Non-human identities (NHIs) have long been the blind spot of traditional programmes, feels Nitin Varma, SVP & MD – India & SAARC, Saviynt. Service accounts, API tokens, bots and workloads often outlive their original purpose and accumulate excessive privileges, he adds. In an exclusive conversation with Rajneesh De, Group Editor, APAC Media & CXO Media, Varma explains that Saviynt’s approach starts with continuous discovery and contextual enrichment, linking each NHI to its owner, purpose, resources accessed and risk posture. Subsequently, Saviynt applies the same lifecycle discipline used for human identities: ownership assignment, periodic review, least-privilege enforcement and automated remediation where possible.
Saviynt has evolved from a traditional IAM into a converged cloud-native identity security platform. What are the current solutions in your product portfolio and how have your services scaled to manage over 60 million identities globally?
Identity has moved far beyond classic user provisioning. Enterprises today need a single control plane that covers every identity type (workforce, external, privileged, non-human, and now AI agents) across cloud, hybrid and on-prem environments.
Saviynt’s portfolio is built around the Identity Cloud: Identity Governance and Administration (IGA), Privileged Access Management (PAM), Application Access Governance, Identity Security Posture Management (ISPM), and External Identity capabilities. These are not bolted-together point products; they share a common data fabric and intelligence layer so organisations get consistent visibility, risk scoring and policy enforcement.
With the recent addition of Zuma, we have extended that same foundation to AI agents and non-human identities. We now secure well over 100 million identities for large global enterprises. Scale comes from a cloud-native architecture designed for continuous discovery, real-time decisioning and automated lifecycle management rather than periodic campaigns. In markets such as India and SAARC, where digital and AI adoption is accelerating rapidly, this converged approach is proving essential because organisations simply cannot afford fragmented tooling any longer.
What business imperatives influenced the launch of Zuma?
The core imperative is straightforward: AI agents and non-human identities are proliferating faster than traditional identity processes can govern them. Enterprises are asking very practical questions: where are all my AI agents, who owns them, what can they actually do at runtime, and how do we maintain accountability when they act at machine speed?
Legacy identity tools were built for human users with predictable access patterns. AI agents reason, decide and execute continuously. That creates an unmanaged attack surface and compliance risk that boards and regulators are beginning to notice.
Zuma was developed after working closely with large organisations already running agents in production. The business need was clear: a purpose-built control plane that delivers continuous discovery, runtime protection based on intent and context, and full lifecycle ownership, without creating yet another silo. The goal is to let enterprises scale AI confidently rather than slow it down out of fear.
How would you explain the functioning of Zuma Insights, Zuma Access, and Zuma Governance?
Think of the three pillars as discovery, real-time protection and accountability.
Zuma Insights continuously discovers AI agents, large language models (LLMs), tools and other non-human identities across the environment. It maps what they can access, who owns them, how their privileges change over time, and where risk is accumulating, giving security teams a single, living inventory instead of blind spots.
Zuma Access operates at runtime. It evaluates each agent action against identity, context, declared intent, policy and risk signals, then authorises or blocks the action before it can impact the business. This is intent-aware authorisation rather than static permission checks.
Zuma Governance closes the loop by establishing ownership, purpose, lifecycle controls, access reviews and audit-ready evidence for every AI identity. Orphaned or unmanaged agents can no longer persist without accountability.
Together they form a control plane that treats AI identities with the same rigour, often higher, that organisations apply to human users.
Under Saviynt’s broader strategic initiatives, what are the key pillars of your go-to-market (GTM) strategy today, particularly in driving renewals, expansions, and customer success?
Our GTM is centred on delivering measurable outcomes across the full identity lifecycle rather than selling individual modules. The pillars are deep customer understanding, strong partner ecosystems, and continuous value realisation.
In India and SAARC, we focus on new logo acquisition in sectors where digital and AI transformation is intense, while simultaneously expanding within existing accounts by extending governance to non-human and AI identities. High retention comes from making the platform operationally sticky: faster access decisions, reduced audit friction, and clear risk reduction.
Customer success teams work closely with Chief Information Security Officers (CISOs) and IAM leaders to map identity programmes to business priorities such as zero-trust programmes, regulatory readiness and AI adoption. Partners, including system integrators and technology alliances, play a critical role in both implementation and ongoing co-innovation. The net result is that renewals and expansions follow from demonstrated value rather than sales campaigns.
In a market shared with competitors, what uniquely differentiates Saviynt’s offerings in terms of value proposition and technology innovation?
The differentiation is convergence and architectural intent. Many solutions still treat IGA, PAM, application access and posture management as separate layers that customers must integrate. Saviynt was built cloud-native from the start so these capabilities share the same identity data fabric and intelligence engine.
That architectural choice becomes decisive when organisations must govern AI agents alongside humans and machines. We can discover, risk-score, authorise at runtime and enforce ownership without stitching together multiple products. AI is embedded across the platform, for recommendations, anomaly detection and automation, rather than added as a feature.
In practical terms this means lower operational complexity, faster time-to-value and a single source of truth for auditors and security teams. Customers tell us the real differentiator is the ability to treat every identity type with consistent, continuous controls while still moving at the speed the business demands.
How is Saviynt approaching the integration of identity, privileged access management and other functions?
We treat them as inseparable parts of one platform rather than adjacent products. Privileged access is simply high-risk identity that requires tighter controls, continuous monitoring and just-in-time elevation. Application access governance brings fine-grained entitlement visibility into the same decisioning engine. Identity Security Posture Management surfaces configuration and risk issues across the entire landscape.
Because everything shares the same data and intelligence layer, a single policy decision can influence workforce access, privileged sessions, application entitlements and now AI-agent actions. This reduces the classic gap where privileged accounts or service accounts sit outside regular governance.
The practical outcome for customers is fewer tools, consistent risk scoring and the ability to enforce least privilege continuously rather than through periodic reviews. In an environment where non-human and AI identities are growing rapidly, that integration is no longer optional.
How is Saviynt managing non-human identities such as service accounts and tokens?
Non-human identities (NHIs) have long been the blind spot of traditional programmes. Service accounts, API tokens, bots and workloads often outlive their original purpose and accumulate excessive privileges.
Our approach starts with continuous discovery and contextual enrichment, linking each NHI to its owner, purpose, resources accessed and risk posture. We then apply the same lifecycle discipline used for human identities: ownership assignment, periodic review, least-privilege enforcement and automated remediation where possible.
With the expansion into AI agents the same principles scale further. Orphaned credentials and over-privileged machine identities are prioritised through Identity Security Posture Management, and runtime controls can restrict what those identities are actually allowed to do. The objective is simple: no identity, human or non-human, should operate without clear ownership and continuous oversight.
How does Saviynt view Agentic AI for application onboarding and for last-mile provisioning/de-provisioning?
Agentic AI is a force multiplier when applied inside the identity platform itself. Application onboarding has historically been one of the slowest and most resource-intensive parts of any IGA programme. AI agents can accelerate discovery of entitlements, suggest role mappings, detect Segregation of Duties conflicts early, and generate much of the initial configuration that human experts then validate.
For last-mile provisioning and de-provisioning the same intelligence reduces manual effort and error. Intelligent recommendations based on peer groups, historical patterns and risk signals improve the accuracy of access decisions. Automated workflows can then execute joiner-mover-leaver processes with higher confidence and full audit trails.
The key is that AI remains under governance. We use agentic capabilities to remove friction and improve consistency, not to remove human accountability. That balance of speed with control is what organisations need as the volume of applications and identities continues to grow.
What strategic direction are you taking to align with the next phase of enterprise identity challenges?
The next phase is defined by three realities: the explosion of AI agents, the dominance of non-human identities, and the need for continuous rather than periodic controls. Our direction is to make identity the foundational control plane for the AI-enabled enterprise.
That means extending governance to every agent and machine identity with the same (or higher) standards applied to humans, embedding real-time intent-aware authorisation, and ensuring ownership and auditability never lag behind innovation. In India and the broader SAARC region, where cyber threats are intense and digital transformation is rapid, this becomes especially urgent.
We are investing in deeper ecosystem integrations, agentic automation inside the platform, and regional capability so that enterprises can adopt AI at scale without creating ungoverned risk. The strategic bet is clear: organisations that treat identity as the primary security control plane will move faster and safer than those still managing it as a compliance afterthought.
