Notifications
Clear all
Topic starter
27/06/2026 12:59 pm
TL;DR: KuppingerCole’s 2026 IGA Leadership Compass frames access intelligence, lifecycle control, and non-human identity governance as core differentiators, while Nexis argues that NHIs now sit inside the same governance problem as employees and contractors. The strategic shift is clear: identity programmes that cannot govern service accounts, bots, and AI agents are leaving a growing blind spot.
NHIMG editorial — based on content published by Nexis: IGA in 2026, key insights from KuppingerCole Analysts Identity Governance and Administration Leadership Compass
By the numbers:
- Service accounts, bots, and AI agents now outnumber human users in many enterprise environments, sometimes by a factor of 25 to 50.
Questions worth separating out
Q: How should teams govern service accounts and AI agents in the same IGA programme?
A: Use a single governance model for ownership, review, and offboarding, but apply it to different identity lifecycles.
Q: Why do access reviews often fail to reduce real identity risk?
A: They fail when they measure completion instead of decision quality.
Q: What breaks when non-human identities are governed only through employee-centric workflows?
A: Ownership becomes unclear, offboarding gets missed, and entitlement reviews lose context.
Practitioner guidance
- Extend governance to non-human identities Inventory service accounts, bots, API keys, and AI-agent-linked credentials in the same governance register as employee identities.
- Reduce certification noise with access intelligence Prioritise risky entitlements, abnormal access patterns, and duplicate roles in certification workflows so reviewers see decisions that need judgment.
- Validate lifecycle consistency across platforms Test joiner, mover, and leaver workflows across legacy applications, SaaS tools, and container environments to confirm that approvals, revocation, and record updates behave consistently.
What's in the full article
Nexis' full post covers the operational detail this post intentionally leaves for the source:
- The specific capabilities the KuppingerCole Leadership Compass used to evaluate IGA vendors, including access reviews, access intelligence, and API support.
- Nexis' own product framing for Identity Grids, NICO, and data quality routines that the vendor positions as part of its governance workflow.
- The deployment and integration detail behind supporting on-premises, containerised, and SaaS environments in regulated industries.
- The report access path and demo information for readers who want the vendor's original context rather than this independent analysis.
👉 Read Nexis' analysis of the KuppingerCole 2026 IGA Leadership Compass →
Non-human identity governance in IGA: what teams are missing?
Explore further
27/06/2026 2:08 pm
IGA is now an identity control layer, not a back-office reporting function. The article correctly places governance at the intersection of security, compliance, and operational efficiency. That shift matters because identity programmes are increasingly judged by whether they can reduce excess access and lifecycle risk, not by how many certifications they can complete. For practitioners, the real question is whether governance decisions change access outcomes.
A few things that frame the scale:
- From our research: Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: How do organisations know whether their IGA programme is actually working?
A: Look for fewer orphaned accounts, fewer unresolved SoD conflicts, and a lower rate of redundant approvals in certification campaigns. If the programme is healthy, access reviews should produce cleaner entitlement data and fewer exceptions over time, not just higher completion percentages.
👉 Read our full editorial: IGA in 2026: Why non-human identity governance is now central
