What's the single most important question to ask an IVIP vendor?

What does your coverage percentage exclude. Every vendor will state what they discover; far fewer will volunteer what they miss. The answer to the second question is what determines whether the first number is meaningful.

How is an IVIP evaluation different from evaluating IGA or PAM?

IGA and PAM evaluations focus on workflow coverage — which applications connect, which lifecycle events are automated. An IVIP evaluation is a data-quality evaluation: how complete, current, and accurate is the underlying inventory, independent of any workflow built on top of it.

Should I run a proof of concept before buying?

Yes, and specifically ask to run it against a set of identities you already know about that are hard to find — an orphaned service account, a local admin account created outside a change ticket, an AI agent session. A demo environment with curated data won't surface these; a proof of concept against your real estate will.

Do I need the write path, or is discovery-only enough?

It depends on your team's operational capacity. Discovery-only tools still require someone to manually close every gap they find, in whichever tool owns that identity. If your team is already stretched, a write path that closes gaps automatically compounds in value the longer you run the platform.

Buyer's Guide

IVIP Buyer's Guide

Every vendor in this category will claim "visibility." Few will survive being asked what that word actually covers. Here's the evaluation framework and a copy-paste-able question set for your next RFP.

What to Evaluate Before You Buy

"Visibility" is the easiest word in identity security to claim and the hardest to verify from a demo. A vendor can show a clean dashboard built on a curated dataset in a sales environment and still leave 30% of your actual estate undiscovered in production. The gap between a demo and a deployment is almost always coverage — what the platform can see, how current that view stays, and what happens after it finds something wrong.

This guide breaks the evaluation into five dimensions that matter more than any single feature checkbox: discovery coverage, data freshness, correlation and graph depth, the write path back into enforcement, and time-to-value. Use the question set below directly in an RFP, or as a structured list for reference-customer calls — the answers that matter are specific, not directional.

The Trap: A Coverage Percentage Without a Defined Denominator

Every vendor in this category will quote a coverage number. Almost none will volunteer what it's a percentage of. "98% identity coverage" measured against the accounts a connector already knows about is a different claim than 98% measured against every credential-bearing entity in the environment — and only one of those numbers is useful for a security decision.

Ask for the denominator before trusting the numerator. A vendor that can answer precisely — down to how local accounts, orphaned service accounts, and AI agent sessions are counted — is describing a real measurement. A vendor that answers in generalities is describing a marketing slide.

The Trap

A coverage percentage means nothing without a defined denominator. Ask what the number excludes before you ask what it includes.

RFP Question Set

Grouped by evaluation dimension. Copy directly into an RFP or use as a structured script for vendor demos and reference calls.

Discovery Coverage

What identity types does the platform discover out of the box — human accounts, service accounts, API keys, local admin accounts, AI agent sessions?
How does the platform discover identities that were never provisioned through a standard onboarding workflow?
What is explicitly out of scope, and what is your customers' typical workaround for it?
Can you provide a reference customer willing to discuss their actual measured coverage percentage and how it was calculated?

Data Freshness & Continuity

Is discovery continuous, or does it run on a scheduled scan cycle? What is that cycle, specifically?
How quickly does a newly created identity — including a short-lived AI agent session — appear in the platform after it's created?
What happens to data accuracy between scan cycles for identities that changed permissions or were deprovisioned in that window?

Correlation & Graph Depth

How does the platform reconcile the same identity as it appears differently across systems — same person, different usernames or IDs?
Can the platform represent and query multi-hop access paths (identity → group → role → resource), or only direct assignments?
How does the platform handle inherited privilege — an AI agent or automation running under a service account's permissions?

Write Path & Remediation

Can the platform take action directly in the systems of enforcement (PAM, IGA, the IdP), or does every finding require a human to manually remediate in a separate tool?
What specific actions can be automated versus what always requires a ticket or manual review?
How is a false positive handled, and what is the audit trail for an automated action?

Integration & Time-to-Value

How long does it take to onboard a new data source — a cloud provider, SaaS application, or on-prem directory — after contract signature?
Does onboarding a new source require professional services, or can your own team configure it?
What is the typical time from kickoff to a first complete, validated identity inventory?

Frequently Asked Questions

See the Identity System of Record in Action

Hydden discovers, reconciles, and continuously governs every identity — human, machine, and agentic — across your enterprise.

IVIP Buyer's Guide

What to Evaluate Before You Buy

The Trap: A Coverage Percentage Without a Defined Denominator

RFP Question Set

Discovery Coverage

Data Freshness & Continuity

Correlation & Graph Depth

Write Path & Remediation

Integration & Time-to-Value

Frequently Asked Questions

Related Reading

What Is an IVIP?

IVIP vs. IGA

IVIP vs. ISPM

IVIP vs. ITDR

See the Identity System of Record in Action