Identity security posture management (ISPM) is software that maps every identity and every permission across a company's systems, so that the security team can answer the question: what can this account actually do? Posture here means the overall state of the company's settings: how many accounts it has, what each one can reach, and which of them are risky.
The question sounds simple, but it is hard to answer. One person's access comes through many paths. She is in a group in the directory. That group has a role in the cloud. That role can read a database. She is also an owner of a team's online app, and an old service account still names her as its owner. Each system shows only its own piece. ISPM reads the permissions from the directory services, the cloud accounts, the databases and the online apps, and joins them into one graph. A graph is a map of points and lines. Here, the points are identities and resources, and each line is a permission.
Imagine a stock broking company in Mumbai. The security team wants to know who can read the database table that holds clients' PAN numbers and bank account numbers. The expected answer is the 14 people in the operations team. ISPM follows every path in the graph and finds 212 identities. They include 37 service accounts that belong to programs, a cloud role that every developer is allowed to take on, an analytics tool that was given full access for a test two years ago, and the access key of an intern who left last year. Each of these is shown with the path that leads to the table.
The team then works through the list. ISPM sends the access to be removed to identity governance and administration (IGA), which removes it and records who approved each change. Most of the paths that ISPM finds belong to non-human identities. Nobody reviews these, because they never join or leave through HR. ISPM also covers AI agents that act on behalf of employees, through AI agent identity and security.
How does ISPM differ from its neighbours? IGA grants and removes access, following roles and requests. ISPM checks what access actually exists, wherever it came from. Cloud infrastructure entitlement management (CIEM) does the same check, but only inside cloud platforms. ISPM checks least privilege across all the systems together.