Converged identity, answered plainly

Identity security is traditionally bought as three separate stacks — access management, governance and privileged access — from three vendors, then stitched together with connectors. Converged means all three run on one platform: one identity source, one policy engine, one audit trail and one console. There is no integration layer between them because there is no gap to integrate across.

Governance is about ordinary access held over long periods: what a person is entitled to, who approved it, and whether it is still justified at the next review. Privileged access is about dangerous access held briefly: a domain admin or root credential that should be vaulted, granted for a window and recorded while it is in use. Most organisations need both, which is precisely why buying them separately creates a seam.

Yes. Each discipline is a full-strength product in its own right, so you can start with the pillar that hurts most. The difference from buying three point tools is that when you add the next module it already shares the same identities, policies and audit trail — there is no migration or connector project in between.

Both. The same platform runs as a managed cloud service, in your own datacenter as containers, or as a hybrid where the control plane is your choice and agentless connectors reach assets in any network. The on-premise option is air-gap capable, which matters where data residency or regulatory mandates rule out SaaS.

No. Connectivity is agentless, including brokered RDP and SSH for privileged sessions, so there is no software footprint to deploy and maintain on the targets themselves.

No. Active Directory and LDAP are supported as identity sources — Zetect reads from them rather than replacing them. Applications federate to Zetect over SAML 2.0 and OIDC for single sign-on, and provisioning flows out over SCIM and REST where a target supports it.

They are treated as first-class identities on the same fabric as people. Service accounts, machine identities and privileged accounts are mapped alongside human accounts, which is what makes it possible to spot the ones that are dormant, over-privileged or no longer owned by anyone.

Biometric MFA requires a fingerprint or facial scan to verify the user in real time, which is what makes it identity-bound rather than device-bound. Even if a device or password is compromised, an attacker cannot complete authentication without the authorised person's own biological traits — which also removes the dependency on SMS one-time passwords and the SIM-swap and phishing routes that come with them.

The evidence auditors ask for is produced by normal operation rather than assembled by hand: scheduled certification campaigns, Segregation-of-Duties enforcement that blocks toxic access up front, tamper-evident session recordings, and one audit trail spanning authentication, entitlement and privileged activity. That maps to ISO 27001, SOC 2, PCI-DSS, HIPAA, SOX, GDPR and NIST 800-53.

De-provisioning is automated from the governance module and flows through to access and privilege together — the account is removed, entitlements are revoked and any standing privileged access disappears with it. Because it is one platform, there is no window where a leaver is disabled in one tool and still active in another.

SCIM and REST APIs cover most cases. Beyond that there is a connector SPI: a connector is a standalone project that plugs into the Zetect agent, so a bespoke or in-house system can be brought under the same governance as everything else. The connector guide in the documentation walks through building, testing and publishing one.