Topic starter
22/09/2026 3:28 pm
TL;DR: Gartner’s new Identity Visibility and Intelligence Platform category formalises a layer for aggregating identity, entitlement, and activity data across fragmented environments, with Oleria listed as a Representative Provider, according to Oleria Security. The practical shift is that continuous visibility and action on human, non-human, and AI identities is becoming a governance requirement, not an optional IAM add-on.
NHIMG editorial — based on content published by Oleria Security: Gartner IVIP category and Oleria's recognition as a Representative Provider
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
Questions worth separating out
Q: How should identity teams handle fragmented identity data across IGA, PAM, and cloud systems?
A: Treat fragmentation as a governance defect, not just a reporting inconvenience.
Q: Why do entitlements alone fail as a measure of identity risk?
A: Because entitlements show theoretical access, while activity shows exploitable access.
Q: What are the signs that an identity programme is still workforce-only?
A: A workforce-only programme usually cannot explain where service accounts live, which AI identities are active, or which cloud entitlements are disconnected from governance workflows.
Practitioner guidance
- Map all identity sources into one operational graph Inventory where human, NHI, and AI identity data lives today, then define which systems supply authoritative entitlement, activity, and control-state records.
- Separate assigned access from used access Build review workflows that compare entitlements with observed activity so access decisions are based on what is actually exercised, not just what is provisioned.
- Require continuous revocation paths Verify that your identity platform can remove or constrain access without opening a new integration project for each control action.
What's in the full article
Oleria Security's full post covers the operational detail this analysis intentionally leaves for the source:
- Gartner category framing and the implications of being named a Representative Provider
- The vendor's own explanation of visibility, intelligence, and action across a unified identity graph
- The three practitioner questions it recommends for vendor evaluation
- The article's view on how platform consolidation is changing identity tooling choices
👉 Read Oleria Security's analysis of Gartner's IVIP category and identity visibility →
Identity visibility and intelligence platforms: what changes for IAM teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
22/09/2026 3:29 pm
IVIP is a category name for a control problem, not a product race. The market has accumulated too many identity point solutions that each answer a narrow question but none answer the programme question. That leaves governance teams with fragmented evidence and weak enforcement across humans, NHIs, and AI identities. The category matters because it re-centres identity on operational control rather than tool count.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why identity visibility is still a baseline problem, not a mature-state assumption.
A question worth separating out:
Q: How should security teams evaluate IVIP-style capabilities in existing tools?
A: Ask whether the platform can see all identity types, use activity rather than entitlements alone, and execute control changes without another integration project. Those three checks separate a reporting layer from a working control layer.
👉 Read our full editorial: Identity visibility and intelligence is becoming the new IAM layer
