Topic starter
23/03/2026 2:08 pm
TL;DR: Identity governance projects often spiral because manual data discovery, harmonisation, access review handling, and maintenance are still embedded in the operating model, according to Oleria Security. As enterprises add SaaS, cloud, and machine identities, the real test is whether governance can work without service-heavy dependency and quarterly guesswork.
Editorial analysis by NHI Mgmt Group, based on content published by Oleria Security: “The true cost of IGA: why identity governance projects spiral (and how to fix it)”.
By the numbers:
- $400k can be added on Day 1 just to make claimed out-of-the-box connectors production-ready.
- Mordor Intelligence reported 57% professional services revenue in 2024.
Key questions
Q: What breaks in IGA programmes when identity data discovery is manual?
A: Manual discovery breaks the foundation of IGA because the control plane starts with incomplete inventories, inconsistent schemas, and missing ownership data.
Q: Why do access reviews become rubber-stamping exercises in many IGA deployments?
A: Access reviews degrade when reviewers lack current manager mappings, accurate HR data, and clear entitlement context.
Q: How can security teams judge whether an IGA platform will scale without heavy services work?
A: Look at whether new applications, schema changes, and integrations can be absorbed without repeated connector fixes or reimplementation.
Practitioner guidance
- Audit the hidden service load Break total cost of ownership into licensing, professional services, integrators, internal FTEs, and maintenance so the real governance cost is visible before procurement.
- Map every identity data source before purchase Identify where account, entitlement, role, and ownership data lives across SaaS, cloud, and on-prem systems, then test whether the platform can ingest those sources without bespoke rebuilds.
- Validate review context quality Check whether manager mappings, HR records, and entitlement descriptions are complete enough for reviewers to make informed decisions without default approvals.
Bottom line: Many IGA deployments stall because manual data discovery, review administration, and maintenance remain embedded in the operating model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 7:19 pm
Manual governance is the hidden scaling tax in many IGA programmes: the control promise looks standard, but the operating model is still built on human assembly of data, workflows, and exceptions. That makes implementation time and service dependency part of the security architecture, not just a delivery inconvenience. The field should stop treating manual effort as an acceptable trade-off for coverage and start treating it as a sign that governance has not really been operationalised.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should organisations include in IGA total cost of ownership calculations?
A: They should include licensing, professional services, integrator cost, internal FTE time, and ongoing maintenance. A narrow software-only view hides the real delivery burden and makes deployments look cheaper and faster than they actually are.
👉 Read our full editorial: The hidden cost of IGA is manual governance at scale