1 Executive Summary

This KuppingerCole Leadership Compass provides an overview of vendors and the services and products they offer in Identity and Access Governance (IAG) market segment, including specific capabilities for access intelligence. While most vendors offer comprehensive IGA products for both identity provisioning and access governance, some offer specialized solutions either for User Access Provisioning (UAP) or IAG.

Identity and Access Governance as a core part of IGA is one of the key technologies within IAM for any organization. This is due to the massive impact of security and governance risks arising due to issues in managing access controls such as over-entitlements and gaps in enforcing the least privilege principle, Segregation of Duties (SoD) violations, and access governance controls. There are several access-related security risks in today’s organizations that have a direct impact on business, including but not limited to, intellectual property theft, business fraud in ERP systems including SOD conflicts and other policy violations, reputational damage due to the loss of customer information and privacy-related data, and many more. Thus, an adequate access governance framework is essential for organizations dealing with continually changing paradigms of security and risk management.

Currently, organizations are going for a comprehensive IGA solution, but some organizations may find a specialized IAG solution more appropriate to their needs. This is the case in specific scenarios. One scenario are companies that currently have only lightweight Identity Lifecycle Management (ILM) or User Access Provisioning (UAP) systems in place but require enhanced governance to meet regulatory compliance. These companies may find that a specialized IAG solution is the better fit for their requirements. Similarly, organizations with legacy ILM/UAP systems that lack robust governance capabilities may need to deploy a specialized IAG tool to quickly address governance gaps without undergoing the complex and potentially disruptive process of replacing their existing ILM/UAP systems.

In the broader market, IAG solutions are dominated by two groups of vendors. This includes vendors either offering comprehensive IGA suites with strong governance capabilities or vendors focused primarily on IAG, with limited UAP and ILM capabilities. The latter group of IAG specialists excels in providing focused governance functions but may rely on connecting to existing ILM or UAP systems to gather the necessary data from target systems and to execute change requests. Despite the depth and specialization of these IAG-only solutions, most customers favor comprehensive IGA suites due to their breadth and integration.

This KuppingerCole Leadership Compass provides an overview of the IAG market with notable vendors and their products in the market. Most of the vendors today offer combined capabilities to qualify as IGA vendors, while only a few, especially the new entrants, provide Identity and Access Governance or reporting capabilities to cater to specific needs of the organizations, mainly small and medium sized. The vendors in this report offer a range of deployment options varying from on-premises (including the ability to be hosted by the customer or a Managed Services) or IDaaS, with IDaaS being either multi-tenant or single-tenant.

The top drivers for acquiring IAG solutions are as enhancing security, regulatory compliance, risk management, improved user experience, and operational efficiency by leveraging latest AI and machine learning technologies. In this year’s report, we have seen vendors invest heavily in automating certain capabilities and using AI and machine learning for recommendation-based features. The IAG market was already mature, but with these new advancements, we have a new perspective on how vendors are managing identities, risks, analytics, and provisioning.

Typical buyers for IAG products are spread across various industry verticals. This trend can be seen mainly in sectors which require a high level of compliance with regulatory authorities. Finance, healthcare, manufacturing and industrial companies, technology firms, and government institutions are some of the main sectors seeking IAG products. The organizations deploying IAG solutions commonly range from mid-market to very large organizations. IAG products deliver strong capabilities in providing a centralized view of who has access, who provided the access, and who has access for how long. Companies in healthcare, finance and government sector which have critical data and strict regulatory compliance requirements rely on IAG solutions for governing identities and managing their life cycle. The IAG market has a global footprint and is not limited to a specific region.

It is important that organizations scope their IAG requirements well before starting to evaluate products that differ in the strength of functionalities, making most of them better aligned for either provisioning or governance focused deployments.

This IAG Leadership Compass follows a published Leadership Compass for Identity and Governance Administration (IGA). This Leadership Compass on Identity and Access Governance is a specialized version which will evaluate vendors with an emphasis, but not limited to, core access governance capabilities. It does not include vendors who only have strong Identity Lifecycle Management (ILM) capabilities while lacking IAG support.

With these various LCs and accompanying BCs, we aim to provide CISOs and security leaders responsible for IAM the most practical and relevant information that they need to evaluate technology vendors based on the specific use-case requirements, whether these are access governance driven, provisioning focused, governance focused, focused on comprehensive IAM suites or a combination of these.

1.1 Key Findings

What are the top considerations buyers should know about?

• This Leadership Compass evaluates 29 IAG product vendors and an additional twenty-four vendors to watch showcasing the strength of this market.
• The IAG market is growing, and although maturing it continues to evolve.
• IAG is essential to business as a strategic approach to ensure overall IT security and regulatory compliance.
• The level of access and risk intelligence, role modelling, segregation of duties and access analytics has become a key differentiator between IAG product solutions.
• Automation is a key trend in IAG to reduce management workload by automating tasks and providing flexible access review approaches
• The Overall Leaders are (in alphabetical order) Broadcom, EmpowerID, Evidian, IBM, Identity Plus, Microsoft, Omada, One Identity, OpenText, Oracle, Ping Identity, RSA, SailPoint, SAP, Saviynt