Topic starter
22/02/2026 9:34 pm
TL;DR: Enterprises that stop at IAM often automate sign-ins while leaving access reviews, segregation-of-duties checks, and revocation decisions in spreadsheets, and 84% still rely primarily on manual review and provisioning processes, according to SafePaaS-cited 2025 survey data. Access governance fails when eligibility is never continuously re-validated.
Editorial analysis by NHI Mgmt Group, based on content published by SafePaaS: “IAM Software vs IGA: Understanding the Key Differences”.
Key questions
Q: What breaks when organisations stop at IAM and skip IGA?
A: They can still authenticate users while leaving entitlement validity unchecked.
Q: Why do manual access request processes create governance risk?
A: Manual processes increase the chance of inconsistent approvals, slow fulfilment, and weak audit trails.
Q: How should security teams govern access across SaaS sprawl?
A: Security teams should govern SaaS sprawl with one inventory, one policy model, and one review process that covers both human and non-human access.
Practitioner guidance
- Define IAM and IGA as separate control layers Document IAM as the authentication and session enforcement layer, and IGA as the entitlement validity and evidence layer.
- Inventory high-risk entitlements across applications Build a consolidated view of finance, production, admin, and other sensitive access across ERP, SaaS, directories, and PAM.
- Replace spreadsheet reviews with policy-driven certifications Move periodic access certification into a governed workflow that routes reviews to the right owner, applies SoD rules, and records approval or revocation decisions in a defensible audit trail.
Bottom line: IAM software controls access at the point of authentication, but it does not continuously validate whether entitlement remains appropriate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 3:32 pm
IAM is an enforcement layer, not a governance answer: Identity software can authenticate users, apply conditional access, and grant session-level access, but it cannot decide whether access is still appropriate. That distinction matters because organisations often mistake successful login control for a complete identity programme. The practical conclusion is that IAM without IGA is a front door with no ongoing entitlement challenge.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How do teams decide whether access is actually justified over time?
A: By tying certification, role design, and revocation to business purpose, not just successful authentication. If the organisation cannot explain why the access exists, who approved it, and when it will expire, the entitlement should be treated as a governance defect rather than an active right.
👉 Read our full editorial: IAM software vs IGA: why governance matters beyond logins