Topic starter
11/06/2026 10:35 pm
TL;DR: Gartner IAM 2025 highlighted a market shift toward Identity Visibility and Intelligence Platforms, continuous identity security, and modern authorization patterns as enterprises confront 82:1 non-human identity sprawl and 99% over-permissioned service accounts, according to Zluri. The governance model is changing because visibility now has to precede review, certification, and enforcement.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “What the Gartner IAM 2025 Summit Revealed About the Future of Identity Governance”.
Key questions
Q: How should IAM teams sequence identity visibility and governance?
A: Start with discovery and ownership mapping, then use that inventory to drive certifications, policy reviews, and access enforcement.
Q: Why do non-human identities create more IAM risk than many teams expect?
A: Because they are numerous, long-lived, and often poorly owned.
Q: What are the warning signs that non-employee identity governance is failing?
A: Common signs include not knowing how many non-employee identities exist, finding duplicate or shared accounts, and seeing access that no longer matches sponsor ownership.
Practitioner guidance
- Build a visibility-first governance sequence Start with discovery coverage, ownership mapping, and application inventory quality before widening access reviews or certification cycles.
- Expand governance to machine identities Include service accounts, pipelines, and other non-human identities in entitlement review, ownership assignment, and offboarding workflows.
- Prioritise high-value applications first Use a minimum viable deployment approach for the applications with the highest access risk, highest change rate, or weakest ownership data.
Bottom line: Legacy IGA loses effectiveness when the organisation cannot reliably see the applications, identities, and permissions it is trying to govern.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 6:49 am
Visibility before governance is the new identity control sequence: Legacy IGA assumed the inventory was known before review began. That assumption no longer holds in SaaS-heavy and machine-heavy environments, where unknown applications and unowned access make certification look precise while remaining incomplete. Practitioners should treat discovery quality as the upstream control that determines whether governance is real or ceremonial.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should organisations move from periodic access reviews to continuous identity governance?
A: Start by treating certification campaigns as validation, not detection. Then connect entitlement changes, exceptions, and revocations to real-time policy checks so the programme can prove enforcement at the moment access changes. That shift matters most where service accounts, tokens, and privileged roles can drift faster than a review cadence.
👉 Read our full editorial: Identity visibility is overtaking legacy IGA in the IAM market
This post was modified 4 days ago by NHI Mgmt Group