Topic starter
27/06/2026 1:33 pm
TL;DR: Large enterprises with SAP, Oracle, and mainframe-heavy governance needs may find SailPoint strongest, but its licensing, services, and deployment model can add 30% to 60% in first-year overhead and extend implementations into months or years, according to Zluri. The real decision is whether your identity programme needs legacy depth or faster governance across SaaS, cloud, and non-human identities.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Is SailPoint Worth It? How Zluri Compares on Cost, Speed, and Modern Identity Security”.
By the numbers:
- Professional services for setup, integration, and custom workflow development typically add 30% to 60% on top of first-year licensing.
- A 36-month, 2,500-identity contract was benchmarked at roughly $825,000 total.
- Annual maintenance and support typically run 18% to 22% of license value for on-premise deployments.
Key questions
Q: How should teams choose between SaaS-first and ERP-first identity governance models?
A: Choose the model that matches the dominant risk surface in your environment.
Q: When does legacy IGA create more overhead than value?
A: It becomes overhead when the organisation does not have the specialist team, timeline, or customisation budget that the platform assumes.
Q: What are the signs that identity governance is too dependent on manual expertise?
A: Look for workflows that require consultants or certified admins for routine changes, integrations that need scripting to stay stable, and certification campaigns that rely on reviewer memory more than live data.
Practitioner guidance
- Assess your dominant identity substrate Determine whether your environment is primarily ERP-heavy, SaaS-heavy, or a hybrid estate, because the governance model that fits one can create unnecessary friction in the other.
- Inventory non-human identities alongside human accounts Include service accounts, API tokens, bots, and AI agents in the same discovery process so lifecycle ownership and access review do not stop at employee accounts.
- Separate certification design from entitlement complexity Use different control designs for periodic access review, ERP segregation of duties, and continuous posture monitoring instead of assuming one certification process fits every system.
Bottom line: The article frames legacy IGA and modern identity security as different answers to different operating models, not interchangeable labels.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 2:57 pm
Legacy IGA and modern identity security now solve different operating problems: the former is built for deep enterprise entitlement governance, while the latter must cover SaaS sprawl, cloud access, and non-human identities at the speed the business changes. The article makes the contrast plain: implementation model, not just feature list, now determines whether governance can keep up. Practitioners should evaluate identity platforms against their actual operating tempo, not the vendor category label.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.
👉 Read our full editorial: SailPoint versus Zluri: cost, speed, and modern identity security