Access Governance & Intelligence

The KuppingerCole Leadership Compass on Access Governance & Intelligence maps a maturing, crowded market where organizations increasingly want stand-alone access governance, often because identity provisioning already exists or is delivered as a managed service while governance remains in-house for tighter control. Access governance is positioned as an IAM risk-management discipline that enables business involvement in managing entitlements, certifications, reporting, and segregation-of-duties (SoD) controls, while access intelligence adds analytics and machine learning to support role design, automated reviews, anomaly detection, and process optimization. Core questions are who has access, who used it and why, and who granted it.

A complete access governance approach is defined as role management (including role mining and simulations), continuous attestation/recertification, auditing and analysis, access request management with workflows and reconciliation, SoD enforcement, and increasingly the inclusion of privileged users through tight integration with privilege management. The document also highlights the rise of entitlement and access governance (EAG) and data access governance for platforms like SAP and Windows file servers, plus the importance of integrating with GRC tools for compliance visibility even though GRC tools alone are insufficient.

The evaluation focuses on predominantly on-premises or MSP-hosted products (excluding vendor-operated IDaaS). Vendor selection is emphasized as requiring requirements analysis and proof of concept beyond the Compass. In overall leadership, SailPoint leads, followed closely by IBM, CA Technologies, and Oracle, with a strong second cluster including EmpowerID, Hitachi-ID, Micro Focus, Omada, One Identity, RSA, SAP, and Saviynt. The report provides correlated views across product, innovation, and market leadership to identify “market champions,” overperformers, and highly capable but regionally constrained vendors.

• The access governance market evaluation considered about 25 prominent vendors.
• SailPoint is rated the overall leader, slightly ahead of IBM, CA Technologies, and Oracle.
• No vendors are placed in the Follower segment in the Overall Leadership rating.
• The Leadership Compass scope focuses on products that predominantly run on-premises or are hosted by a managed service provider.
• Vendor-hosted Identity as a Service (IDaaS) delivery is excluded from this access governance evaluation.
• Access governance is defined around three core questions: who has access to what, who has accessed what and why, and who has granted that access.
• Core access governance elements include role management, attestation/recertification, auditing/analysis, access request management, integrated privilege management, and support for EAG.
• The Challenger segment is described as being surprisingly dominated by European vendors.
• GDPR and other political developments in Europe are described as fueling demand and innovation for access governance.
• The report states that most access certification reviews are conducted at the application level.

• “Access Governance & Intelligence is an IAM focused risk management discipline that facilitates involvement of business in the overall management of access rights across an organization’s IT environment.”
• “Access intelligence refers to the layer above access governance that offers business-related insights to support effective decision making and potentially enhance access governance.”
• “Access governance products focus on implementing and governing the controls for access management.”
• “From KuppingerCole’s perspective, a complete access governance approach must go beyond the governance of ‘standard users’ to include privileged users as well.”
• “Conducting separate access certification campaigns for standard and privileged access can be complex and time consuming.”
• “We don’t expect the available GRC tools to deliver even basic capabilities to meet the access governance requirements of organizations.”
• “Support for SCIM (System for Cross-domain Identity Management) is preferred over traditional SPML (Service Provisioning Markup Language) for federated as well as on-prem provisioning.”
• “Unfortunately not every tool that looks nice at first glance is sophisticated enough to cover all needs of customers.”
• “But it is not the customer adapting to the tool, it should be the tool adapting to the customer.”
• “Selecting a vendor of a product or service must not be only based on the comparison provided by a KuppingerCole Leadership Compass.”