With identity-related incidents accounting for 70 per cent of breaches (RSA), identity has long become the new security perimeter, but visibility remains its weakest point. Despite major investments in IAM, PAM, and CIEM, many organisations still struggle to answer a deceptively simple question: Who has access to what data?
At the same time, the usage of artificial intelligence (AI) is massively increasing the number of non-human identities. Every AI agent, model and API integration creates new accounts, tokens and credentials. This introduces additional attack surfaces and security gaps.
In July 2025, Gartner added Identity Visibility and Intelligence Platforms (IVIP) as a distinct category to its Hype Cycle for Digital Identity. As organisations expand into multi-cloud environments and adopt AI-powered automation, the number of human and non-human identities is growing rapidly. IVIP provides the unified visibility organisations need to securely govern these identities and their access rights.
This article examines the current identity risks, explains what IVIP means, why it is becoming increasingly important in the age of AI, and how IVIP can be applied in practice.
What Are the Current Data Security Challenges?
What do recent Studies show about Identity Risk in Organisations?
- 75 per cent of organisations in Germany experienced an identity-related security breach in the past three years, compared with 42 per cent the previous year. This highlights how central identity has become as an attack surface. (RSA ID IQ Report 2026)
- Among 92 per cent of organisations that reported a data breach involving AI models or AI applications, adequate AI access controls were missing. This highlights the existing gap in securing AI identities. (IBM Cost of a Data Breach Report 2026)
- The average cost of a data breach reached USD 4.99 million, 12 per cent higher than the previous year and a record high. A lack of access control can therefore have significant financial consequences. (IBM Cost of a Data Breach Report 2026)
Why does AI make the Identity Problems worse?
- They are created quickly and decentralised: Development teams can provision agents and integrations without going through established IAM processes.
- They have no traditional “leaver” process: Tokens are rarely revoked when a project ends.
- They are often overprivileged: To ensure that an agent “just works,” it may be granted broad read and/or write permissions.
- They act autonomously: An AI agent can access large volumes of data within seconds, meaning a compromised token can have an equally rapid impact.
Why are Traditional IAM Tools Not Enough?
Over the past decade, enterprise identity architecture has evolved into a fragmented collection of specialised tools.
- Identity Providers (IdPs) manage authentication and Single Sign-On (SSO).
- IGA solutions manage identity lifecycles and access certifications.
- PAM platforms secure privileged accounts and access.
- CIEM and secrets management tools protect cloud and API credentials.
Each tool serves a purpose, but each also creates another data silo. The result is dozens of disconnected systems that understand their own permissions but have little visibility into the rest of the environment.
Traditional IAM tools were also primarily designed around human users with clearly defined identity lifecycles. They manage processes, but do not necessarily provide continuous, cross-system context. Zero Trust, based on the principle of “never trust, always verify,” is difficult to implement if organisations cannot even see which identities exist or what they can access. Without greater visibility, AI identities risk becoming one of the biggest blind spots in data security.
What Pressure do DORA and NIS2 create?
Both regulatory frameworks make access control a requirement.
DORA (Regulation (EU) 2022/2554) requires financial entities under Article 9(4) to restrict logical access to information and ICT assets to what is necessary for legitimate and authorised functions, and to implement strong authentication mechanisms.
NIS2 (Directive (EU) 2022/2555) requires, under Article 21(2), point (i), policies on access control and, where appropriate, multi-factor authentication or continuous authentication under point (j).
Organisations that need to demonstrate compliance with these requirements need an up-to-date understanding of their identities and access rights. Fragmentation therefore becomes a regulatory risk.
How Does IVIP Address Identity Challenges?
What Is an Identity Visibility and Intelligence Platform (IVIP)? An Identity Visibility and Intelligence Platform (IVIP) is an intelligence layer that unifies identity data across an organisation’s environment. It does not replace IAM; instead, it connects and In essence, an IVIP:
- Collects identity, account, and entitlement data from multiple sources – IDPs, IGAs, PAMs, HR systems, SaaS apps, and data platforms.
- Correlates these data points into a single model linking people, service accounts, roles, and effective permissions.
- Analyses for risk: orphaned entitlements, toxic combinations, dormant privileges, or policy drift.
- Visualises the entire “who-can-do-what” map – across clouds, apps, and data stores.
- Generates audit-ready evidence to prove compliance with DORA, NIS2, and other frameworks.
Think of IVIP as the connective tissue between your existing identity systems – turning static configuration data into actionable intelligence.
Traditional IAM systems manage processes. IVIP provides context. It tells you not just who has access, but what that access actually means.
How IVIP complements the IAM Stack
The existing IAM stack already includes robust components:
- IDP → controls authentication and access policies.
- IGA → manages identity lifecycle and recertifications.
- PAM → secures privileged access.
But none of them provides continuous, contextual insight into effective permissions across systems.
That’s where IVIP adds value:
- Verification: Confirms IAM policies behave as intended in real environments.
- Correlation: Connects user accounts, service identities, and entitlements across sources.
- Context: Explains why certain access exists – and whether it still makes sense.
- Evidence: Delivers clean, defensible audit artefacts on demand.
If IAM is the nervous system of digital identity, IVIP is its sense of sight, revealing the connections that make risk and compliance visible.
What Use Cases does IVIP Address in Practice?
IVIP is particularly valuable wherever access changes continuously and no one has a complete overview. The five key use cases include:
- How Does IVIP Detect Unwanted Access Changes? IVIP continuously compares current access rights to approved policies, flagging when entitlements expand unintentionally.
- How Does IVIP Support Joiner-Mover-Leaver Processes? When employees change roles or depart, IVIP verifies that all associated accounts, tokens, and keys are updated or revoked across systems.
- How Does IVIP Improve Privileged Access Hygiene? The platform identifies dormant admin accounts, bypass paths, and toxic combinations before attackers do.
- How Does IVIP Help with M&A? Following mergers and acquisitions, IVIP maps entitlements across tenants to expose redundant or risky overlaps instantly.
- How Does IVIP Automate Audits? Instead of exporting data manually for auditors, IVIP generates complete, contextual evidence packs, reducing weeks of work to hours.
The result: Fewer blind spots, faster audits, and decisions backed by clear, defensible visibility.
How Is IVIP Evolving in the Age of AI?
As organisations adopt generative AI, the number of identities and the complexity of identity security will increase exponentially. Managing these identities manually will become increasingly impractical. IVIP provides the bridge between human oversight and AI-driven automation in identity security.
The IVIPs of tomorrow will:
- Use machine learning to predict risky privilege escalations.
- Use behavioural baselines to detect anomalous access patterns.
- Use natural language to explain identity risk to auditors and executives.
- Integrate with ITDR and ISPM platforms to support automated remediation.
The goal is not simply to see, but to understand and ultimately act.
Visibility and intelligence form the foundation for the next phase of identity security automation.
How does CyberDesk bring IVIP to Life?
CyberDesk exemplifies the core vision behind Identity Visibility and Intelligence Platforms (IVIP). It unifies identity and data intelligence into a single, adaptive layer that answers the most fundamental question in security: who can access what data, and why?
Here are some common situations:
1. Unclear Where Sensitive Data Resides and Who Can Access It
CyberDesk automatically classifies sensitive data, such as customer records or transaction data, and maps access to the respective identities. This makes it possible, for example, to identify third-party access and revoke it, when external users still have access to payment systems months after a project has ended.
2. Hidden Admin Paths and Stale Access
CyberDesk’s access graph provides a visual, live map showing how users and applications interact with sensitive data. It helps identify hidden administrative paths, toxic permission combinations, and stale access risks. For example, it can identify when a former contractor still has API access to a production backup bucket and automatically flag or isolate that access.
3. Over-privileged Access Permissions
CyberDesk monitors permissions according to the principle of least privilege and alerts on critical changes. Automated alerts identify when access exceeds defined policies, allowing high-risk access to be blocked in real time or flagged for review. For example, if a junior analyst suddenly receives write access to regulatory databases, the compliance team can be alerted immediately.
4. Time-Consuming Manual Access Reviews
CyberDesk automates access reviews for both recurring and ad-hoc certifications. Managers receive intelligent review prompts, while review decisions are securely stored for auditability. For example, all administrator accounts in cloud environments can be reviewed every 30 days, with each decision documented and traceable.
Conclusion
IAM remains a fundamental component of identity security, but on its own it is no longer sufficient to represent the growing complexity of modern IT and AI environments.
As the number of human and non-human identities, multi-cloud environments and dynamic permissions continues to grow, answering the question “Who can access which data, and why?” is becoming increasingly difficult.
This is where IVIP comes in. It does not replace existing IAM, IGA, PAM, or CIEM systems. Instead, it connects their information and creates a continuous, context-aware view of identities, permissions and data. This makes hidden access, overprivileging and compliance risks visible and traceable.
CyberDesk demonstrates how this vision can be put into practice: by combining identity intelligence and data intelligence, access graph, continuous risk monitoring and automated access reviews.
In the age of AI, the question is no longer simply who has access, but also which non-human identities are acting, what they can access and whether that access is still justified. IVIP is therefore evolving from a visibility layer into an important foundation for context-aware and increasingly automated identity security.
