Topic starter
11/08/2026 3:13 pm
TL;DR: Enterprises still leave most applications outside IGA coverage, while manual integration work drives high implementation costs and slow onboarding, according to Opnova. AI-native automation may reduce operational friction, but identity governance still depends on auditable approval, scope control, and lifecycle oversight.
Editorial analysis by NHI Mgmt Group, based on content published by Opnova: “Opnova Sweeps Black Hat Startup Spotlight Competition”.
Key questions
Q: What breaks when IGA does not cover the full application estate?
A: When IGA does not cover the full application estate, joiner, mover, leaver processes fall back to manual handling, access reviews become inconsistent, and audit evidence fragments across local owners and ticket queues.
Q: Why do disconnected applications create identity governance risk?
A: They create risk because the organisation cannot reliably see, certify, or revoke access through the same control plane used for integrated systems.
Q: How do teams know if IGA is actually working?
A: Look for evidence that entitlement changes are being governed before access expands beyond need.
Practitioner guidance
- Map application coverage by controlability Inventory which applications are fully governed, partially governed, or effectively outside IGA reach, then rank the unmanaged set by business criticality and access risk.
- Separate automation from approval logic Define where automated identity operations may execute, who approves them, and what audit trail must be retained before any workflow is considered production-ready.
- Prioritise disconnected systems for lifecycle control Focus first on applications that handle privileged access, regulated data, or high-volume joiner mover leaver activity because those gaps create the largest governance exposure.
Bottom line: Disconnected applications create a structural IGA gap because policy only matters where the platform can actually enforce it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
11/08/2026 3:27 pm
Application coverage is now the decisive identity governance metric. The core weakness in many IGA programmes is not policy design, but the number of applications that remain outside enforceable control. If an enterprise can only govern a minority of its estate, then recertification, offboarding, and privilege review are incomplete by definition. Practitioners should treat coverage as a first-order governance measure, not a delivery metric.
A question worth separating out:
Q: Should organisations replace IGA to close application coverage gaps?
A: Not necessarily. The stronger decision is to extend governance to disconnected applications without ripping out an existing IGA core. The key test is whether the operating model can add coverage, preserve approvals, and keep auditability intact for the long tail of applications.
👉 Read our full editorial: AI-native identity governance exposes the application coverage gap
This post was modified 5 days ago by NHI Mgmt Group