Access Governance & Intelligence

The KuppingerCole Leadership Compass for Access Governance assesses vendors delivering access governance and access intelligence capabilities, reflecting a market shift: many organizations now seek stand-alone access governance products, especially when identity provisioning is already in place or delivered via managed services while governance is kept in-house for control and auditability. To align with changing adoption patterns, KuppingerCole split coverage into two documents—one focused on Access Governance and Intelligence and another on broader IGA spanning provisioning plus governance—complemented by Leadership Compasses for SMB-focused IGA and comprehensive IAM suites.

Access Governance & Intelligence is positioned as an IAM risk-management discipline that answers “who has access to what,” “who accessed what and why,” and “who granted access.” Core capabilities include access warehouses, certification, analytics/intelligence (often ML-driven), risk-based workflows, access request management, segregation of duties (SoD), and enterprise role management. The scope increasingly must include privileged users via integration with Privileged Access Management, plus deeper entitlement-level governance in systems like SAP and Windows file environments (EAG/data access governance). GRC tools alone are not expected to meet access governance needs, but integration with GRC is recommended to improve compliance visibility and incorporate regulatory changes.

The Leadership Compass evaluates predominantly on-premises and MSP-hosted offerings (excluding vendor-hosted IDaaS for this report), emphasizing workflow design, entitlement repositories, intelligence, flexible campaigns and delegation, connector heritage, standards (SCIM/SPML), customization durability across upgrades, security architecture, HA, deployment ease, multi-tenancy, and advanced analytics.

Overall market leadership is led by SailPoint, followed closely by IBM, then Saviynt and One Identity, within a crowded field of 24 vendors. Product and innovation leadership similarly highlight SailPoint, IBM, and Saviynt, with correlated matrices distinguishing “market champions,” innovative specialists, and regionally strong challengers.

• The Leadership Compass evaluates 24 vendors in the Access Governance market segment.
• SailPoint holds the top position in Overall Leadership for Access Governance, with IBM closely behind.
• Saviynt and One Identity follow SailPoint and IBM in the Overall Leadership ranking.
• No vendors appear in the Follower segment of the Overall Leadership rating.
• Access governance is defined around three questions: who has access to what, who has accessed what and why, and who has granted that access.
• The report focuses on products that predominantly run on-premises or are hosted by a Managed Service Provider, excluding vendor-hosted IDaaS delivery for this evaluation.
• Core elements of access governance listed include role management, attestation/recertification, auditing/analysis, access request management, integrated privilege management features, and support for EAG.
• Avatier Identity Anywhere is described as a Docker container-based cloud service using a REST API agent on-premises to communicate with on-premises identity stores and applications.
• Brainwave Identity GRC can be extended to IGA lifecycle capabilities using ServiceNow as the lifecycle component.
• Broadcom’s Symantec Enterprise business resulted from acquiring CA Technologies in 2018 and Symantec Enterprise in 2019.

• “Access Governance & Intelligence is an IAM focused risk management discipline that facilitates business involvement in the overall management of access rights across an organization’s IT environment.”
• “Access governance concerns the access mechanisms and their relationships across IT systems and thus is instrumental in monitoring and mitigating access-related risks.”
• “From KuppingerCole’s perspective, a complete access governance approach must go beyond the governance of ‘standard users’ to include privileged users as well.”
• “Conducting separate access certification campaigns for standard and privileged access can be complex and time-consuming.”
• “While there is some functional overlap, we don’t expect the available GRC tools to deliver even basic capabilities to meet the access governance requirements of organizations.”
• “Unfortunately, not every tool that looks nice at first glance is sophisticated enough to cover all needs of customers.”
• “But it is not the customer adapting to the tool, it should be the tool adapting to the customer.”
• “The market continues to remain crowded, with 24 vendors we chose to represent in our Leadership Compass rating…”
• “Innovation is not about delivering a constant flow of new releases.”
• “It is therefore highly recommended that organizations spend considerable resources in properly scoping and prioritizing their AG requirements prior to AG product evaluation.”