- BFSIBanking, Financial Services & Insurance
- HealthcareComing soon
- ManufacturingComing soon
- Retail & E-CommerceComing soon
CyberArk Identity Governance
Secure the front door. Email is where most attacks arrive — CyberArk Identity Governance (Zilla) answers who has access to what — AI-powered lifecycle, fast access reviews and compliance, unified with privileged access.
Buy through TechBag
Same software. Better outcome — at no extra cost.
Free, vendor-neutral, 30 minutes
How it’s rated
Full scoreboard ↓Quick answer
CyberArk Identity Governance is CyberArk's Identity Governance and Administration (IGA) capability — enhanced by the 2025 acquisition of Zilla Security — for answering and controlling the fundamental questions every organisation must: who has access to what, should they, and can you prove it. IGA is the discipline of governing access over its whole lifecycle: provisioning the right access when someone joins or changes role, deprovisioning it when they leave (a notorious gap — orphaned accounts of departed employees are a classic breach vector), and periodically reviewing and certifying that everyone's access is still appropriate (the access reviews auditors demand for SOX, ISO, RBI and SEBI). Traditional IGA has a reputation for being slow, complex and painful; Zilla's modern, AI-powered approach makes access reviews and governance far faster and simpler, automatically discovering access across cloud and on-prem apps and using AI to right-size it. Delivered through CyberArk's Identity Security Platform — with Identity Flows for workflow automation, provisioning, lifecycle management and access-review compliance — it unifies governance with privileged access so the whole identity estate is governed together. CyberArk is now part of Palo Alto Networks. TechBag scopes, PoCs and quotes it in INR/GST.
The CyberArk platform family
This page covers Identity Governance — IGA & access reviews (Zilla). The rest of the platform:
Quick facts
30-second orientation- Product
- CyberArk Identity Governance — IGA (Zilla)
- Vendor
- CyberArk (Zilla acquired 2025 · now Palo Alto Networks)
- The questions
- Who has access to what · should they · can you prove it
- The lifecycle
- Provision · deprovision · review & certify
- The gap it closes
- Orphaned accounts, access creep, audit pain
- Zilla's edge
- Modern, AI-powered, fast access reviews
- Includes
- Identity Flows · provisioning · lifecycle · UARs
- Part of
- CyberArk Identity Security Platform
- Licensing
- Per identity / subscription
- In India via
- TechBag — quotes, PoCs, GST invoicing, Tier-1 support
Understand email security before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is IGA?
Governing who has access to what across the lifecycle — provision, deprovision, review and certify.
Modernised by Zilla’s AI-powered approach.
Unprotected inbox vs AI email security — the honest table
What consolidation actually replaces, dimension by dimension.
| Dimension | Unprotected / signature email | Identity Governance (CyberArk) |
|---|---|---|
| Who has access | Nobody really knows | Auto-discovered & mapped |
| Joiners/movers | Manual, slow, error-prone | Auto-provisioned by policy |
| Leavers | Orphaned accounts linger | Auto-deprovisioned |
| Access creep | Accumulates, never trimmed | Right-sized (AI) |
| Access reviews | Painful spreadsheet rubber-stamp | Fast, AI-assisted, meaningful |
| Audit | A scramble | An export |
| Separation of duties | Toxic combos unseen | Flagged & enforced |
| The estate | Governance & PAM siloed | Unified on one platform |
Who has access to what, should they, can you prove it — answered by AI-powered governance. Unified with CyberArk PAM.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Access Discovery
Automatically discovers who has access to what across cloud and on-prem applications — the visibility governance depends on, gathered without manual spreadsheets.
Provisioning & Lifecycle
Provisions the right access on joining or role change, and deprovisions it on leaving — closing the orphaned-account gap automatically.
Access Reviews (UAR)
Runs periodic user-access reviews so managers certify access is still appropriate — the certification auditors demand, made fast instead of painful.
AI Right-Sizing
Zilla's AI recommends right-sized access and flags anomalies — turning slow, rubber-stamp reviews into intelligent, meaningful governance.
Identity Security Platform
Delivered on CyberArk's platform with Identity Flows automation — governance unified with privileged access, the whole identity estate together.
One agent on every machine, one console over all of them — modules attach without a second operational world.
Twelve capabilities. Discover, automate, certify.
CyberArk Identity Governance answers who has access to what — AI-powered, fast reviews, part of the portfolio, and paired with the human firewall.
Access Discovery
Automatically discovers who has access to what across cloud and on-prem apps — no manual access-inventory spreadsheets.
Access-Creep Detection
Surfaces the permissions users accumulate over years and never lose — the access creep that inflates risk and fails audits.
Orphaned-Account Detection
Finds the accounts of departed employees and role-changers that were never deprovisioned — a classic, dangerous breach vector.
Automated Provisioning
Grants the right access automatically when someone joins or changes role — the right access, fast, without manual tickets.
Automated Deprovisioning
Removes access automatically when someone leaves or changes role — closing the orphaned-account gap the moment it opens.
Identity Flows
No-code workflow automation for identity processes — request, approve, provision, review, all orchestrated without custom code.
Lifecycle Management
Full joiner-mover-leaver lifecycle management — access always matches the person's current role, automatically.
AI-Powered Access Reviews
Zilla's AI right-sizes access and flags anomalies during reviews — turning slow rubber-stamping into meaningful governance.
User Access Reviews
Runs periodic access certifications so managers confirm access is still appropriate — audit-ready, and far faster than legacy IGA.
Compliance Reporting
Demonstrates who has access, why, and that it was reviewed — the evidence SOX, ISO, RBI and SEBI audits require.
Separation of Duties
Enforces separation-of-duties policies — flagging toxic access combinations that would let one person do too much.
Unified with PAM
Governance on CyberArk's platform, unified with privileged access — the whole identity estate governed together.
Watch CyberArk Identity Governance in action
The overview, getting started, and protecting M365 email.
Looking for a modern approach to identity governance?
Modern, AI-powered identity governance.
A New Identity Crisis: Governance in the AI Age
Why IGA matters as identities and AI explode.
What is Identity Security?
Where governance fits in identity security.
Want a live, India-context walkthrough on your own fleet?
Book a guided demo →The endpoint catches what arrives. Email stops it arriving.
Here’s what genuinely sets CyberArk / Zilla governance apart.
Who has access to what — and should they?
Every organisation must be able to answer three deceptively hard questions: who has access to what, should they have it, and can you prove it. Over time, access sprawls — people join, change roles, and accumulate permissions they never lose; departed employees leave behind accounts that were never removed; and nobody has a clear, current picture of who can actually reach what. This is not just untidy, it is dangerous and non-compliant: excessive access is an inflated attack surface, orphaned accounts are a classic breach vector, and you cannot demonstrate control to an auditor if you cannot even answer the questions. Identity Governance and Administration exists precisely to answer and control these questions across the whole access lifecycle, which is why it is a foundational governance discipline for any regulated or security-conscious organisation.
The joiner-mover-leaver lifecycle
Access must track people through their whole journey, and each stage has a failure mode IGA fixes. When someone joins or changes role (joiner/mover), they need the right access provisioned promptly — do it manually and it is slow and error-prone, leaving people either under-provisioned (can't work) or over-provisioned (a security risk). When someone leaves (leaver), their access must be removed immediately — and this is the notorious gap: deprovisioning is routinely missed, leaving orphaned accounts of departed employees active for months or years, a direct and well-documented breach vector. IGA automates the full joiner-mover-leaver lifecycle so access always matches a person's current status: granted correctly on arrival and change, and removed the moment they leave. Getting this lifecycle right closes some of the most common and dangerous access gaps organisations have.
Access reviews auditors actually demand
Beyond the lifecycle, governance requires periodic proof: regularly reviewing and certifying that everyone's access is still appropriate. These user access reviews (UARs) are a hard requirement in most compliance regimes — SOX, ISO 27001, and in India RBI and SEBI cyber directions all mandate that organisations periodically verify who has access to what and remove what is no longer needed. The problem is that legacy IGA made these reviews slow, complex and painful — huge spreadsheets, confused managers rubber-stamping access they do not understand, and a scramble every audit cycle. IGA done well turns this from a dreaded chore into a manageable, meaningful process: reviewers see clear, contextualised information about each person's access and can certify or revoke efficiently, and the whole thing produces the defensible audit trail regulators expect. Making access reviews fast and meaningful is central to what modern IGA delivers.
Zilla — modern, AI-powered governance
IGA's biggest historical weakness was that it was slow, complex and expensive to implement and run — a reputation that made many organisations avoid or under-invest in it. CyberArk addressed this by acquiring Zilla Security in 2025, a modern IGA vendor built specifically to make governance faster and simpler. Zilla's approach automatically discovers access across cloud and on-premises applications (rather than requiring painstaking manual integration), and uses AI to right-size access and streamline reviews — so instead of managers blindly rubber-stamping, the system surfaces what access looks anomalous or excessive and recommends corrections. In an era where identities (including non-human and AI identities) are exploding, this AI-powered, automation-first approach is what makes governance keep up. Bringing Zilla into CyberArk modernised its IGA capability, giving customers governance that is genuinely faster and more intelligent than the legacy tools that gave IGA its painful reputation.
Governance and privileged access, together
IGA is most powerful when unified with privileged access, and that is exactly what CyberArk's Identity Security Platform delivers. Historically, organisations governed ordinary access with an IGA tool and controlled privileged access with a separate PAM tool — two disciplines, two teams, and a gap between them where risk hides (for example, privileged entitlements that escape the governance reviews applied to everything else). Delivering governance on the same platform as CyberArk's privileged access, with Identity Flows workflow automation tying it together, means the entire identity estate — ordinary and privileged, human and increasingly machine — is governed under one coherent discipline: discovered, provisioned, reviewed and audited together. For organisations that already run CyberArk for PAM, adding governance on the same platform closes that gap and gives them one unified identity-security program rather than a fragmented set of tools.
The honest scope
CyberArk Identity Governance — modernised by Zilla — is a strong, AI-powered IGA, especially compelling if you run CyberArk for PAM (governance unified with privileged access on one platform) or want faster reviews than legacy tools deliver. SailPoint is the dominant standalone IGA leader with the deepest, most mature governance capabilities; Saviynt is a strong cloud-native competitor; Microsoft Entra ID Governance covers governance within the Microsoft world. CyberArk's edge is Zilla's modern, fast, AI-driven approach plus unification with privileged access. TechBag scopes CyberArk/Zilla vs SailPoint and the alternatives honestly for your governance needs.
The numbers behind the platform
What your identity-governance journey looks like
Governance scoping
Your access-review pain, your joiner-mover-leaver gaps, your compliance obligations (SOX/RBI/SEBI), and whether you run CyberArk PAM. TechBag scopes it free.
Discover & connect
Access auto-discovered across cloud and on-prem apps; orphaned accounts and access creep surfaced; the current-state picture built.
Automate & review
Joiner-mover-leaver automated via Identity Flows; AI-assisted access reviews run; separation-of-duties enforced.
Governed & provable
Access right-sized, lifecycle automated, reviews an export, governance unified with PAM. TechBag models the mix in INR/GST.
Trusted across regulated industries in 100+ countries
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Access reviews were a spreadsheet nightmare our managers rubber-stamped. Zilla's AI right-sizing made them fast and actually meaningful — reviewers see what is anomalous and revoke it. Audit went from scramble to export.”
“Orphaned accounts of departed employees were our recurring audit finding. Automated deprovisioning closed that gap the moment someone leaves. That vector is gone.”
“Automatic discovery of access across our cloud and on-prem apps meant no more manual integration marathon. Governance we could actually stand up quickly.”
“Running governance on the same CyberArk platform as our PAM means privileged entitlements get reviewed like everything else — no gap where privileged access escapes governance.”
“Identity Flows let us automate joiner-mover-leaver without custom code — the right access, fast, and removed on exit.”
“We compared SailPoint — the deepest, most mature IGA. We chose CyberArk/Zilla for the modern AI approach and PAM unification. Scope both; SailPoint leads standalone.”
“Separation-of-duties flagging caught toxic access combinations we did not know existed — one person who could both create and approve. Real risk surfaced.”
“As our identity count exploded (including machine identities), a modern AI-first governance tool was the only way to keep up. Legacy IGA would have drowned.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the email security market — tap any vendor to see why it sits where it does.
TechBag Email-Security Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Modern AI-first IGA, unified with PAM. This page's product.
Detection × Portfolio Integration
The grid nobody publishes — how strong the email detection is vs how integrated with the wider security portfolio.
Modern AI IGA + PAM unification — the corner it owns.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
CyberArk / Zilla vs the IGA field
The standalone IGA leaders and native option — honest lanes; the edge is modern AI governance unified with PAM.
| Dimension | CyberArk / Zilla | SailPoint | Saviynt | Microsoft Entra ID Governance | No IGA |
|---|---|---|---|---|---|
| Approach | Modern, AI-first, PAM-unified | The IGA leader | Cloud-native IGA | MS-world governance | The gap |
| Access reviews (speed) | Fast, AI-assisted | Powerful but complex | Modern | Good (E5) | None |
| Lifecycle & discovery | Auto-discovery | Deepest | Strong | MS-centric | None |
| Unified with PAM | Yes — one platform | Standalone IGA | Standalone IGA | MS stack | None |
| Best fit | CyberArk shops wanting modern IGA unified with PAM | Deepest standalone governance | Cloud-native IGA-first | All-Microsoft E5 estates | Nobody regulated or at scale |
Which email-security approach fits you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose CyberArk / Zilla if…
- ✓You want modern, AI-powered, fast identity governance
- ✓You run (or want) CyberArk PAM — governance unified with privileged access
- ✓Legacy-IGA pain (slow reviews, complex setup) is a concern
- ✓Closing the orphaned-account and access-creep gaps matters
Choose SailPoint if…
- ✓You want the deepest, most mature standalone IGA leader
Choose Saviynt if…
- ✓You want a strong cloud-native IGA-first platform
Choose Entra ID Governance if…
- ✓You are all-in on Microsoft E5 and want native governance
No IGA if…
- ✓Not advisable if regulated or at scale — you must govern access
What do email threats cost you?
Drag the sliders (count users; IT-hour cost as loaded incident rate). Estimates assume ~1.5 hours per user per year handling email threats that reach the inbox without AI filtering, with ~70% removed by stopping the mass at the gateway — the avoided-breach value (most attacks start here) is the larger, unpriced win. Illustrative.
Loaded cost = salary + overheads per productive hour. Illustrative only — your TechBag quote models actual device counts and modules.
Three ways to consume it
CyberArk Identity Governance prices per identity/subscription. TechBag scopes it (and unification with CyberArk PAM) for your governance needs in one GST quote.
Identity Governance
Best for access governance
- Who has access, should they, prove it
- Joiner-mover-leaver + Identity Flows
- AI-powered fast access reviews (Zilla)
+ Platform add-ons
Best for a broader rollout
- Scoped to your estate
- Add-on modules as needed
- Phased, right-sized deployment
+ Unified with PAM
Best for the whole estate
- Governance + privileged access, one platform
- No gap where privileged escapes review
- TechBag scopes the mix
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your device counts and current tools — we’ll model it against what you spend today.
The 8 questions to ask every vendor
Take this into your next vendor call — including ours.
Confirm it auto-discovers access across YOUR cloud and on-prem apps — no manual integration marathon.
Test joiner-mover-leaver automation — right access on arrival/change, removed on exit (no orphans).
Verify reviews are fast and AI-assisted (right-sizing), not painful spreadsheet rubber-stamping.
Test detection and auto-deprovisioning of departed-employee accounts — a classic breach vector.
Map reviews and reporting to YOUR obligations (SOX/ISO/RBI/SEBI) — provable governance.
Confirm SoD policy enforcement flags toxic access combinations.
Decide whether unifying governance with CyberArk PAM matters; else compare SailPoint (deepest standalone).
Right-size per identity/subscription — TechBag scopes and quotes in INR/GST.
Questions buyers ask
Ready to govern access properly?
Scope a governance PoC (discover who has access, then prove fast AI-assisted reviews and closed orphaned-account gaps), unify it with your PAM, or let a TechBag advisor plan identity governance.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.