Governing the Identity Patchwork: What IVIP Has to Deliver
3 Nov 2026
Gartner’s Hype Cycle for Digital Identity 2025 named a category for the first time. Identity Visibility and Intelligence Platforms, IVIP for short, have been debated across the identity community ever since, and the discussion moved quickly past the acronym toward the question of whether this describes a genuine product class or puts a label on work that vendors have been doing for years under other names.
The same document defines the category as products that deliver rapid integration and visibility for IAM-relevant data, usually combined with advanced and often AI-enabled analytics. What such a product is meant to produce is a single view of IAM data, events, relationships, configuration and posture, and from that view the remaining IAM controls can be improved without a separate data-gathering exercise for each one.
Fragmented stacks hide where identity risk actually sits
Identity and access management stacks have grown difficult to hold in one’s head. A CISO in a large enterprise operates roughly 83 separate cybersecurity tools, a figure reported in Capturing the cybersecurity dividend, a study by the IBM Institute for Business Value with Palo Alto Networks. Few of those tools are integrated in any meaningful sense. What follows is fragmented visibility of identity data, and worse, no dependable intelligence about which systems are actually covered and where the remaining risk sits.
Take identity governance and administration alongside privileged access management. Both are mature disciplines with two decades of tooling behind them. Yet a great many organizations still cannot answer the question an auditor asks first. Who is allowed to do what? Role names and technical entitlements rarely tell a business user anything useful, which turns access assignments and recertification campaigns into rubber-stamping exercises. Privileged accounts sharpen the problem. Regulated firms have to demonstrate segregation of duties, and in practice IGA and PAM often run side by side without genuine integration, one covering the workforce while the other covers administrators. Conflicts spanning both worlds stay invisible.
An example from HR shows how this plays out. One system manages business roles; another manages administrative accounts. On paper the separation holds. Without a joined-up view, overlaps remain hidden, and a user can hold an HR administrator role in one system while carrying conflicting HR business entitlements in the other. The systems remain separate in technical terms, while the same person ends up able to define the rules for sensitive data and to manipulate it. Only end-to-end integration brings a violation of that kind to the surface.
Every identity fabric in production is assembled from overlapping products
The identity fabric model answers a different question than a product catalog does. Rather than naming tools, it describes which capabilities a modern IAM environment has to provide, and that makes it usable as a target picture for an environment already in operation. Hardly any organization starts from nothing, so the practical worth of the model lies in mapping what already runs against the capabilities it sets out. Every capability in that model then has to be delivered by an actual service or product, which is where the model meets procurement reality. Products overlap or leave gaps, and they rarely cut along the same lines the model draws, so enterprises end up with a patchwork stitched together to approximate the target picture.
IVIP addresses exactly that gap. The concept describes a layer reaching across every kind of identity and every type of IAM, producing one governance view of the whole. Insight on its own would be too little. Optimization and remediation are what change outcomes, whether that means cleaning up entitlement structures or giving a business user a recommendation they can act on. The furthest version of this is identity security posture management, where the system corrects deviations from a learned baseline on its own.
Some analysts argue that a visibility layer is no substitute for designing and implementing an identity fabric properly. They are right about that. It remains a pragmatic way to close the distance between a real deployment and the ideal one. Others ask whether the category risks entrenching today’s fragmentation rather than resolving it. Fragmentation, though, has always been a feature of enterprise IT. Complexity has grown steadily for twenty years, and technology arrives faster than enterprise products can absorb it, with agentic AI the latest demonstration. The patchwork is the starting condition for any realistic governance design, and nothing suggests a perfectly integrated fabric will be assembled from single standard products any time soon. What deserves argument is how to govern it while security and business outcomes improve.
The platform label depends on the individual product
So is IVIP a platform? That depends on the product in front of you. At heart the category is a sum of capabilities that can be realized in different ways with different tools. Where one product covers enough ground, the platform label is fair enough, and where several cover it together the outcome can be the same. The label is the least interesting part of the discussion.
What a governance layer has to be able to do
If the category is defined by capability rather than by packaging, those capabilities are worth naming. Authorizations belong in scope at every level, from policies and roles down to individual entitlements, and across system boundaries, which means IGA environments as well as the privileged access and non-human identity systems that sit beside them. Posture management reaching into access management products makes least privilege practical, since authorizations nobody uses can be identified and withdrawn instead of accumulating quietly for years.
Analytical capability is the second half. Machine learning trained on feedback from the people who actually approve access can simulate and design better policy and role models, and a visual representation of complex authorization structures tells a reviewer more than another spreadsheet export. Reasoning that a human can follow matters as much as the recommendation itself. A business user who understands why access should be granted or denied decides better the next time, and an auditor will ask for the reasoning in any case. Regulation makes the point concrete. Article 9(4)(c) of the Digital Operational Resilience Act, Regulation (EU) 2022/2554, requires financial entities to “implement policies that limit the physical or logical access to information assets and ICT assets to what is required for legitimate and approved functions and activities only”. Demonstrating that such a policy holds means producing an authorization concept for every system under IAM management, service accounts included, which presupposes visibility reaching that far. Documentation assembled from a live view of entitlements can be produced on the day a supervisor asks for it, rather than reconstructed once a year for the file.
The gap this close is a specific one. An organization that can list the authorization conflicts spanning its IGA and PAM systems, and evidence that list at short notice, has gained something its previous stack could not deliver. Whether that gain shows up in governance decisions depends on whether anyone outside the IAM team acts on what the layer surfaces, and that part is not a procurement question.
See what unified identity visibility looks like in practice
Discover how the NEXIS Platform connects identity data across IGA, PAM, and other IAM systems to uncover hidden access risks, strengthen governance, and turn fragmented information into actionable intelligence.