Topic starter
24/06/2026 10:47 pm
TL;DR: Identity governance programs often stop after covering the first five to ten critical applications, leaving disconnected systems unmanaged, according to Cerby; only 54% of applications are adequately integrated and just 6% of organisations report fully automated IGA processes. Partial coverage turns the rest of the application estate into a persistent governance and lifecycle blind spot.
Editorial analysis by NHI Mgmt Group, based on content published by Cerby: “Stop settling for partial coverage: The real math of identity governance”.
By the numbers:
- Only 54% of applications are adequately integrated with an IGA platform.
- Only 6% of organisations report fully automated IGA processes.
Key questions
Q: What breaks when identity governance starts with too many applications at once?
A: The programme loses control quality before it builds control coverage.
Q: Why do disconnected apps create so many audit problems?
A: Because auditors need proof that access was granted, reviewed, and revoked consistently, not just a statement that policy exists.
Q: How can security teams tell whether IGA coverage is actually complete?
A: They should compare the number of applications in governance workflows with the number of applications found through discovery and network evidence.
Practitioner guidance
- Define coverage as a programme objective Set a target for the percentage of applications that must be governed, not just the number of systems initially integrated.
- Inventory the hard-to-integrate estate Create a separate backlog for legacy, non-federated, vendor-hosted, and custom-built applications that cannot join standard workflows.
- Test whether certification actually enforces revocation Sample access reviews in disconnected systems and verify that approved removals are executed, not just recorded.
Bottom line: Phase-one IGA programs tend to overprotect the easiest applications and under-govern the hardest ones.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:37 am
Partial IGA coverage is not a staging problem, it is a structural governance gap. Programs that stop at phase one do not merely delay maturity; they establish a two-tier control model where connected apps are governed and disconnected apps are effectively exceptions. That matters because the exception set is usually the most operationally awkward and therefore the least likely to shrink. Practitioners should treat coverage completeness as a core governance outcome, not a roadmap aspiration.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Should organisations prioritise full coverage or deeper automation first?
A: Coverage comes first when major application classes still sit outside the identity control plane, because automation that only applies to a narrow subset leaves the largest risk untouched. Deeper automation matters, but only after the programme can govern the applications most likely to carry stale access, manual exceptions, and lifecycle drift.
👉 Read our full editorial: Identity governance fails when programs stop at phase one