Home / Entitlement risk ranking
Entitlement risk ranking
Entitlement risk ranking puts the entitlements that carry the most risk at the top of the campaign. Your IGA platform remains the system of record. Quantlyx ranks the campaign, attaches a plain-language definition to each line, and shows which grants are actually being used.
Highest-risk entitlements first, definition attached.
Ranking the campaign, not replacing the system
Recertification fatigue
Reviewers see the highest-risk entitlements first, each with a definition they can read, so approvals stop being a habit.
IGA campaign reduction
Start the campaign where the risk is instead of certifying every line the same way. IGA still runs the campaign and holds the record.
Least privilege entitlements
Grants that are never used are recovered or re-scoped, moving access toward least privilege entitlements without a new store.
Access entitlement management
Quantlyx adds the ranking and the evidence. Access entitlement management stays in the platform you already run.
Over-provisioned access
Over-provisioned access shows up as the gap between what was granted and what was used, not as a longer list.
License waste identity
Standing seats and unused grants surface as license waste identity, so unused access is recovered and not only reviewed.
IAM, IGA, and what Quantlyx adds
Each layer answers a different question. Quantlyx does not replace either one. It adds the one answer neither gives a reviewer: whether the access was actually used the way it was approved.
IAM: who can sign in
Authentication, single sign-on, multi-factor and access policies. It answers whether this identity is allowed in, and what it can reach.
IGA: who should have access
Joiner-mover-leaver lifecycle, access requests, certification campaigns, segregation of duties and audit evidence. It stays the system of record.
Quantlyx: was it used as approved
Grant versus use, ranked by risk with the evidence attached. Quantlyx ranks the campaign and routes each finding to its owner. It reads, and it does not provision.
What is the difference between IAM and IGA?
IAM controls who can sign in and what they can reach. IGA governs whether that access should exist, through lifecycle, requests, certification and audit. Neither shows a reviewer whether a grant is actually being used. Quantlyx adds that signal, ranks the review by risk, and leaves IGA as the system of record.
Is PAM part of IAM?
Privileged access management (PAM) is usually treated as a specialised part of the wider identity and access management family: it vaults privileged credentials and controls privileged sessions. Quantlyx does not replace a PAM tool. It compares what a grant allowed with what was used, including standing access after revoke, and ranks that for the owner.
IAM hygiene without a new campaign engine
A finding routes to the accountable owner with its evidence, and Quantlyx tracks whether it closed or aged past its window. IAM hygiene becomes a ranked worklist instead of a quarterly spreadsheet. The same ranking feeds the NHI misuse threat library, so a grant that is both over-provisioned and being misused rises to the top.
See NHI misuse on your tenant
Read-only pilot. One lifecycle path. If nothing turns up, you keep a clean report.