Identity governance coverage gaps: why phase one leaves risk behind

TL;DR: Only 54% of applications are adequately integrated with an IGA platform and just 6% of organisations report fully automated IGA processes, according to the source article and the 2025 State of IGA Report. Partial coverage turns disconnected applications into a governance blind spot that compounds compliance, lifecycle, and maintenance costs.

NHIMG editorial — based on content published by Cerby: identity governance programs and the cost of partial application coverage

By the numbers:

• Only 54% of applications are adequately integrated with an IGA platform.
• Only 6% of organizations have achieved fully automated IGA processes.

Questions worth separating out

Q: What breaks when identity governance stops at the easiest applications?

A: Coverage gaps turn governance into documentation instead of enforcement.

Q: When should organisations prioritise hard-to-integrate applications over easy wins?

A: As soon as the easy integrations no longer improve security posture.

Q: How do you know if access reviews are actually reducing risk?

A: Access reviews are working only when the outcome is enforceable.

Practitioner guidance

• Inventory unmanaged applications by control gap Classify every application that cannot currently enforce automated provisioning, deprovisioning, or access review outcomes.
• Quantify connector maintenance as a recurring cost Track how often custom connectors break after UI, API, or permission changes and assign that effort to the program cost baseline.
• Escalate read-only reviews as failed control enforcement Flag any application where access certification cannot result in direct revocation.

What's in the full article

Cerby's full article covers the operational detail this post intentionally leaves for the source:

• The cost model for custom application integration across legacy, non-federated, and premium-tier platforms
• How self-healing connector maintenance reduces the burden of keeping fragmented integrations alive
• The operational mechanics of feeding identity data from disconnected systems back into governance workflows
• Why Cerby argues its approach changes the economics of reaching full application coverage

👉 Read Cerby's analysis of why phase one identity governance stalls →

Identity governance coverage gaps: why phase one leaves risk behind?

Explore further

View Full Forum →  |  NHI Foundation Course →