Notifications
Clear all
Topic starter
25/06/2026 5:11 pm
TL;DR: Demand for access entitlement control, separation of duties enforcement, and hybrid identity visibility across cloud and on-prem environments is highlighted by Saviynt’s recognition as Overall Leader in KuppingerCole’s Identity as a Service - IGA Leadership Compass, according to Saviynt and KuppingerCole. The signal for practitioners is that governance scope is widening beyond classic IGA into cloud privileged access and risk-based access decisions.
NHIMG editorial — based on content published by Saviynt: its KuppingerCole Identity as a Service - IGA leadership announcement
By the numbers:
- Saviynt’s identity 3.0 solution extends security across AWS, Azure, GCP, Alibaba Cloud, Office 365, SharePoint, Box, NetApp and more.
Questions worth separating out
Q: How should IAM teams evaluate converged IGA and PAM capabilities?
A: Start by checking whether the platform can maintain a single authoritative view of entitlements across cloud, SaaS, and on-prem systems.
Q: Why do hybrid environments make access governance harder?
A: Hybrid environments spread identities, entitlements, and controls across different administrative planes, which makes policy consistency difficult.
Q: What do security teams get wrong about separation of duties?
A: They often treat SOD as a static rule set rather than a control that must stay aligned to current access state.
Practitioner guidance
- Validate live entitlement state across environments Confirm that your governance tool can reconcile access entitlements across cloud, on-prem, and SaaS systems before relying on certification outcomes.
- Map SOD rules to critical applications Test separation of duties policies against the applications that actually drive business risk, including ERP, finance, and HR systems.
- Separate privileged cloud access from routine access reporting Create distinct views for administrative cloud access, service access, and standard application access so high-risk entitlements do not disappear inside generic identity reports.
What's in the full analysis
Saviynt's full press release covers the analyst ranking and product positioning details this post intentionally leaves for the source:
- The report language Saviynt cites around leadership in identity as a service and the evaluation criteria used by KuppingerCole.
- The vendor's own description of its convergence model across identity governance, application GRC, and cloud privileged access.
- The regional expansion and partner ecosystem context that explains how the company is positioning the business.
- The product capability descriptions that matter if you are comparing feature sets rather than reviewing market implications.
👉 Read Saviynt's report on KuppingerCole's Identity as a Service ranking →
IGA convergence and access governance: what this ranking signals?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 5:43 pm
Converged identity governance is becoming the baseline expectation, not a differentiator. The market is moving toward platforms that can unify access entitlement management, SOD policy enforcement, and cloud privileged access in one operational model. That shift reflects how hybrid environments now expose identity risk across too many control domains for separate tooling to manage cleanly. Practitioners should treat convergence as the operating assumption and test whether a platform actually sustains it under live policy and audit pressure.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why entitlement state is still the first governance problem to solve.
A question worth separating out:
Q: When should organisations re-evaluate their identity governance programme?
A: Re-evaluate whenever cloud privilege, application risk, and compliance reviews are operating in separate workflows. That separation creates blind spots in audit, certification, and privileged access oversight. If your programme cannot show how one identity is governed end to end, it is overdue for redesign.
👉 Read our full editorial: Saviynt's IGA recognition points to converged identity governance
