Notifications
Clear all
Topic starter
25/06/2026 3:21 pm
TL;DR: Identity vendor selection now spans lifecycle automation, authentication, certification, self-service, integrations, zero trust, AI-assisted risk scoring, and implementation realities, according to Avatier’s 2026 evaluation framework. The decisive issue is not feature breadth but whether the platform handles mover events, verification, and operational scale without creating multi-year migration friction.
NHIMG editorial — based on content published by Avatier: The evaluation framework for choosing an identity management vendor for 2026
By the numbers:
- 5-10× average demand., hput should typically be sized to peak load, which is often 5-10× average demand.
- A platform quoting 12 weeks for a 12-month problem is setting up the difficult-conversations meeting six months in.
Questions worth separating out
Q: How should security teams evaluate identity platforms for lifecycle automation?
A: They should test whether the platform can handle real joiner, mover, and leaver changes, not just simple onboarding.
Q: Why do mover workflows matter more than joiner and leaver flows?
A: Mover workflows matter because they expose whether access governance can keep up with change inside an active employment relationship.
Q: How do teams know whether certification campaigns are too broad?
A: A certification campaign is too broad when reviewers are asked to assess too many entries without enough risk context.
Practitioner guidance
- Script mover scenarios end to end Use a Monday join, week-three contractor conversion, week-eight return-to-FTE, leave of absence, and month-nine termination to see how access changes propagate through workflow, logs, and exception handling.
- Test privileged recovery as part of authentication design Ask vendors to demonstrate recovery for a privileged account after a failed verification step, then confirm how session revocation, audit evidence, and helpdesk escalation behave together.
- Score connector maintenance, not connector count Separate native connector coverage from ongoing maintenance by checking how custom integrations are built, how quickly API changes are absorbed, and whether the platform supports your highest-risk applications.
What's in the full article
Avatier's full analysis covers the operational detail this post intentionally leaves for the source:
- Scripted demo questions for lifecycle automation, authentication, certification, self-service, and scale testing
- Trade-off commentary on mover workflows, recovery design, connector maintenance, and deployment complexity
- Implementation and proof-of-concept guidance for testing real HRIS data and representative application coverage
- Vendor-specific positioning on where the platform fits best and where it fits less well
👉 Read Avatier's 2026 identity vendor evaluation framework for IAM buyers →
Identity vendor evaluation in 2026: where do the trade-offs hide?
Explore further
25/06/2026 4:50 pm
Identity vendor selection is now a lifecycle governance decision, not a feature comparison. The article shows that the platform choice determines how joiner, mover, leaver, certification, and recovery processes behave under real enterprise pressure. That makes vendor evaluation a control-design exercise across IAM, IGA, and adjacent workflow layers. Practitioners should treat shortlist scoring as a governance decision, not a procurement convenience.
A few things that frame the scale:
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, which shows how slowly remediation can move once exposure is known.
A question worth separating out:
Q: Who is accountable when authentication recovery for privileged accounts fails?
A: Accountability sits with the identity programme, not just the helpdesk, because recovery is part of the authentication control chain. Teams should define ownership for verification policy, escalation paths, audit logging, and revocation so recovery does not become a weak bypass around stronger primary authentication.
👉 Read our full editorial: 2026 identity vendor evaluation hinges on lifecycle and zero trust
