Zero Standing Privilege Is Here. It's Just Not Evenly Connected.

What I heard between demos

I spent most of Navigate at our booth, running demos and talking with customers, so I caught very few keynotes. The headline still found its way to the booth: standing privilege is dead, and just-in-time access and autonomous agents are taking its place.

The reality check came from Sanjeev Shukla, Accenture's global lead for identity and trust: "I'm yet to meet one client in my entire career who has least privilege fully employed in their organization." Then he put a number on it. Some tier-one banks have spent hundreds of millions of dollars on identity and still cover only about 65% of their privileged access.

Think about who those banks are. Nobody has more identity budget or more regulators watching. If they top out at 65%, the average enterprise isn't anywhere close.

Where the rest of the access lives

The gap isn't random. Whenever the conversation at our booth turned to coverage, it landed in the same place: the applications nobody ever connected.

Think mainframes, core banking platforms, homegrown tools, and vendor apps with no API and no SCIM. IGA and PAM connectors never reach them. Access gets granted through a ticket, an app admin makes the change by hand, and once a quarter somebody reconciles a CSV extract in a spreadsheet. By our count, that's about 80% of the applications in a typical enterprise.

In a bank, these aren't low-risk apps either. Payments, wires, the core ledger. That's where the most sensitive privileged access sits, and it's often the least connected part of the estate. Your governance platform can't revoke access in an app it can't touch.

Agents raise the stakes

Almost everything shown on stage assumes the platform can reach into the app. Grant access for ten minutes, pull it back on schedule, kill an agent that misbehaves. On a disconnected app, just-in-time access turns into a ticket. The kill switch turns into a request sitting in someone's queue.

That gap was survivable at human speed. It isn't at machine speed. When an agent hits a missing permission, it goes looking for another way in, and in most banks the easiest way in is a standing account on an app nobody ever automated.

My takeaway

You can't declare standing privilege dead in apps you can't reach. Nobody is going to build connectors for the rest of the estate, and waiting for them is how a bank stays at 65% for years. The gap closes when governance can operate those apps directly.

That's the problem we started Opnova to solve, and it's why we partner with SailPoint. So here's the question I'd put to any identity team before next year's budget: what share of your privileged access sits in apps your IGA and PAM platform can actually touch? If you don't know, that's your gap.