement governance Treat privileged accounts and elevated application rights as part of the same governance model so that standing access, escalation paths and exceptions are visible together.
- Review hybrid access ownership and accountability Assign clear business and technical owners for access across cloud, on-premises and enterprise applications so that governance decisions are enforceable across environments.
Key takeaways
- This announcement signals that identity governance is expanding beyond user access administration into a broader control model for privilege, applications and machine identities.
- The practical pressure point is scope convergence, because separate handling of IGA, PAM and application risk leaves governance gaps across hybrid environments.
- Teams should align lifecycle, review and offboarding processes across human and non-human identities before those gaps turn into audit and access exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article explicitly extends governance to non-human identities carrying elevated access. |
| Recommendation — Map non-human identities with elevated rights to NHI-05 and review their privilege scope and ownership. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The announcement centres on privileged access and scope control across enterprise systems. |
| Recommendation — Apply AC-6 to constrain elevated access and reduce standing privilege across governed identities. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governance over permissions and entitlements across multiple identity types. |
| Recommendation — Use PR.AA-05 to keep entitlements, approvals and ownership aligned across identity classes. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | The announcement discusses governance across hybrid cloud and enterprise identity controls. |
| Recommendation — Apply IAM-domain cloud controls to maintain consistent identity governance across environments. | ||
| MITRE ATT&CK | TA0004;TA0006 — Privilege Escalation; Credential Access | Privileged access and elevated identities are central risk themes in the article. |
| Recommendation — Map privileged access exposure to TA0004 and TA0006 to guide detection and review priorities. | ||
Key terms
- Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
- Privilege Access Management: Privilege Access Management is the discipline of controlling and monitoring elevated access to critical systems and data. It governs how privileged accounts, credentials, sessions, and commands are issued, used, recorded, and revoked, so administrative power is limited, traceable, and aligned to policy, risk, and operational need.
- Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
- Business Application Risk Management: Business Application Risk Management is the discipline of identifying and controlling access risk inside ERP, CRM, and other operational platforms. It looks at the real actions an application allows, then evaluates whether combinations of entitlements, workflow steps, and exceptions create audit or security exposure.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 3, 2026.
Updated on October 7, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org