Does my IGA platform already do what an IVIP does?

Only for the identities it already knows about. IGA runs workflows against identities that were provisioned into it through a connector or onboarding process. An IVIP continuously discovers identities regardless of whether they were ever provisioned — including the 20-40% of enterprise identities that typically never pass through IGA at all.

If my IGA vendor added a dashboard, is that the same as an IVIP?

No. A dashboard built on top of an IGA platform's existing connectors still only shows what those connectors already captured. An IVIP's value is discovering the identities that were never in that inventory in the first place — a dashboard on top of a partial inventory is still a partial inventory.

Will an IVIP replace our IGA platform?

No, and that isn't the goal. An IVIP feeds an IGA platform accurate, continuous, complete identity data so its certification campaigns, access requests, and lifecycle workflows run against reality instead of a stale or partial snapshot.

Why do multi-year IGA deployments still leave visibility gaps?

Because IGA is architected to manage identities it's told about, not to go find the ones no one registered. Gartner's own rationale for creating the IVIP category was that organizations with mature IGA, PAM, and AM programs still can't achieve a single pane of glass at a sustainable cost, even after years of investment.

IVIP Comparison

IVIP vs. IGA

IGA vendors are increasingly claiming IVIP-style visibility, and buyers are genuinely confused about whether their existing IGA "already does this." Here's the honest answer — where IGA's workflow engine ends and the data layer underneath it begins.

Two Different Layers of the Identity Stack

Identity Governance and Administration (IGA) is a workflow engine. It runs joiner-mover-leaver lifecycle automation, access requests, and certification campaigns — the operational scaffolding that manages the lifecycle of identities once they've been provisioned into it.

IGA's most common failure mode isn't the workflow engine — it's the data underneath it. Access certifications get rubber-stamped against stale data. Connectors break silently. Somewhere between 20 and 40 percent of enterprise identities — local accounts, legacy systems, service accounts, and now AI agents — never pass through IGA at all. Multi-year IGA deployments underdeliver for exactly this reason: Gartner's own framing for the IVIP category was that organizations with mature IGA, PAM, and AM programs still can't reach a single pane of glass at sustainable cost after years of investment.

An IVIP is the data layer IGA was always missing. It makes a certification campaign a review of reality instead of a review of whatever a connector last managed to sync.

IVIP vs. IGA, Side by Side

Neither tool is being replaced by the other — they answer different questions. The comparison only gets confusing when an IGA platform starts marketing a dashboard as visibility.

Dimension	IVIP	IGA
Primary job	Continuously discover, normalize, and correlate every identity across the estate.	Run lifecycle workflows — provisioning, access requests, certification campaigns — for identities already known to it.
What it sees	Every identity, including the ones no one provisioned: local accounts, orphaned service accounts, shadow admins, AI agent credentials.	Only the identities onboarded to it through a connector or provisioning workflow.
Data freshness	Continuous — re-discovers the estate as it changes.	As current as the last successful connector sync; access reviews run against whatever that snapshot captured.
Known failure mode	None inherent — the category exists specifically to close this gap.	Certifications rubber-stamped against stale or partial data; connectors that fail silently; the 20-40% of identities that never enter the system at all.
Relationship to Hydden	What Hydden is — the authoritative identity data layer, with a write path.	What Hydden feeds — making every IGA workflow run against a complete, current inventory.

The Trap: A Dashboard Isn't an IVIP

IGA vendors are increasingly adding dashboards and analytics on top of their existing workflow engine and marketing them as visibility. It's worth knowing what that dashboard can and can't see before treating it as a fix.

A dashboard bolted onto a workflow engine inherits the same partial inventory the workflow engine already had. If an identity was never provisioned into the IGA in the first place — the 20-40% gap above — no amount of dashboarding on top of that system makes it visible. Visibility built on a partial inventory is still a partial inventory, just with a nicer chart.

The Trap

An IGA vendor adding a dashboard is not an IVIP. Visibility bolted onto a workflow engine only sees what the workflow engine already sees.

Do You Need an IVIP If You Already Have IGA?

Short answer: yes — but not as a replacement.

You need an IVIP if...

Access reviews get rubber-stamped because reviewers are certifying whatever the last connector sync captured, not what's actually true today.
You can't say with confidence what percentage of your identities — local accounts, service accounts, AI agents — never pass through IGA at all.
A connector broke silently and nobody found out until an audit did.
Onboarding a new application to IGA takes months, so most of your estate sits outside its coverage in the meantime.

Your IGA is still doing its job if...

You need structured access-request workflows and approval chains for identities that are already provisioned.
Certification campaigns are running on a defined cadence against known applications.
Joiner-mover-leaver automation is correctly triggering for your HR-sourced identities.

Hydden's position is not IGA replacement — it's making the IGA investment finally deliver on what it was scoped to do in the first place. This is the same partner-not-rip-out motion that matters most in Saviynt and other IGA-adjacent conversations: Hydden doesn't ask a customer to abandon a multi-year IGA investment, it makes that investment work the way it was supposed to from day one.

Frequently Asked Questions

See the Identity System of Record in Action

Hydden discovers, reconciles, and continuously governs every identity — human, machine, and agentic — across your enterprise.

IVIP vs. IGA

Two Different Layers of the Identity Stack

IVIP vs. IGA, Side by Side

The Trap: A Dashboard Isn't an IVIP

Do You Need an IVIP If You Already Have IGA?

You need an IVIP if...

Your IGA is still doing its job if...

Frequently Asked Questions

Related Reading

What Is an IVIP?

IGA Acceleration

IVIP vs. ISPM

IVIP vs. ITDR

See the Identity System of Record in Action