Enterprise Identity and Access Management (IAM) is facing a fragmentation crisis. With identities spread across thousands of applications, machine accounts, and autonomous systems, nearly 46% of identity activity occurs outside centralized IAM visibility — what Orchid Security calls Identity Dark Matter. This unseen layer includes unmanaged apps, local accounts, opaque authentication flows, and over-permissioned non-human identities, creating a dangerous gap between perceived and actual access.
The IVIP Model
Gartner has introduced the Identity Visibility and Intelligence Platform (IVIP) as a new category within the Identity Fabric framework. Positioned at Layer 5: Visibility and Observability, IVIPs provide oversight beyond traditional IAM and governance tools.
Key differences between IAM/IGA vs. IVIP:
- Scope: IAM covers integrated apps; IVIP covers managed, unmanaged, and disconnected systems.
- Data sources: IAM relies on attestations; IVIP uses runtime telemetry.
- Analysis: IAM infers from static configs; IVIP continuously discovers and proves with evidence.
- Intelligence: IAM uses rules; IVIP leverages LLM-powered intent discovery and behavior analysis.
What IVIP Must Deliver
A credible IVIP must act as an active intelligence engine, not just another repository. Core functions include:
- Continuous discovery: Human and non-human identities across all systems.
- Data unification: Consolidating fragmented identity data into a coherent evidence layer.
- Intelligence: Using analytics and AI to convert telemetry into actionable insights.
- Automated remediation: Correcting posture gaps directly across IAM stacks.
- Real-time signal sharing: Triggering immediate security actions via CAEP standards.
- Intent-based intelligence: Interpreting the purpose behind identity activity to separate normal from risky behavior.
Orchid Security’s IVIP Approach
Orchid operationalizes IVIP by focusing on application-level visibility:
- Visibility: Binary analysis and dynamic instrumentation to discover unmanaged apps, shadow IT, and hidden identities.
- Data unification: Proprietary telemetry combined with IAM logs to reconcile policy vs. reality.
- Intelligence: Evidence-driven audits revealing risks such as:
- 85% of apps with legacy/external accounts.
- 70% with excessive privileges.
- 40–60% orphaned accounts in legacy environments.
Extending IVIP to AI Agents
Autonomous AI agents introduce new identity risks. Orchid’s Guardian Agent applies Zero Trust principles to AI-driven activity:
- Human-to-agent attribution.
- Full activity audit chains.
- Context-aware guardrails.
- Just-in-time least privilege.
- Automated remediation.
Measuring Success
CISOs must pivot to Outcome-Driven Metrics (ODMs):
- Example: Reduce dormant entitlements from 70% to 10% in one quarter.
- Protection-Level Agreements (PLAs): Mandate revocation of critical access within 24 hours of a leaver.
- Business ROI: Shrink audit prep from months to minutes with automated compliance evidence.
Final Thought
Unified visibility is no longer optional — it is the essential control plane. IVIPs transform identity observability into identity control, shrinking the IAM attack surface and governing the dark matter where attackers hide.
Leave a Reply