Access Governance

The KuppingerCole Leadership Compass offers a comprehensive review of vendors providing access governance (AG) solutions, emphasizing the integration of identity governance and administration (IGA). It categorizes vendors based on their provisioning or governance capabilities and evaluates multiple AG adoption patterns in different industries. The increased demand for access governance products stems from organizations aiming to enhance IT security, regulatory compliance, and access intelligence. Vendors are judged on various criteria like target system connectivity, access review, and risk management. Core features such as access warehouses, access certification, analytics, risk management, SoD enforcement, and role management are deemed essential for robust access governance. The document breaks down market segments, delivery models, product ratings, and specific vendor strengths and challenges. Moreover, it explores various leadership categories (product, innovation, and market) and provides a detailed analysis to help security leaders identify and select appropriate technology vendors based on specific IAM needs.

• The document evaluates 25 AG product vendors.
• Overall leaders include Avatier, Beta Systems, Broadcom, EmpowerID, Evidian, IBM, Microsoft, OpenText, Netwrix, Omada, One Identity, Oracle, RSA, SAP, SailPoint, Saviynt, and Simeio.
• Product leaders encompass companies like Avatier, SailPoint, and Omada, providing extensive access governance capabilities.
• Innovation leaders are headed by SailPoint, Broadcom, and IBM showcasing enhancements in UIs, microservice architectures, and analytics.
• Market leaders, such as IBM, SailPoint, RSA, and Broadcom, have a significant global reach and customer base.
• Core AG features include access warehouses, certification campaigns, and risk-based access management.
• Delivery models vary but include on-premises, SaaS, and hybrid solutions, with multi-tenancy support.
• Effective governance involves automated provisioning, risk evaluation, and policy enforcement.
• Specialized tools for governance of privileged users are gaining importance.
• Integration with third-party tools like ITSM and GRC systems is recommended for comprehensive governance.

• "Access governance is essential to ensure overall IT security and regulatory compliance."
• "The level of identity, access, and risk intelligence has become a key differentiator."
• "Automation reduces management workload by automating tasks and providing process workflows."
• "There is a considerable shift in IAM vendors' product roadmap to support access governance."
• "Core elements of an access governance solution include role management, auditing, and certifications."
• "Access risks can have severe operational impacts and can stem from organizational-wide security risks."
• "Effective governance controls are crucial for preventing data theft, identity fraud, and other policy violations."
• "Risk-based approach to evaluate and assign risk score for access requests is necessary."
• "Workflow support for role management and policy enforcement is critical for effective AG."
• "Integration with GRC tools provides better visibility in the state of access-related compliance."