Upgrading IBM Verify before its support dates arrive.
IBM renamed most of this product family in the last two years. Some teams run Verify Identity Governance or Verify Identity Access, and others still have ISIM and ISAM estates. We help them work out what they actually run and how much support is left, then plan the move.
Cohash upgrades, migrates and supports IBM Verify, the product family formerly sold as IBM Security Verify.
We move Security Verify Access 10.0 appliances to IBM Verify Identity Access 11.0 and upgrade Verify Identity Governance. We also connect IBM Verify SaaS to directories and applications. ISVA 10.0.x went to Extended Support on 30 April 2026, so our first step is an inventory of versions and support dates.
you probably need this if
On 30 April 2026 your Verify Access 10.0 appliances crossed into Extended Support.
ISIM still provisions accounts and the person who built it has left.
Nobody can say which reverse proxy junctions are still used.
30 Apr 2026Security Verify Access 10.0.x in Extended Support Moved to Extended Support on 30 April 2026. Extended Support ends 30 April 2029. source ↗
Jun 2026IBM Verify Identity Access 11.0.3 IBM's table lists this as the current release. It was 11.0 that renamed Security Verify Access to Verify Identity Access, and 11.0 went GA in December 2024. source ↗
today · Oct 22, 2026
30 Apr 2028aheadVerify Identity Governance 10.0.x support dates Moves to Extended Support on 30 April 2028, which ends 30 April 2031. Verify Identity Governance 11.0 Fix Pack 1 is available. source ↗
the story · ibm verify estate
From the first call to a setup your own team can run.
Here's what usually prompts a call about your IBM Verify estate, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · ibm verify estate3 open
openOn 30 April 2026 your Verify Access 10.0 appliances crossed into Extended Support.
recurringISIM still provisions accounts and the person who built it has left.
blockedNobody can say which reverse proxy junctions are still used.
exposure
Verify Identity Access 11.0…Verify Identity Governance…ISIM and IGI migrationsIBM Verify SaaS integrationAdapter development and support
IBMS/4
startrehearsehandover
Version and support inventory
Configuration export
Rebuild and rehearse
Cut-over and handover
we are here
ready to hand over
The team retires junctions nobody uses, moves the rest to a supported release and has an…
Provisioning now runs on Verify Identity Governance, same policies as before.
Version, fix pack and support-date inventory across appliances and servers
Reverse proxy junction inventory with owner and last-used evidence
chapter 01 · where it hurts
Why teams reach out
On 30 April 2026 your Verify Access 10.0 appliances crossed into Extended Support.
ISIM still provisions accounts and the person who built it has left.
Nobody can say which reverse proxy junctions are still used.
chapter 02 · what we change
How we solve it
Verify Identity Access 11.0 upgrades
Verify Identity Governance upgrades
ISIM and IGI migrations
IBM Verify SaaS integration
Adapter development and support
chapter 03 · how it runs
Our approach
Version and support inventory
Configuration export
Rebuild and rehearse
Cut-over and handover
chapter 04 · where you end up
What changes
The team retires junctions nobody uses, moves the rest to a supported release and has an owner to call for every application.
Provisioning now runs on Verify Identity Governance, same policies as before.
Version, fix pack and support-date inventory across appliances and servers
Reverse proxy junction inventory with owner and last-used evidence
what we do
Our IBM Verify work
5 kinds of IBM Verify work, each run by engineers who have done it on live tenants.
Security Verify Access 10.0.x appliances moved to IBM Verify Identity Access 11.0.x, with reverse proxy instances, junctions and policies exported, rebuilt and tested before cut-over.
Verify Governance 10.0 estates taken to Verify Identity Governance 11.0, with adapters, workflows and custom reports reviewed release by release.
Older IBM Security Identity Manager and Identity Governance and Intelligence deployments assessed and moved into Verify Identity Governance, keeping provisioning policies and certifications intact.
Workforce and customer sign-in on IBM Verify SaaS, with SAML and OIDC applications, MFA policy and provisioning to downstream directories.
Identity adapters for the applications IBM doesn't cover, plus health checks of adapters, reconciliation schedules and error queues.
capability 01 / 05in production
IBMS/4
Verify Identity Access 11.0 upgrades
Security Verify Access 10.0.x appliances moved to IBM Verify Identity Access 11.0.x, with reverse proxy instances, junctions and policies exported, rebuilt and tested before cut-over.
Older IBM Security Identity Manager and Identity Governance and Intelligence deployments assessed and moved into Verify Identity Governance, keeping provisioning policies and certifications intact.
We pieced these together from IBM Verify situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Twelve Verify Access 10.0 appliances, two hundred junctions, no owner list
composite · not a client story
Beforethe situation
Security Verify Access 10.0.x appliances front most internal web apps. Support moved to Extended on 30 April 2026, and the junction list has grown for years with no record of who owns each one.
What we dothe work
We export every reverse proxy configuration and match junctions against request logs to find the ones nobody uses. The rest get owners. Then Verify Identity Access 11.0 goes up beside production and junctions move across in groups.
Afterwhere you end up
The team retires junctions nobody uses, moves the rest to a supported release and has an owner to call for every application.
case file 02
ISIM provisioning an estate that includes RACF
composite · not a client story
Beforethe situation
ISIM still provisions Active Directory and mainframe RACF accounts. The adapters work, but no one has tested a move to Verify Identity Governance and the ISIM skills on the team are thin.
What we dothe work
We document provisioning policies, adapters and workflows, map them to Verify Identity Governance, and rehearse the migration on a production copy with RACF and AD test targets before scheduling cut-over.
Afterwhere you end up
Provisioning now runs on Verify Identity Governance, same policies as before. And the team has documentation, which it never had for ISIM.
We don't start a step until the last one has produced something you can check.
step 01
Version and support inventory
Every appliance, governance server and adapter goes on the list, with version, fix pack and IBM support date. We write the current IBM Verify name next to the old one.
step 02
Configuration export
We export reverse proxy instances, junctions, AAC policies, federation partners, adapters and workflows, and each one gets an owner. That way the upgrade scope is a list and not a guess.
step 03
Rebuild and rehearse
Verify Identity Access 11.0 or the new Verify Identity Governance release goes up beside production. We import the configuration, then test sign-in and provisioning with real applications.
step 04
Cut-over and handover
Traffic moves in waves by junction or application group. Each wave has a rollback path, and the team that'll run it afterwards gets the runbooks.
ai on ibm verify
Where AI fits on IBM Verify, and where it needs guardrails.
In September 2026 IBM opened IBM Agent Identity to public preview. It's in the IBM Verify portfolio and is meant to register and authenticate AI agents and then govern them. IBM Verify Identity Protection now has AI-powered threat detection that also covers agentic identities. Neither product removes the upgrade work on Verify Identity Access 11.0 or Identity Governance. For us, that work still drives most timelines.
AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
IBMIBM Verifydoes the work
IBM doesn't currently document an MCP server for IBM Verify, so agents call the IBM Verify REST APIs with an API client limited to the needed entitlements and short-lived tokens. We log every call and put a human approval step in front of writes.
IBM Agent Identity (public preview)
It registers agents with central ownership and issues short-lived task-scoped tokens through delegated authorization. Audit trails link humans, agents and policy decisions. Access needs IBM's approval, and features may change before GA. So for us it's a pilot on one low-risk agent.
IBM Verify Identity Protection
IBM's pitch includes discovering human, non-human and agentic identities and running behavioral analytics for compromised agent behavior. It monitors agent-to-agent communication too. For us the first step is connecting your directories, so the inventory is complete before anyone tunes alerts.
AI help with Verify Identity Access upgrades
Moving from 10.0.x to 11.0 means going through junction, policy and mapping rule configuration. For us, an AI assistant drafts the inventory and flags changed settings, then an engineer verifies each one on a test appliance.
Where IBM Verify sits between users, applications and accounts
Users sign in through IBM Verify SaaS or through Verify Identity Access reverse proxies, which protect the web applications. Verify Identity Governance reads HR data and provisions accounts through adapters. It also runs the access reviews auditors ask for.
01 · Users and sources
Workforce usersbrowser · mobile → IBM Verify SaaS · SAML · OIDC→ Verify Identity Access 11.0 · HTTPS
These are working documents, written against your configuration, so your team can run them without us.
inventory01
Version, fix pack and support-date inventory across appliances and servers
yours to keep
inventory02
Reverse proxy junction inventory with owner and last-used evidence
yours to keep
runbook03
Verify Identity Access 11.0 upgrade runbook with rollback per wave
yours to keep
inventory04
ISIM or IGI to Verify Identity Governance mapping of policies, adapters and workflows
yours to keep
report05
Adapter health report with reconciliation timings and error queues
yours to keep
talent and delivery · ibm verify
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Put these to anyone bidding on your IBM Verify work. The ones who've done it answer differently from the ones who've read about it.
Q1
Do we have appliances or servers on Extended Support today, and what will it cost to stay?
IBM put Verify Access 10.0.x on Extended Support in April 2026. What that contract costs often decides whether the upgrade happens this year or slips to next.
Q2
How will you find junctions and federation partners that are no longer used?
Moving dead configuration to a new release adds test effort for nothing. Matching junctions to logs before the upgrade shrinks the scope.
Q3
How will custom AAC policies and mapping rules be tested on 11.0?
Custom authentication logic is where upgrades fail in production. Each policy needs a test case, not a visual check of the admin console.
Q4
What is your plan for ISIM adapters that have no direct equivalent?
Older custom adapters may need rework in Verify Identity Governance. Knowing which ones early keeps provisioning from going dark at cut-over.
Q5
Who will run the platform after you leave?
IBM Verify skills are scarce. A handover with runbooks, or a plan to staff the role, matters as much as the upgrade.
01What is IBM Security Verify called now?
IBM uses IBM Verify for the whole family now. Security Verify Access became IBM Verify Identity Access at version 11.0, and Security Verify Governance is IBM Verify Identity Governance. You'll still trip over ISAM, ISIM and IGI in support pages and URLs.
02Our Verify Access appliances are on 10.0. How urgent is the upgrade?
Security Verify Access 10.0.x went to Extended Support on 30 April 2026, and Extended Support ends on 30 April 2029. It's a separate contract, so the cost of staying usually drives the timeline. Version 11.0.3 was current when we checked.
03How long does a move from Verify Access 10.0 to 11.0 take?
It depends on how many reverse proxy instances and junctions you run, how much custom authentication you built in AAC or federation, and how many environments need the same change. We export the configuration first and size the work from what is actually there.
04Can you migrate us off ISIM?
Yes. In version 10.0 IBM folded ISIM into what is now Verify Identity Governance. We map ISIM provisioning policies, adapters and workflows to Verify Identity Governance and rehearse the move on a copy of production.
05Do you also connect IBM Verify to privileged access tools?
Yes. Verify Identity Governance can connect to CyberArk and similar vaults. We set that up so privileged account membership is requested and recertified like other access.
services
Related services
Projects on IBM Verify usually end up touching one of these, so they're worth a look.
