SailPoint Non-Employee Risk Management

Short Summary

Contemporary organizations operate across dense webs of networks, devices, assets, and people, while relying heavily on contractors, partners, seasonal workers, and vendors. This dependence creates an identity governance gap: many enterprises manage employee access through IAM and sensitive administrative access through PAM, yet lack comparable, centralized control for external identities across B2B, B2G, and B2B2C ecosystems. Supply-chain complexity deepens the challenge because third parties may themselves depend on “fourth parties,” expanding indirect exposure. Governance shortfalls show up in weak prioritization and resourcing for outsourced relationship risk, incomplete inventories of third parties with network access, and limited clarity about which external parties can reach sensitive data—conditions linked to a large share of third-party-caused breaches.

Unmanaged non-employee identity growth produces operational and security problems: unclear counts of non-employee users, difficulty distinguishing employees from contractors or suppliers (especially as roles change over time), duplicate accounts and credentials, and unnecessary software license creation. Attempts to solve these issues via HR tool modifications or custom-built platforms often fail due to misaligned workflows, high cost, and resource drain, while many IAM/PAM platforms only partially address third-party needs.

SailPoint Non-Employee Risk Management extends SailPoint’s identity governance into non-employee lifecycle control, using technology acquired from SecZetta and requiring SailPoint Identity Security Cloud. It supports delegated administration so approved external administrators can create standardized profiles, capture policy acknowledgements (e.g., Acceptable Use), and submit identities for analysis. An AI-assisted engine flags duplicates and surfaces prior history, then approved identities become governed “Identity Cubes” that persist across the relationship lifecycle. Strengths include flexible workflows, natural-language form creation, centralized visibility, and automated provisioning/termination. Key challenges include limited support for non-human identities and a desire for broader PAM/CIEM integrations, both positioned on the roadmap.

Interesting Facts

• Only 42% of respondents say managing outsourced relationship risk is a priority.
• Only 40% of respondents say there are enough resources to manage outsourced relationships.
• 54% of respondents indicate their organizations lack a comprehensive inventory of all third parties with network access.
• 65% of organizations have not identified the third parties with access to the organization’s most sensitive data.
• 51% of organizations experienced a data breach caused by a third party in 2021.
• SailPoint was founded in 2005 and is based in Austin, Texas.
• SailPoint Non-Employee Risk Management is based on technologies acquired from SecZetta.
• Customers must be on SailPoint Identity Security Cloud to get the specific benefits of SailPoint Non-Employee Risk Management.
• The module adds a “Manage Non-Employees” widget to the main SailPoint administrator dashboard after installation.
• Full support for non-human identities is expected in early 2024.

Notable Quotes

• “Effectively managing these identities and regulating access presents a complex challenge, necessitating an all-encompassing solution to bring these crucial non-employee identities under control.”
• “However, modern organizations also need to accommodate external identities.”
• “It is crucial for the hosting or sponsor organization to have the means to regulate secure access centrally.”
• “There are several business problems that the unmanaged growth of non-employee identity presents.”
• “Duplicate user accounts and multiple credentials are a big problem which can also result in multiple software licenses being created for the same user.”
• “Once installed, a new Manage Non-Employees widget will appear in the main SailPoint administrator dashboard.”
• “Each identity will have one Cube throughout its lifecycle with the sponsor organization.”
• “Detail on actual workflows and granular access by non-employees can be added to Cubes, making them very flexible and incredibly useful for audit and security purposes”
• “SailPoint needs to improve support for non-human identities.”
• “There are only likely to be more of them in the future.”