I think something which struck me was just the sheer size growth in the IGA market, the number of vendors that we are covering, I think that clearly demonstrates the IGA market is growing. And what was struck me as well is that several of these vendors were really newcomers and they were really focused a bit more on the core capabilities of IGA. But it will be interesting to see how these, you can say, emerging vendors now progress in the next one year, two years, and how they expand on the capabilities. So I'm looking forward to that side of segment as well.
Welcome to the KuppingerCole Analysts chat. I'm your host. My name is Matthias Reinwarth. I'm analyst and advisor with KuppingerCole Analysts.
Today, we want to talk about a topic which is without any doubt one of the flagship topics that we at KuppingerCole Analysts cover. And for this, I have invited the author who was behind that flagship research that we are looking at. We want to talk about Identity Governance and Administration, IGA.
For this, I have invited my colleague Nitish Deshpande. Hi, Nitish. Good to have you.
Hi, Matthias. Good to be here as well. It's been a while. And I think you correctly mentioned IGA has been a very important topic for us and everyone else in the industry. So looking forward to the quick discussion with you today. Yeah.
So really, we want to really draw from your research, from your experience. And IGA is a market segment that is around for quite a while. But that does not mean that it's stalling or getting boring or does not evolve. All of this is completely wrong. It's changing. So when we look at IGA, from your research, where does IGA stand today? What has happened? Where it is now? What's the state of the union? Absolutely. Completely agree with you. I think most of the people would say that IGA is a very mature market. There's not much happening, but it's completely the opposite.
You can say IGA traditionally was definitely more driven towards more strategic models and more towards siloed components. But what we are seeing right now, when we did this report, when we did our current analysis on this IGA report, is that the vendors are moving towards a more, you can say, converged platform for lifecycle management, access governance, access intelligence capabilities. Then also some are also providing password management capabilities as well. So it's all being done on one single platform. And that seems to be the new theme as well.
But what is also interesting right now is that due to the current demand as well, now the types of identities that are being supported is not just limited to workforce, contractors or partners. It is now also being expanded to this new genre of identities called the non-human identities. And the IGA vendors are now also covering this part of the, you can say, workforce identities as well. So it is definitely moving to that side. It is also equally driven by the customers as well as the customers are looking for a more integrated solution for all types of identities and all types of modules.
But that said, you can say that some organizations are still currently preferring, depending on what is their industry and what is their focus, to have a bit more, you can say, central control into their own premises rather than just having a more fully deployed into the cloud. So it's a bit of a mix of both right now. So it's definitely an interesting time to be here. But I think with the current advancement in IGA, I think we are at a really interesting point right now. Right. From what I've seen with I'm doing advisory in the IGA area quite a lot.
So I also see differences between customer groups, how they consume IGA. Do they use the traditional front end focused, workflow focused, user facing way of doing IGA? Or are they more modern, more cloud native? Are there more API users? So really using the platform as the driver under the hood in the machine room, but not necessarily as a content. I think that is also something that is currently evolving in parallel, even at the same vendors or specific vendors that focus on one or the other. But I think that is also something that is really changing.
So it's really something that is embedded into an overall architecture rather than having log in and clicking and now I'm in IGA and now I do a workflow. Right. Definitely. People are also trying to understand if they can, you know, try to not connect to the whole IGA solution or implement the full solution. They're also looking for a bit more flexibility in there is to maybe just they want to implement just the access governance part of it or maybe just the lifecycle management part of it.
So it's definitely driven more towards that as well as to have a bit more flexibility and also support in all the scaling as well. Right. And when we say that the market is evolving, of course, there needs to be a driver for this evolution. The question is, what is already well working? Is it only just the traditional use cases that we have or are these vendors also targeting new use cases? You've mentioned NHI as a new type of identities. We see AI supported use cases where generative AI supports the end user or the admin in doing their job better.
But evolution means that there's room for improvement. There's room for evolution. Are there areas where IGA actually also still falls short and where there's new tendencies, new emerging technologies to be embedded here?
Yeah, absolutely. I agree with you. I think no solution is 100% perfect. There are definitely areas for improvement. When we did this report for the IGA, we had several types of vendors in this report, not just your traditional big vendors, but also smaller vendors, upcoming vendors, emerging vendors, innovative as well. But I would say the more recurring theme amongst all of them, in most cases, was that there were some limitations in some, you can say the app automation side and governance side.
So especially if you look at more around the anomaly detection, then there was one quite common theme was limitations around role mining as well. So that was again, you can say a shortcoming or an area which is currently being worked on, which needs to be improved. AI driven recommendations is another part which is still on the roadmap of several vendors. So you can say the access intelligence side is currently where the vendors are also innovating and are focused right now and they are addressing these challenges as well.
But if you also maybe look at from policy management point of view, there are again a few inconsistencies or shortcomings there, such as in most cases, the support for something like a policy simulation, policy testing is not being provided right now. Even support for policy as a code is currently missing. But I think that again depends on what kind of customers you have. If the vendor is focused on customers who are mainly around the business users and not really, I can say, developer focused.
So the vendors are making this conscious decision to not provide policy as a code as they believe their own client is not really going to be utilizing this capability to the full. But another area again is around workflows. Workflow automation, workflow graphical designing is also missing in a few vendors, which I would like to see as well.
But again, the vendors are doing their best. They're trying to address these challenges and hopefully, I would say maybe the next time we do this report again, which is next year, I guess, then we will have a bit more understanding on what has been the progress of the vendors and have these kind of shortcomings been really addressed.
I mean, the challenges around deployment and flexibility are being addressed as well because you have vendors providing different kinds of deployment models. You have vendors providing fully SaaS model or they're also providing support for on-premise deployments. But then that again leads to different conversation as well is that what is the feature parity in both kind of deployment models. So these are some of the, let's say, a few areas where IGA solutions are currently evolving and developing. But let's unpack this.
This was actually really my next question because when I had this conversation five years ago, six years ago, seven years ago, there was a clear move from on-premise IGA towards just consuming it from the cloud with all the benefits that you have, continuous updates, no downtime, not having to provide any infrastructure, having always the newest capabilities and the newest version available without really having to care about that. That has changed for many of our customers, not for all. So we see still this tendency as a big trend.
But on the other hand, we see with the geopolitical situation, where do I consume the cloud from? Where is it actually run? Who runs the system on behalf of the vendor? There's a strong call also for solutions that can be handled autonomously within a private cloud or even still in own data centers. So we have the full breadth of potential when it comes to deployment models. But what the customers that I talk to actually are asking for, does the market cater for that? What you hinted at, I think, yes.
Yeah, absolutely. I agree with you. Yes. And that has been a recurring theme, as you mentioned, around the geopolitical situation is several vendors from Europe positioning themselves as EU sovereign. So which is, again, attractive for EU customers right now is they're looking for more and more EU-based vendors. Definitely that has been one driver in this transition as well.
But if you talk about the shift from, let's say, shift to the cloud models or the status of the on-premise models, again, the same thing is still the recurring theme since last couple of years is customers from highly regulated industries are still preferring a bit more of an on-premise control or in, let's say, in the best case scenario, something like a private cloud deployment. So that is, you can say, the shift right now.
In fact, we did a survey last year trying to understand what is the status of IGA deployments, on-premise, cloud or hybrid. And the responses that we got were a bit, you can say, interesting because we did the same survey three years in a row and we tried to compare the responses of all the surveys.
In 2023, the theme showed that on-premise definitely was the predominant deployment model. In 2024, there was a good shift, you can say, towards hybrid deployments. But in 2025, we saw from the responses that we got is that there was deployment shift again back towards more on-premise deployments. Maybe this is an outlook of how IGA deployments are complex. And some of the respondents who were participating in this service for the last three, four years had to roll back to on-premise deployments due to some complications with cloud.
But it will be interesting to see again this year what's the status. But once we have some more information, definitely we'll be happy to share with everyone who's listening to this podcast and also who is a regular visitor of our website. Right. And I think with the target systems moving more and more to the cloud and IGA are actually running somewhere, hybrid, on-prem, wherever, there needs to be connectivity, at least to the outside world, to SaaS, to infrastructure as a service, to whatever you have.
So I think that there is also a strong move to have at least the provisioning somewhere else, not on-prem, because it's closer to the target systems. One question that you've hinted at very briefly when we talk to our customers, when they say, I want to have a tools choice, I want to have a good IGA product and I have a choice between on-prem and software as a service or self-hosted or containerized somewhere. Do I get the same product? Is there feature parity? Are they the same wherever I consume them?
And can I even change over time, moving from on-prem to hybrid to the cloud without sacrificing any functionality? Yeah, definitely. That has been again, an issue that, not an issue you can say, but a common observation from our side is that the requirements for having full feature parity between the different deployment models.
Now, in most cases, let's say the more established vendors are providing a full feature parity in all of the deployment models, but there is still some inconsistency in some of the vendors. So definitely their SaaS deployments receive the updates and the latest features much more sooner compared to their on-premise deployments. But I would say that's also another observation is that some vendors are providing different products for the SaaS and on-premise. So they are focused completely differently, but they're focused on providing equal capabilities for both the products.
So that has been again, an observation. Main differences have mainly been around providing the access intelligence capabilities, the overall support for, let's say now the NHI governance aspect as well.
So yeah, definitely on-premise provides a bit of a challenge right now, but I think soon we will try to understand a bit more in the next report as well as what is the state of this feature parity between different deployment models. Right. And now that you have just published the report, it's a bit unfair to ask the question, what's next? What's coming? What do you see? What I see is really to provide human identities for non-human identities.
So to add the governance layer, to understand who is an owner for a group of NHIs that have unfortunately still long-lived credentials and they need to be monitored. I think that is something where what people are asking for is for really to add a governance layer while the NHIs stay where they are. So stay within their system of records. That is something that I think will be happening and I expect that to happen because there is a demand for that. What else do you expect to cover in the next edition of this report?
Yes, definitely. I think you made a really good point around the governance layer as well. What I'm also seeing is having a more, let's say, requirement or desire to have more real-time governance for different kinds of identities.
Again, I think for the next report, when we will do next year, my expectation would be is that all the things which I mentioned, which are currently being under development or as a challenge for IG solutions right now around the access intelligence part, automation part, support for more policy management, even for workflow capabilities as well. I hope to see the vendors address those capabilities first as basis and then maybe focus a bit more around the AI and machine learning part as well.
So maybe that is something which I would be interested to see again next year and how the IGA market is developing on that side. Right. Before we hint at the report, my personal question to you, I think the IGA market is a huge market. How many vendors did you cover for this? This is definitely a very huge market. When we did the report a couple of years back, we had around 25 to 30 vendors.
This year, when we did the report, we had almost 44 vendors who were willing to participate. But based on the inclusion criteria that we defined, the exclusion criteria that we defined, we had to narrow it down to again around 30 vendors, which you will see soon in this report, which should be live already, I guess, on the Google website. Yeah. And so it's a continuous process. Soon we will be also launching the access governance report, which will be also a subset of the IGA report. And then we will also focus a bit more around a new type of IGA report. So it's still in the progress.
We still haven't finalized the name yet, but we are planning to definitely publish it by the end of this year. It will be a different kind of customer and market segment that we'll try to address in this different report. That sounds interesting and really forward-looking and really also covering the market as it evolves. But for now, if you as the audience are interested in learning more about the state of IGA per today and per the research that Nitish just has completed, please head over to our website and find the Leadership Compass Identity Governance and Administration.
It's been published on day one of EIC. If I remember correctly, EIC is over, but the topic still remains with us. And IGA as being one of the key foundation set of building blocks for our identity fabric. I think that is a key element that every organization should be aware of what's happening in there. Even if you have chosen a solution, where is your vendor heading? What does change? I think that's really of importance.
And if you have any questions towards Nitish, towards the topic of IGA or just around this podcast episode, please leave your comments on YouTube in the comment section, reach out to Nitish or to myself. We are easy to find and the email address is really not well hidden. So you can reach out to us and we are happy and glad to reply, to share our information if it has not been covered in this podcast, or if you can't find it in the Leadership Compass, don't think so, but if there are any additional questions, please reach out to us.
So Nitish, before we close down, any final observation that you had that really struck you when you looked at this large market segment, what was the most unexpected evolution in IGA that you came across? Yes, definitely. I think something which struck me was just the sheer size growth in the IGA market, but the number of vendors that we are covering, I think that clearly demonstrates the IGA market is growing.
And what was struck me as well is that several of these vendors were really newcomers and they were really focused a bit more on the core capabilities of IGA, which is really, really good. We had to first address the basics and they were doing that. But it will be interesting to see how these, you can say, emerging vendors now progress in the next one year, two years, and how they expand on the capabilities, so I'm looking forward to that side of segment as well.
But for all the IGA market, definitely it's a constant evolution and it might appear mature, as I said earlier, but it's definitely evolving into the right direction. Perfect. Thank you very much. First of all, for your research, then of course, for being here and being my guest today and talking about your research, this is really one of the key markets and I think it's interesting for almost any of our listeners because IGA is a must somehow. So this is really an interesting market. So thank you, Mitesh, for being my guest today.
Looking forward to talk about this new evolution also of the leadership compass by the end of the year. And until then, thank you very much and looking forward to having you soon as a guest in this podcast. Perfect.
Thank you, Mitesh. I look forward to our next session as well. Thank you very much. And yeah. Thank you. See you. Bye bye. Bye.
