Topic starter
06/11/2026 6:40 pm
TL;DR: KuppingerCole’s 2026 Leadership Compass, according to READI, highlights a structural IGA connector gap: disconnected legacy applications, terminal systems and custom tools remain outside modern governance because RPA and ticketed workarounds break when interfaces change. The real issue is not connector breadth but whether governance can reach the systems where privilege drift actually accumulates.
Editorial analysis by NHI Mgmt Group, based on content published by READI: “KuppingerCole 2026 revealed the IGA connector gap no vendor has closed.”.
Key questions
Q: How should teams govern disconnected applications that do not expose APIs?
A: Treat them as governed exceptions with a defined workflow, not as informal manual tasks.
Q: Why do RPA-based connectors break in identity governance programmes?
A: RPA-based connectors break because they depend on user-interface automation rather than stable application APIs, so small screen, workflow or field changes cause failures and control drift.
Q: What is the best way to handle access reviews for disconnected systems?
A: The best way is to use access-state evidence from the disconnected system itself, such as exports of local accounts, group membership, privilege lists and application logs, then reconcile that data to the identity governance record.
Practitioner guidance
- Establish a disconnected-application inventory Classify every terminal, mainframe, and custom application that cannot be governed through standard API-based connectors, then assign each one a risk owner and lifecycle path.
- Measure offboarding latency for legacy systems Track the time between a leaver event and confirmed removal of access in applications that rely on tickets, scripts, or manual updates, then escalate exceptions as control failures.
- Require reconciliation evidence for indirect connectors Do not accept a successful automation run as proof of governance unless the identity platform can verify the resulting access state in the target system.
Bottom line: Disconnected applications remain the weakest point in many IGA programmes because standard connector patterns assume systems that are easier to query and control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
The connector gap is a category problem, not a vendor defect. KuppingerCole's 2026 IGA evaluation surfaces the same limitation across multiple platforms because the hardest applications to govern are often the least cooperative ones. Legacy terminals, mainframes, and internally built tools do not fit the assumptions that standard connector libraries were built around. The implication is that IGA maturity has to be judged by coverage of the difficult estate, not by catalogue size alone.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: When should organisations prioritise legacy application onboarding over new SaaS connectors?
A: Prioritise legacy application onboarding when those systems still hold critical data, drive business processes, or use brittle credentials that cannot be governed through modern connectors. Legacy platforms often rely on service accounts, static secrets, file shares or local administrator access, so onboarding them first reduces unmanaged access and improves rotation, ownership and revocation across disconnected systems.
👉 Read our full editorial: IGA connector gaps leave disconnected apps outside governance