Notifications
Clear all
Topic starter
11/08/2026 3:23 pm
TL;DR: Modern IGA is defined by integration, automation, and business alignment, according to Fischer Identity, which argues that leaders should judge governance by predictable security, compliance, and operational outcomes rather than buzzwords. That framing is useful because many programmes still rely on fragmented workflows and manual exceptions that cannot keep pace with hybrid identity estates.
NHIMG editorial — based on content published by Fischer Identity: Cutting Through the Noise, What Modern IGA Really Means
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should teams judge whether an IGA programme is actually modern?
A: They should look for three things: broad integration across identity sources, reliable automation across the lifecycle, and reporting that ties governance to business outcomes.
Q: When does automation in IGA create real value?
A: Automation creates real value when it removes repeatable manual work from onboarding, offboarding, certification, and access correction.
Q: What do organisations get wrong about non-human identity governance?
A: They often treat service accounts and other machine identities as secondary to human access, which leaves ownership and lifecycle control unclear.
Practitioner guidance
- Map governance to measurable outcomes Define the business outcomes your IGA programme must support, such as faster provisioning, cleaner deprovisioning, and stronger audit evidence.
- Review connector coverage before redesigning workflows Inventory the systems that feed identity data into governance and confirm whether they can be integrated without brittle custom middleware.
- Identify manual lifecycle bottlenecks Trace where joiner, mover, leaver, and certification processes still rely on tickets, spreadsheets, or exception handling.
What's in the full article
Fischer Identity's full blog post covers the positioning and product context this analysis intentionally leaves aside:
- How Fischer Identity defines modern IGA across hybrid, cloud, and on-prem environments
- Details on the platform's no-code configuration model and implementation approach
- Examples of lifecycle automation, certification, and compliance workflows referenced in the post
- The company's forthcoming identity intelligence capabilities and how it describes them
👉 Read Fischer Identity's post on what modern IGA means for governance teams →
Modern IGA guidance: what matters for integration and governance?
Explore further
11/08/2026 3:33 pm
Modern IGA is still a control-plane problem, not a branding exercise. The discipline only works when identity data, workflow, and policy are tightly connected enough to produce consistent outcomes across the lifecycle. When teams treat modernisation as terminology, they miss the real question: whether the programme can still govern change at enterprise scale. Practitioners should evaluate IGA by control integrity, not by market language.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- Another finding from the same research shows that 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: How can security teams tell whether IGA is supporting compliance rather than just reporting on it?
A: Compliance support exists when the platform can enforce lifecycle decisions, retain evidence, and show timely revocation or certification outcomes. Reporting alone only proves that data exists. Governance support proves that access changed because policy required it.
👉 Read our full editorial: Modern IGA is integration, automation and alignment
