Who can access what, should they, and can you prove it?

The problem IGA solves has a nickname: "access creep" (rights piling up). Picture an employee who's been at the company 10 years — started in sales, moved to marketing, then ran projects. Every time they moved, they got a new set of keys — but almost no one ever took back the old set. In the end, their key ring swells with the rights of every role they've ever held, not just the current one. This is the most dangerous hole, because if their account is hacked, the attacker gets the whole ring too.

Worse still is the orphaned account — the account of someone who's left that no one closed. In reality, "cutting access the moment someone leaves" is harder than it sounds, because the rights are scattered across dozens of systems. Verizon's 2025 report found that about 22% of data breaches involved insiders, part of it from delayed offboarding. And Ponemon estimates that insider threats cost an organization an average of ~$16.2 million a year.

But the biggest force driving this market isn't just security — it's law and auditing. Public companies in the U.S. must pass SOX (Sarbanes-Oxley), which requires them to prove who can access financial systems, to separate duties (so one person can't both create and approve a payment), and to keep complete records. If they can't, a company may be flagged as having a "material weakness" in internal controls — and the stock usually drops 2–5% the moment it's announced. In the past year, about 64% of material weaknesses disclosed came from "people and weak access controls." So IGA is a tool that automatically produces "audit-ready evidence."

ภาพประกอบ (access-creep.webp)

This is why IGA is a "must-have," not a "nice-to-have" — every public company, every bank, every hospital (HIPAA), every company that takes credit cards (PCI DSS) is pushed by law to prove its access controls. So this market grows on "the practical necessity of compliance," not just fear of cyberattacks.

The heart of how IGA works is watching over the "identity lifecycle" at work, which boils down to three beats called joiner – mover – leaver — people who join, people who move roles, people who leave — with one key checkpoint in between, access certification, which reviews whether the keys in everyone's hands should "still be there."

What makes this system powerful is that it's tied to the HR system as the source — when HR records a new hire, IGA automatically sets up a bundle of rights by "role" in minutes (instead of waiting weeks for IT to open one system at a time). And when HR records a departure, every right is cut in a single beat, leaving no orphaned account. Meanwhile, access certification forces every department's managers to sit down periodically (say, every quarter) and review which keys each of their people should still hold. What the system quietly keeps at every step is the audit trail — a record of who granted access to whom, when, who approved it, who reviewed it. That's exactly the "audit-ready evidence" the law requires.

IGA is the "governance layer" of identity. It doesn't work alone — it's the piece that makes IAM whole. Let's look at how it connects to its neighbors.

• Paired with Workforce IAM (SSO/MFA): SSO/MFA proves "you are you" at login, while IGA answers the next question — "what should you be able to access?" A verified identity still needs someone to govern its rights, or you just log in and walk anywhere you like
• Complementing PAM (privileged accounts): PAM guards the admin's most dangerous master keys, IGA guards the keys of "everyone across the organization" — together they cover both ordinary and special users. That's why many big players try to sell both on one platform
• The foundation of zero trust: for the principle "trust no one automatically, verify every access" to hold, the system has to know first who should access what — which is the rights database IGA maintains. Without IGA setting "what should really be," zero trust has nothing to check against
• Accelerated by Cloud & Digital Infrastructure and AI: the more an organization moves to the cloud and uses hundreds of SaaS apps, the more the number of "keys" explodes — and AI is creating vast numbers of new "machine identities" that also need governing. IGA's demand grows with this complexity

The IGA market today is worth about $8.4–9.3 billion in 2025 and is expected to reach $17–33 billion by early next decade — steady growth of about 13–15% a year, because it's driven by laws that aren't going away (every public company has to do this), not just a tech fad.

The biggest story in this space lately is the return of the market leader SailPoint — the company regarded as the "pioneer" of IGA for large enterprises. It was taken private by Thoma Bravo (a private equity fund) in 2022 for $6.9 billion, then brought back to the stock market in early 2025 at a valuation of about $12.8 billion, raising $1.38 billion. In its filing, the company revealed ARR of about $813 million, growing ~30% a year, with net retention of 114% (existing customers spend more every year) — a sign that the dull-looking IGA is actually a business where money flows in steadily.

The key challenger is Saviynt, which just raised $700 million in a Series B in late 2025 at a valuation of about $3 billion to accelerate AI-driven IGA. Meanwhile Denmark's Omada pitches "deployed in 12 weeks" against legacy systems that drag on for years, and Okta is expanding from its SSO base to sell Identity Governance as an add-on module.

But the biggest shadow over this market is Microsoft — with Entra ID Governance sold as an add-on at about $7 per user per month, tied to the Microsoft 365 E5 package many organizations already have. So Microsoft is both a major player and a pricing pressure on every pure-play. The game becomes "the deeper, specialized player" versus "the giant that throws it in with something the customer already owns."

The first direction is AI stepping into access decisions. The classic problem with access certification is "rubber stamping" — a manager who has to review hundreds of items of a subordinate's rights tends to approve them all in one click without really looking. AI is now helping point out, "this key your report hasn't used in 6 months — should it be removed?" or "this person's rights are abnormal compared with peers in the same role" — turning the review from a meaningless ritual into a data-backed decision.

ภาพประกอบ (ai-review.webp)

The second direction is a tsunami changing the very meaning of the word "identity" — machine identity. Today it's not just "people" that need rights, but bots, scripts, API keys, and lately AI agents working on people's behalf — each one needing access to systems like any employee. The problem is they appear fast and in huge numbers. Several 2025 reports show that machine identities outnumber human ones by 45-to-1, even up to 144-to-1 depending on the organization, growing ~44% in a single year.

This is IGA's biggest new arena — because most machine identities have no clear owner. There's no HR to tell you they've "left," and there are reports that ~68% of organizations still have no access controls for AI at all. Whoever can automate the governance of machine and AI-agent identities first will be the winner of the next generation of IGA.

The first risk is Microsoft's shadow. When Entra ID Governance is sold as a cheap add-on tied to the Microsoft 365 E5 that many organizations already pay for, some customers may pick "good enough and cheaper" over paying extra to a pure-play, even if the specialized product is deeper. This pricing pressure is a direct risk to specialists' revenue — though the specialists argue that organizations with complex systems or apps outside the Microsoft world still need a dedicated platform anyway.

The second risk is deployment complexity. IGA is notorious for projects that drag on for years and budgets that balloon, because you have to connect to dozens or hundreds of legacy systems and define "who should have what right" correctly from the start. Get the foundation wrong and the system just "automates the same chaos, faster." This is why a new-generation player like Omada uses "fast deployment" as a selling point, and it's the hurdle that makes customers hesitate.

The third risk is identity sprawl and machine identity growing faster than the tools can keep up. When AI agents and machine identities multiply to 45–144 times the number of humans, governing all of it becomes an ever-harder problem — fall behind, and new holes open faster than governance can close them. And because the product is "the credibility of proof" itself, if the IGA system fails, it becomes the single point that breaks and takes the whole organization down with it.

In short: this node is the story of a question that sounds ordinary but is the hardest to answer in any digital-age organization — "who can access what, should they, and can you prove it?" — a question the law requires you to answer, where enormous economic risk hides, and which keeps getting harder now that "identity" is no longer just people.