TL;DR: Enterprise IAM is moving toward unified control planes that must span humans, NHIs, and AI-adjacent identities without relying on static access models, and IDC MarketScape positions SailPoint as a Leader in integrated identity security, citing an identity graph that connects workforce, contractor, and machine identities with policy, metadata, and security telemetry.
NHIMG editorial — based on content published by SailPoint: SailPoint named a Leader in IDC MarketScape for Integrated Solutions for Identity Security
By the numbers:
- The average organization now uses more than 100 SaaS applications.
Questions worth separating out
Q: How should security teams govern workforce, machine, and AI-linked identities in one programme?
A: Start by mapping all identity types into a single governance model with clear ownership for provisioning, review, and offboarding.
Q: When does a cloud-first identity platform matter more than a self-hosted one?
A: It matters most when your environment changes quickly, your SaaS footprint is large, and new identity types appear faster than your release cycle can absorb them.
Q: What do IAM teams get wrong about AI-driven identity security?
A: They often treat AI-driven features as a tooling upgrade rather than a governance shift.
Practitioner guidance
- Inventory identity types beyond workforce accounts Identify where contractors, service accounts, machine identities, and AI-linked identities are already in scope, then map which systems own their lifecycle, access, and review responsibilities.
- Test whether your identity platform can consume security telemetry Confirm that identity policies can use risk signals from SOC tools, cloud logs, and threat intelligence sources instead of relying only on static entitlement data.
- Assess cloud-first update and integration velocity Review how quickly your current platform can add new applications, new identity sources, and policy changes without depending on major maintenance windows.
What's in the full analysis
SailPoint's full blog post covers the operational detail this post intentionally leaves for the source:
- IDC MarketScape positioning language and the specific criteria used to judge integrated identity security vendors.
- Expanded discussion of SailPoint's identity graph, security fabric, and AI-driven identity strategy.
- The article's own framing of cloud-first identity platforms and how the vendor positions migration from self-hosted deployments.
- Context on how SailPoint connects its platform direction to enterprise IAM buying decisions.
👉 Read SailPoint's IDC MarketScape analysis for integrated identity security →
Identity fabric and AI-driven IAM: what SailPoint’s IDC ranking means?
Explore further
Unified identity security is becoming the baseline, not the differentiator. The market signal here is that platforms are being evaluated on whether they can govern workforce identities, contractors, machines, and AI-linked identities through one control model. That shift matters because fragmented identity tooling cannot produce a coherent risk picture when access, telemetry, and response are distributed. Practitioners should treat unified coverage as the minimum requirement for modern identity governance.
A few things that frame the scale:
- The average organization now uses more than 100 SaaS applications, according to Ultimate Guide to NHIs.
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control.
A question worth separating out:
Q: How do you know if identity governance is keeping pace with identity sprawl?
A: Look for evidence that access reviews, remediation workflows, and integrations still function across the full estate without manual stitching. If the programme cannot consistently cover workforce users, contractors, machine identities, and service accounts, it is already behind the operating model.
👉 Read our full editorial: SailPoint’s IDC MarketScape leadership and identity fabric shift