- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Gurucul Identity Analytics
Not who has access — which access is dangerous. Gurucul Identity Analytics scores entitlements and access patterns for risk, surfacing excess privilege, dormant high-risk access and the permissions that accumulate across a decade of role changes and never get removed.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — answered by definition
Where data lives
Yours, if you self-host
Gartner’s own 2025 MQ text confirms the platform runs SaaS, cloud OR self-hosted. Self-hosted puts collection scope and physical storage under your control — on-premises or your own cloud account, in India if you choose — which is how you hold 180 days of logs in Indian jurisdiction and evidence it.
Two things we could NOT verify
Air-gap, and any India region
A genuine air gap is marketed but we could not confirm it independently, and self-hosted is not the same thing — air-gap affects licence activation, threat-intel updates and support access. We also found no evidence of a vendor-run India data region. Get both in writing before you commit.
Be precise about which obligation binds you, because the strict reading is routinely oversold — including by vendors selling on-premises platforms, so weigh our incentive too. CERT-In’s April 2022 Directions require a rolling 180 days of ICT logs “within the Indian jurisdiction”, but CERT-In’s own May 2022 FAQ (Q35) permits storage outside India provided logs stay producible in reasonable time — the hard in-India duty attaching to financial-transaction records. Where it becomes unambiguous is sectoral: IRDAI’s 2023 audit annexure asks, as a yes/no an insurer must answer affirmatively, whether ICT infrastructure logs are stored in India. If that is you, self-hosting stops being a preference. Note too that people in India and data in India are different things — the Pune engineering centre is real, and it is not a data region.
Quick answer
The Gurucul platform family
This page covers Gurucul Identity Analytics — the access-risk analytics. The other pillars:
Quick facts
30-second orientation- Product
- Gurucul Identity Analytics (IdA) — on the REVEAL platform
- Vendor
- Gurucul — founder-CEO Saryu Nayyar, still in post
- The question it answers
- Which access is DANGEROUS, not merely which exists
- Finds
- Excess privilege · dormant high-risk access · accumulated permissions
- India relevance
- RBI and SEBI access-review evidence; SEBI CSCRF material published
- Shares
- One identity model with the SIEM and UEBA
- Deployment
- Follows the platform: SaaS, cloud or self-hosted
- Data residency
- Yours if self-hosted; no vendor India region found
- Data processing
- Same platform — access risk and detection reason over one model
- What it is NOT
- Not IGA — it does not provision accounts or run JML workflow
- Buy in India via
- TechBag — INR, GST, scoped against your IGA if you have one
Understand SIEM economics before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Scoring entitlements and access patterns for risk rather than cataloguing them — excess privilege, dormant high-risk access, and permissions accumulated across years of role changes.
Tick-box access reviews vs Gurucul Identity Analytics — the honest table
What risk-scoring entitlements changes about access governance.
| Dimension | Spreadsheet access review | Identity Analytics |
|---|---|---|
| Question asked | Who has access? | Which access is risky? |
| Reviewer’s view | Hundreds of cryptic entitlement names | Risk-ranked items with usage beside them |
| Dormant access | Re-approved every quarter | Flagged for removal |
| Accumulated privilege | Invisible across role changes | Surfaced as access outliers |
| Orphaned accounts | Found at audit | Detected and scored continuously |
| Detection link | None | Shares an identity model with UEBA and SIEM |
| Honest caveat | — | Analytics, not IGA — no provisioning |
| Best fit | — | BFSI teams evidencing access reviews |
Risk-scored access is the edge — for provisioning and joiner-mover-leaver workflow you still need an IGA platform (TechBag sells those too).
The six pieces behind Gurucul Identity Analytics
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Identity & access ingestion
Pulls accounts, groups, roles and entitlements from directories, IAM and business applications, alongside the activity showing whether each entitlement is actually used.
Access metadata
Normalises entitlements across systems into one model per identity, so a person’s access in the core banking app, the directory and the cloud console is judged together.
Access outlier analytics
Machine learning compares each identity’s access with peers in similar roles and flags outliers — entitlements nobody else in that job holds, which are usually leftovers.
Risk scoring
Gurucul applies anomaly detection and predictive risk scoring to accounts and entitlements, so excess, dormant and orphaned access is ranked rather than merely listed.
Privileged access discovery
Discovery surfaces privileged accounts and rights sitting outside a PAM vault — what Gurucul describes as closing privileged-access blind spots.
Review & IAM loop
Risk context feeds access reviews and, through closed-loop IAM integration, the governance tool that removes access. It informs IGA rather than replacing its workflow.
Entitlements and their actual use, scored for risk — so reviewers decide on evidence and dormant access gets removed.
Ten capabilities. Discover, score, clean up.
Gurucul Identity Analytics pulls accounts and entitlements from your directories and applications, compares them with how they are actually used, and scores the risk. Here is what sits in each layer.
Account and entitlement discovery
Inventories accounts, roles and entitlements across directories and applications.
Access-usage correlation
Pairs each entitlement with whether, and how, it is actually used.
Privileged access discovery
Finds admin rights and privileged accounts that sit outside the vault.
Access outlier detection
Flags entitlements that no peer in the same role holds.
Dormant high-risk access
Surfaces powerful access unused for months — the easiest risk to remove.
Orphaned accounts
Finds accounts whose owner has left, or never existed in HR records.
Excess privilege
Measures access beyond what the role needs, accumulated across moves.
Predictive risk scores
Ranks identities and entitlements by likelihood of misuse.
Risk-based access reviews
Reviewers see risk and usage, not cryptic entitlement codes.
Closed-loop IAM
Findings pushed to the governance tool that actually revokes access.
Watch the platform behind Gurucul Identity Analytics
The REVEAL platform identity analytics runs on, and Gurucul’s analyst-assist layer.
Gurucul REVEAL — Platform Overview
Where identity analytics sits.
Gurucul AI SOC Analyst
The analyst-assist layer.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Review the access that actually carries risk.
Here’s what genuinely sets Gurucul Identity Analytics apart (and where an IGA suite may fit better).
Accumulated privilege is the risk nobody reviews
Organisations grant access competently and revoke it poorly. Somebody joins in one role, moves to a second, covers a third temporarily during a busy quarter, and is promoted into a fourth — and at each step access is added because the work requires it. Almost nothing is ever taken away, because removal has a cost if you get it wrong and no cost at all if you do not bother. After a decade, long-tenured employees hold the union of every role they have ever occupied. No individual grant was a mistake. The aggregate is one of the most exploitable conditions in your estate, and it is invisible to a review process that examines grants one at a time.
Risk scoring changes the question managers are asked
The reason conventional access reviews fail is not laziness, it is that they ask the wrong person the wrong question. A manager handed a list of two hundred entitlement names in system-generated notation cannot tell you which matter, so they approve all of them — which is rational, and produces an audit trail that proves nothing. Scoring access for risk inverts it: instead of asking "is all of this approved", you ask "here are the eleven entitlements that are genuinely dangerous, are these eleven still needed". That is a question a manager can actually answer, and the resulting evidence means something to a regulator.
Dormant access is where the risk concentrates
Access nobody uses is not harmless — it is the ideal target, because misuse of it produces no deviation from a pattern of legitimate use, for the simple reason that there is no pattern. High-privilege entitlements that have sat unused for a year are simultaneously the easiest to remove without business disruption and the most valuable to an attacker who obtains them. Surfacing that intersection is one of the highest-return outputs of identity analytics, and it is one of the few security recommendations that reliably meets no resistance from the business.
It shares an identity model with your detection
Because this runs on the same platform as the SIEM and UEBA, access risk and threat detection reason over one picture of who your users are. That has a concrete consequence during an investigation: when behavioural analytics flags a user, the analyst can immediately see whether the access being exercised was dormant, excessive or recently accumulated — context that turns an ambiguous risk score into a decision. Running access governance and detection on separate platforms means answering that question by correlating two systems that disagree about your directory.
The honest limit: this is analytics, not identity governance
We want to be precise about scope, because the categories are adjacent and vendors blur them. Identity Analytics tells you what access is risky and gives you evidence. It does not run your joiner-mover-leaver workflow, it does not provision or deprovision accounts, and it does not own your certification campaigns end to end. If you have an IGA platform — SailPoint, Saviynt, One Identity — this complements it by adding risk intelligence to decisions that platform executes. If you do not have one, this will not become one, and you should not buy it expecting that. TechBag sells IGA products too, and we will tell you which problem you actually have before you buy for the other one.
The honest positioning
Choose Identity Analytics when you can list who has access but cannot say which access is dangerous, and when a regulator expects evidence that you review it meaningfully rather than ceremonially. It is strongest for Indian BFSI buyers under RBI and SEBI expectations, particularly alongside the SIEM, where the shared identity model earns its keep during investigations. Do not choose it as your first identity purchase if you have no governance platform at all — fix provisioning and JML first, because analytics on top of an unmanaged identity estate mostly produces an accurate description of chaos.
The numbers behind the platform
What your Gurucul Identity Analytics rollout looks like
Pick the systems that matter
Start with the applications an examiner asks about — core banking, payments, treasury, the directory. A focused scope produces evidence faster than connecting every app at once.
Connect entitlements and usage
Load accounts and entitlements from each system with the activity showing use. Without usage data, scoring cannot tell dormant access from access people depend on.
Clear the obvious risk
Work orphaned accounts and long-dormant privileged access first. They are the easiest removals and the quickest proof to management that the scoring is right.
Re-run reviews on risk
Replace line-by-line certification with risk-ranked review. Measure revocation rates before and after — a review where nothing is ever revoked was never a review.
Keep the evidence trail
Keep dated decisions with named owners. When RBI or SEBI ask how access is governed, the record of what was reviewed, removed and why is the answer.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Our quarterly review used to be a manager approving 200 lines. Now they see twelve risky ones with usage beside them, and they actually revoke.”
“The dormant-privilege report paid for the pilot. Admin rights nobody had used in a year came off in a week without a single complaint.”
“It will not provision anything. We still run our IGA suite; this tells it what to remove and gives audit the reasoning.”
“Connectors for our in-house applications took longer than the licence approval. Budget that integration work honestly.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the identity analytics and security-analytics market — tap any vendor to see why it sits where it does.
TechBag SIEM Grid — Standing × Deployment Freedom
Analyst standing against where the platform is allowed to run — the pair that decides a regulated Indian shortlist.
2025 MQ Leader — and the only Leader we sell that self-hosts.
The Convergence × Effort Map
How much of SIEM, UEBA and response share one data model, against how much of the platform you must run yourself.
One data model — SIEM, UEBA, identity and NTA.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Gurucul Identity Analytics vs the field
The identity-analytics field — honest lanes. IGA suites own provisioning and certification workflow; Gurucul’s edge is risk scoring tied to behaviour. Many buyers need both, and we sell both.
| Dimension | Gurucul | Securonix | Exabeam | Microsoft Sentinel | Splunk ES |
|---|---|---|---|---|---|
| 2025 Gartner MQ | Leader — first year, after 3 as Visionary | Leader, 6 consecutive years | Leader, 6th time | Leader | Leader, 11th consecutive |
| Self-hosted / on-premises | YES — SaaS, cloud or self-hosted per Gartner | No — control plane is always their cloud | Via LogRhythm, a second platform | Cloud-only on Azure | Yes, and priced accordingly |
| Pricing axis | Per asset / per user, OR data volume / EPS | GB/day in tiered bands | GB ingested per day (2023 list) | Per GB ingested per day | Ingest or workload — the priciest here |
| Behavioural analytics | The founding capability, built 2010 | The founding capability | The founding capability | UEBA included | Available, add-on heritage |
| India data residency | Self-hosted: yours. No vendor India region found | BYO-AWS/Snowflake can hold data in India | Self-hosted via LogRhythm | Azure India regions available | Self-hosted: yours to place |
| Vendor scale | Bootstrapped boutique — no war chest | VC-backed, ~450 engineers in India | Post-merger with LogRhythm | Microsoft | Cisco-owned |
| Analyst breadth | Gartner-specific — absent from 2025 Forrester Wave | In both Gartner and Forrester | In both | In both | In both |
| The thing to plan around | Air-gap unverified; confirm the pricing axis | No air-gap at all; 120% default overage | Two platforms post-merger | Azure portal retires 31 Mar 2027 | Untuned, it is the costliest log archive there is |
| Best fit | On-premises mandates needing an analyst-recognised product | Cloud-accepting estates wanting retention solved | UEBA-led SOC, or on-prem via LogRhythm | Microsoft estates with E5 | Engineers who will build with it |
Does Gurucul Identity Analytics fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Gurucul Identity Analytics if…
- ✓You can list who has access but not which access is dangerous
- ✓RBI or SEBI expect evidence you review access meaningfully, not ceremonially
- ✓You already have an IGA platform this can add risk intelligence to
- ✓Accumulated privilege across role changes is a known problem you cannot quantify
Choose Securonix if…
- ✓Cloud is acceptable and you want the larger vendor with a six-year Leader run
- ✓365 days of hot searchable data as standard matters to your investigations
- ✓You accept there is no air-gapped or on-premises option in any configuration
Choose Microsoft Sentinel if…
- ✓You are standardised on Microsoft 365 with E5 — first-party logs ingest free
- ✓Azure India regions answer your residency question directly
- ✓You accept cloud-only on Azure, and the portal migration by 31 Mar 2027
Choose Elastic or Wazuh if…
- ✓You need a genuine air gap and have platform engineers to operate it
- ✓You would rather trade analyst standing for deployment freedom and cost control
- ✓Wazuh’s core is free under GPLv2; Elastic self-manages at the Basic tier
Gurucul Identity Analytics is one of 35 SIEM & log management products TechBag carries. The SIEM & Log Management guide narrows them to a shortlist and shows the reasoning. →
Assets or gigabytes — which meter suits you?
Gurucul can meter per asset or per user as an alternative to per-gigabyte ingest. That is the comparison worth modelling, because it is the one that changes behaviour: on an ingest-priced SIEM every improvement in logging coverage raises the invoice, so teams quietly stop collecting the sources that would have caught the intrusion. Move both sliders — the assets you would license, and the daily ingest an ingest-priced SIEM would charge you for. The point is not the exact number, since Gurucul is quote-only. It is the shape: asset counts change slowly, log volume only ever goes up. Indicative Indian-market rates.
If the saving reads zero, the ingest-priced SIEM is genuinely cheaper at your ratio and you should say so internally rather than force the comparison. And remember the precision that matters here: Gurucul offers per-asset pricing as an alternative to per-GB, not instead of it — data-volume and EPS options exist on the same list. Which axis you land on is negotiated, so make it a clause rather than an assumption.
Three ways to consume it
Identity Analytics is quote-only; confirm in writing whether it is licensed standalone or as a module on a REVEAL entitlement. The scope question matters more than the price question: this is analytics, not identity governance. It tells you which access is risky and evidences it. It does not run your joiner-mover-leaver workflow, provision accounts or own certification campaigns end to end — so it complements an IGA platform rather than replacing one. TechBag sells IGA products too, and we will tell you which problem you actually have. INR with GST.
On REVEAL
One identity model
- Shares one identity model with the SIEM and UEBA
- Access risk and detection reason over one picture
- Get standalone-vs-module in writing
What it is NOT
Analytics, not IGA
- Does not provision or deprovision accounts
- Does not run joiner-mover-leaver workflow
- Complements SailPoint, Saviynt or One Identity
India relevance
Why BFSI buyers look here
- Turns tick-box reviews into answerable questions
- Gurucul publishes SEBI CSCRF material
- The audit trail is worth as much as the findings
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 10 questions to ask every identity-analytics vendor
Take this into your next vendor call — including ours.
Which applications hold our regulated data, and are they all in the first phase?
Which of our in-house applications have a connector, and who builds the rest?
Can we feed activity for each system, so dormant access is measured rather than guessed?
How will findings reach our IGA or ticketing tool for revocation?
Will managers see risk and usage, or the same entitlement codes as today?
Does discovery cover privileged accounts outside our PAM vault?
What report will we show RBI or SEBI, and has our auditor seen a sample?
Must identity data stay on our infrastructure, and is self-hosting in the quote?
Is Identity Analytics quoted standalone or as a module on a platform entitlement?
Who owns acting on findings once the first clean-up is done?
Questions buyers ask
Ready to evaluate Gurucul Identity Analytics?
Scope it against your IGA, find your dormant high-risk access, or get an honest analytics-vs-IGA comparison — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.