The account nobody disabled

An employee leaves on Friday. Their access through the identity provider is revoked. Inside one business application, though, their local account is still active, and local sign-in still accepts their credentials. Removing that access requires someone to open the application, find the account, disable it, and check the result.

The company has an off-boarding policy. It has an identity platform. It may even have an approved request to remove the account. Until someone completes the work inside that application, the former employee still has a way in.

Gartner's September report, Innovation Insight: IVIP and IAM Augmentation Vendors Are Disrupting Light IGA, groups a long list of vendors into a bucket it calls IGA augmentation. Full disclosure, Redblock is in that pile. I'll take it. Messy is usually where the work is.

Here's how Gartner describes the bucket: [1]

“These vendors provide visibility into the IAM ecosystem and, in some cases, expose gaps to historically disconnected assets.”

Coverage is still unfinished business

In a 2025 study, Enterprise Strategy Group, now part of Omdia, found that respondents reported adequate IGA integration for an average of 54% of their applications. That leaves 46% not adequately integrated with IGA. [2]

That gap has practical consequences. An application may hold sensitive information, allow local administrators, and retain accounts belonging to people who have left. If checking those accounts depends on an administrator exporting a spreadsheet, the identity team has to arrange that work every time it needs a current answer.

Even an application connected to SSO can require further inspection. SSO can control one route into the application while independent local accounts and application-specific privileges remain outside that control. Knowing an application exists tells you very little about whether everyone inside it should still be there.

Gartner also makes the application coverage question explicit:

“Businesses with legacy or custom-built applications must carefully assess whether light IGA vendors can support these environments, especially on-premises applications.”

There are real reasons coverage stalls. None of them make the app less sensitive.

I worry about the habit this creates. Applications that are easy to connect can get regular attention while difficult ones wait for a project, a budget, or an available administrator. We should be choosing what to inspect based on the access and information at stake. Convenience is quietly deciding your coverage.

Manual work becomes a permanent dependency

The same ESG study found that 39% of surveyed organizations had mostly or entirely manual IGA processes: 15% were minimally automated and 24% were fully manual. [2]

Consider what that means for an access review. Someone exports accounts. Someone reconciles identities. A manager decides that a privilege should be removed. The decision goes back to an administrator, who has to find time to make the change.

Every new application adds another place where this work must happen. Every departure or role change creates another reason to do it again. A quarterly review can tell the organization what access looked like when the data was collected. It leaves a separate question: what access exists now?

Finding an exposure starts the clock

Verizon's 2026 Data Breach Investigations Report offers an example of how long known problems can persist. In third-party cloud environments studied by a research partner, resolving half of the observed weak-password and excessive-permission findings took almost eight months. Half of the MFA findings were resolved in roughly a month. [3]

An unnecessary administrator account continues to carry its privileges while a ticket waits. A revocation approved during a review still needs to take effect in the application. The time between identifying the problem and confirming its correction belongs in any serious discussion of identity risk.

Taking the work into the application

We built Redblock around the work an administrator would otherwise have to do inside applications. Its AI agents use application interfaces to inspect accounts and privileges and carry out approved changes, including where APIs are missing, incomplete, or unreliable. [4]

Return to the employee who left on Friday. Redblock can inspect the application and find the local account. It compares what is there with the organization's identity context and policies. Where removal is required, the correction follows the organization's approval process. The agent disables the account inside the application, checks that the change took effect, and records the evidence. [5]

Most of that bucket shows you the gap. We close it, inside the app, and prove it. Existing identity systems keep policy and approval authority. Redblock brings application data into those systems and executes the decisions they authorize. [4]

The work is specific: retrieve the accounts needed for a review, investigate access that no longer matches policy, remove an approved entitlement, or disable an orphan account. Each task has an observable result inside the application.

Using an AI agent makes that last requirement especially important. A reported success should be backed by the application's actual state. Security teams need to distinguish completed changes from failed or unfinished work, without having to repeat every task themselves to find out.

In our published healthcare case study, a large US organization went from manual exports and IT tickets to approved fixes landing inside its applications, in a four-week proof of value. [6]

This is what progress should look like for the people running identity programs: more of the application estate can be inspected, and less approved work waits for someone to perform it manually.

When evaluating the next addition to an identity stack, I would start with an application the team has struggled to govern. Ask the vendor to show who has access, identify what needs attention, carry out an approved correction, and demonstrate the result. That test makes coverage and execution tangible.

The app that's waited three years for a connector still needs its access checked today.

Sources

1. Gartner, Innovation Insight: IVIP and IAM Augmentation Vendors Are Disrupting Light IGA, Brian Guthrie and Rebecca Archambault, 11 September 2026, G00847027, pp. 3, 7 and 11.

2. Enterprise Strategy Group, Identity Security at a Crossroads: Balancing Stability, Agility, and Security, Todd Thiemann, July 2025, pp. 12 to 13. Commissioned by Teleport; overall survey of 370 US and Canadian IT and cybersecurity professionals, conducted May 5 to 23,2025. Individual IGA question bases are not stated.

3. Verizon 2026 Data Breach Investigations Report, pp. 21 to 22, Figures 20 to 21.

4. Redblock product overview.

5. Redblock Identity Exposure Management.

6. Redblock healthcare case study.

‍