Notifications
Clear all
Topic starter
23/06/2026 9:09 pm
TL;DR: Choosing an IGA platform in 2026 increasingly comes down to lifecycle automation, access review quality, JIT access, and NHI governance, according to ConductorOne’s guide. The real test is whether the programme can handle hybrid identity sprawl without turning governance into manual review theatre.
NHIMG editorial — based on content published by ConductorOne: The Modern IGA RFP Guide: How to Choose the Right Identity Governance Platform in 2026
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams evaluate an IGA platform for hybrid environments?
A: They should test whether the platform can reconcile identities, entitlements, approvals, and lifecycle events across cloud, SaaS, and on-prem systems.
Q: Why do modern IGA programmes need non-human identity governance?
A: Because service accounts, API keys, and certificates carry real access and real risk, but they rarely fit human-centric governance assumptions.
Q: What breaks when access certification is used as the main governance control?
A: Certification breaks down when the underlying entitlement data is stale, incomplete, or too noisy to support a meaningful decision.
Practitioner guidance
- Define the governance boundary before issuing the RFP List the identity classes in scope, including employees, contractors, service accounts, API keys, certificates, and AI-assisted access paths.
- Test whether lifecycle events drive access removal Ask vendors to show how role changes, departures, and account retirement trigger revocation across cloud, SaaS, and infrastructure systems.
- Separate certification quality from certification volume Measure whether reviewers receive accurate ownership, meaningful entitlement context, and usable exception handling.
What's in the full article
ConductorOne's full blog covers the operational detail this post intentionally leaves for the source:
- Sample RFP questions for deployment, scalability, and customer success conversations
- Vendor-side feature descriptions for access reviews, JIT access, and no-code automation
- Implementation-oriented guidance on workflow templates, connector creation, and time-to-value
- Pricing, support, and packaging details that help teams compare deployment models
👉 Read ConductorOne's guide to choosing the right IGA platform in 2026 →
Modern IGA RFPs in 2026: what should IAM teams prioritise?
Explore further
25/06/2026 2:17 am
Modern IGA selection is really a lifecycle governance test, not a feature checklist. The article correctly points readers toward access reviews, provisioning, JIT, and compliance, but the deeper issue is whether a platform can enforce identity lifecycle decisions across humans, workloads, and AI-assisted access patterns. Programmes that buy around the feature list often discover that lifecycle ownership is still fragmented after deployment. Practitioners should judge the platform by whether it closes lifecycle loops, not by how many workflows it exposes.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do teams know if just-in-time access is actually reducing privilege risk?
A: They should verify that temporary access has strict expiry, clear approval traceability, and dependable revocation after task completion. If users can extend access easily or reuse temporary entitlements across multiple tasks, the programme is preserving standing privilege under a different label.
👉 Read our full editorial: IGA RFP selection in 2026: what matters for modern identity
