Topic starter
20/04/2026 7:32 pm
TL;DR: Many identity governance and administration programs are stalling because integration friction, manual workflows, and rapidly expanding identity estates outpace static tools, according to Palo Alto Networks, while Enterprise Strategy Group data shows 77% of organisations call IGA a core cybersecurity best practice and 67% revoke up to 30% of permissions in reviews. The governance problem is now operational, not theoretical, because scale breaks manual control models.
Editorial analysis by NHI Mgmt Group, based on content published by Palo Alto Networks: “Think IGA is challenging? You’re not alone”.
By the numbers:
- 67% of organisations revoke up to 30% of user permissions during access reviews.
Key questions
Q: Why do IGA programs stall when identity estates keep growing?
A: IGA programs stall when connector coverage, review workflows, and governance ownership cannot keep up with the number and variety of identities being added.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use.
Q: How should teams modernise IGA without turning it into a multi-year project?
A: Start with the applications and identity types that create the greatest governance risk, then automate the repeatable workflows around provisioning, review, and revocation.
Practitioner guidance
- Define the governable identity surface Inventory which applications, identity types, and entitlement sources are actually in scope for access reviews, provisioning, and recertification.
- Replace spreadsheet-driven review workflows Move high-volume access reviews and approvals into policy-driven workflows that reduce ticket queues, email chasing, and manual reconciliation.
- Track governance latency as a control metric Measure how long it takes to connect an application, complete a review cycle, and revoke excess access after discovery.
Bottom line: Traditional IGA programs stall when manual processes and incomplete integrations cannot keep pace with expanding identity estates.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 months ago by NHI Mgmt Group
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 4:19 pm
IGA is no longer failing as a concept, it is failing as an operating model. The article shows that most organisations still want governance, but their control design depends on manual effort and incomplete integration. That combination does not hold in estates where identities, apps, and permissions change continuously. The practical conclusion is that governance must be treated as a runtime capability, not an annual programme milestone.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between periodic access reviews and continuous identity governance?
A: Periodic access reviews check entitlements at a point in time, while continuous identity governance tracks access as it changes. The first approach is useful for audit snapshots but weak against fast-moving cloud and automation environments. The second reduces stale access by combining discovery, policy enforcement, anomaly detection, and timely revocation.
👉 Read our full editorial: Why traditional IGA programs stall as identity estates keep growing