Topic starter
06/09/2026 6:21 pm
TL;DR: SaaS governance, identity workflows, and AI-aware oversight are converging into one control plane, according to Josys, which says it reached #1 in G2’s Momentum Grid for SaaS Management Platforms for the fourth straight cycle, added four badges, and entered G2’s IAM category as customer reviews pushed it across 93 reports and 26 awards. The signal for practitioners is that these capabilities are increasingly being managed together in a single control plane.
Editorial analysis by NHI Mgmt Group, based on content published by Josys: “G2 Fall 2026: A New #1 Ranking and a First-Time Category Win for Josys”.
By the numbers:
- Josys maintained an overall G2 Review rating of 4.3/5 based on 131 reviews as of August 28th, 2026.
- Josys was recognized and ranked across 93 reports and awarded 26 badges.
Key questions
Q: What breaks when SaaS change management is separated from IAM processes?
A: When SaaS change management is separated from IAM, teams lose visibility into who should still have access after a change, which accounts or integrations are obsolete, and whether approvals match current state.
Q: Why do shadow IT apps create identity and spend risk at the same time?
A: Shadow IT creates two problems at once.
Q: How can security teams tell whether helpdesk-led access governance is working?
A: Look for short approval cycles, low backlog in access tickets, clean audit evidence, and fast removal of access when roles change.
Practitioner guidance
- Map SaaS discovery to identity ownership Build a governed inventory that links every discovered application to an owner, an access model, and a recertification cadence.
- Separate auto-remediation from human exception handling Define which access changes can be enforced automatically and which require approval, escalation, or post-action review.
- Use RBAC mappings to compress review scope Translate app roles into role-based access control groups so access reviews assess meaningful entitlement clusters instead of individual app accounts.
Bottom line: Josys' G2 movement reflects a broader market shift toward treating SaaS visibility and identity governance as one operational problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/09/2026 6:21 pm
Category convergence is now the story, not standalone SaaS administration. Josys' G2 movement shows that practitioners are evaluating SaaS management through an identity lens, not a software inventory lens. That shift matters because access governance, app discovery, and offboarding now sit in the same operational queue. The practical conclusion is that teams should treat SaaS governance as an identity control surface, not a back-office license exercise.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern SaaS access when bots and AI agents are also active?
A: Treat bots and AI agents as governed identities, not exceptions inside the SaaS stack. Assign ownership, lifecycle rules, and revocation paths for each non-human actor, then make sure review workflows can surface them separately from employee access. If the platform cannot distinguish those actors, governance is incomplete.
👉 Read our full editorial: G2 rankings show Josys gaining ground in identity governance