identity governance

Patch IBM Verify now, then get off the versions IBM is about to stop supporting.

IBM renamed most of this product family in the last two years. Some teams run Verify Identity Governance or Verify Identity Access, and others still have ISIM and ISAM estates. We help them work out what they actually run and how much support is left, then plan the move.

Talk to a IBM Verify engineer What changed recently

IBM

platform dossierIBM VerifyIdentity governance

Current brand: IBM Verify (formerly IBM Security Verify)
Access release: Verify Identity Access 11.0.3, June 2026
Patch to: 11.0.3.2 or 10.0.9.4 (CVE-2026-78406, CVSS 9.8)
ISVA 10.0.x: Extended Support since 30 Apr 2026, ends 30 Apr 2029

release watch

Verify Identity Access 11.0.3.2 and Security Verify Access 10.0.9.47 Oct 2026
CVE-2026-109126, hard-coded credentials (CVSS 8.8)14 Oct 2026

connects with

S/4 z/OS

in short·15-second read

Cohash patches, upgrades and migrates IBM Verify, the family once sold as IBM Security Verify.

If you run Verify Access, two jobs are due now: the 11.0.3.2 or 10.0.9.4 fix for two unauthenticated code-execution flaws rated 9.8, and a plan off 10.0, which is on paid Extended Support. Verify Identity Governance 10.0.x follows on 30 April 2028.

you probably need this if

Your Verify Access 10.0 appliances have been on paid Extended Support since 30 April 2026, and nobody has priced the move.
ISIM still provisions accounts and the person who built it has left.
Half the junctions might be dead, but nobody can say which half.

terms on this page provisioningExtended SupportIdentity governance

Ask an engineer facts checked 2026-11-05

how it runs: 01Version and support inventory
02Configuration export
03Rebuild and rehearse
04Cut-over and handover
you keep: A spreadsheet of every appliance and server, its fix pack and when IBM support runs out
Junctions matched to request logs, so you know which ones still get used and who owns them
Verify Identity Access 11.0 upgrade runbook with rollback per wave
+ 2 more documents
who does it: IBM Verify Identity Access engineer (reverse proxy, AAC)Verify Identity Governance developer (adapters, workflows)ISIM to Verify Governance migration lead IBM Certified Deployment Professional - Security Verify Access V10.0 IBM Certified Administrator - Security Verify SaaS v1
platforms: IBM S/4 z/OS
proof: 1 case study on this
background: field note · 14 minZendesk is killing API tokens, and your Entra ID provisioning still runs on one

ibm-security-verify · release timeline

30 Apr 2026 Security Verify Access 10.0.x in Extended Support Standard support for 10.0.x ended on 30 April 2026, so fixes now come through a separate Extended Support contract. That contract runs out on 30 April 2029. Whatever that contract costs is what you weigh the 11.0 move against.
Jun 2026 IBM Verify Identity Access 11.0.3 IBM's release table still shows 11.0.3 as the newest 11.0 release, and fixes arrive as patches on top of it. Version 11.0 is also where the Security Verify Access name went away. Support pages still mix the two names, so search for both when you look for a fix.
10 Aug 2026 August bulletin, 17 CVEs up to CVSS 8.1 A mix of reverse proxy, Liberty and management-interface fixes. One lets a signed-in user pick up another user's privileges with a crafted request, and two let an administrator run commands beyond their role. IBM fixed it in 11.0.3 IF1 on Verify Identity Access.
2 Sep 2026 September bulletin, fixed in 11.0.3 IF2 and 10.0.9.2 IF2 This one bundled 32 CVEs. The worst, rated 9.6 and 9.1, are Eclipse OpenJ9 Java runtime flaws, and the rest include request smuggling in Liberty and an open redirect. Check which interim fix each appliance actually runs before you plan the October patch.
7 Oct 2026 Verify Identity Access 11.0.3.2 and Security Verify Access 10.0.9.4 IBM's October bulletin fixes 22 flaws in Verify Access. Two of them, CVE-2026-78406 and CVE-2026-78401, let someone with no login run code on the appliance, and both are rated 9.8. Everything up to 11.0.3.1 and 10.0.9.3 is affected, containers included, and IBM lists no workaround. Patch the appliances that face the internet first.
14 Oct 2026 CVE-2026-109126, hard-coded credentials (CVSS 8.8) A week later IBM flagged hard-coded credentials on 11.0.3.1 and 10.0.9.3 that can hand an attacker on the same network segment elevated privileges. The fix is the same pair of releases, 11.0.3.2 and 10.0.9.4, so one patch window covers both bulletins. There's no workaround here either.
today · Nov 09, 2026
30 Apr 2028ahead Verify Identity Governance 10.0.x support dates Standard support for 10.0.x stops at the end of April 2028, and paid Extended Support carries it to the end of April 2031. That sounds far off, but ISIM-era adapters and custom workflows take a while to rebuild. Fix Pack 1 for 11.0 is already out, so you can start testing the move before the bill changes.

the story · ibm verify estate

From the first call to a setup your own team can run.

Here's what usually prompts a call about your IBM Verify estate, what we do about it and in which order, and where you end up.

01 · where it hurts02 · what we change03 · how it runs04 · where you end up

incident board · ibm verify estate3 open

openYour Verify Access 10.0 appliances have been on paid Extended Support since 30 April 2026, and nobody has priced the…

recurringISIM still provisions accounts and the person who built it has left.

blockedHalf the junctions might be dead, but nobody can say which half.

exposure

Verify Identity Access 11.0…Verify Identity Governance…ISIM and IGI migrationsIBM Verify SaaS integrationAdapter development and support

startrehearsehandover

Version and support inventory

Configuration export

Rebuild and rehearse

Cut-over and handover

we are here

ready to hand over

The team retires junctions nobody uses, moves the rest to a supported release and has an…
Provisioning now runs on Verify Identity Governance, same policies as before.
A spreadsheet of every appliance and server, its fix pack and when IBM support runs out
Junctions matched to request logs, so you know which ones still get used and who owns them

chapter 01 · where it hurts
Why teams reach out
- Your Verify Access 10.0 appliances have been on paid Extended Support since 30 April 2026, and nobody has priced the move.
- ISIM still provisions accounts and the person who built it has left.
- Half the junctions might be dead, but nobody can say which half.
chapter 02 · what we change
How we solve it
- Verify Identity Access 11.0 upgrades
- Verify Identity Governance upgrades
- ISIM and IGI migrations
- IBM Verify SaaS integration
- Adapter development and support
chapter 03 · how it runs
Our approach
- Version and support inventory
- Configuration export
- Rebuild and rehearse
- Cut-over and handover
chapter 04 · where you end up
What changes
- The team retires junctions nobody uses, moves the rest to a supported release and has an owner to call for every application.
- Provisioning now runs on Verify Identity Governance, same policies as before.
- A spreadsheet of every appliance and server, its fix pack and when IBM support runs out
- Junctions matched to request logs, so you know which ones still get used and who owns them

what we do

Our IBM Verify work

5 kinds of IBM Verify work, each run by engineers who have done it on live tenants.

Security Verify Access 10.0.x appliances moved to IBM Verify Identity Access 11.0.x, with reverse proxy instances, junctions and policies exported, rebuilt and tested before cut-over.
Verify Governance 10.0 estates taken to Verify Identity Governance 11.0, with adapters, workflows and custom reports reviewed release by release.
Older IBM Security Identity Manager and Identity Governance and Intelligence deployments assessed and moved into Verify Identity Governance, keeping provisioning policies and certifications intact.
Workforce and customer sign-in on IBM Verify SaaS, with SAML and OIDC applications, MFA policy and provisioning to downstream directories.
Identity adapters for the applications IBM doesn't cover, plus health checks of adapters, reconciliation schedules and error queues.

capability 01 / 05in production

Verify Identity Access 11.0 upgrades

Security Verify Access 10.0.x appliances moved to IBM Verify Identity Access 11.0.x, with reverse proxy instances, junctions and policies exported, rebuilt and tested before cut-over.

talk to an engineer about this →

capability 02 / 05in production

Verify Identity Governance upgrades

Verify Governance 10.0 estates taken to Verify Identity Governance 11.0, with adapters, workflows and custom reports reviewed release by release.

talk to an engineer about this →

capability 03 / 05in production

ISIM and IGI migrations

Older IBM Security Identity Manager and Identity Governance and Intelligence deployments assessed and moved into Verify Identity Governance, keeping provisioning policies and certifications intact.

talk to an engineer about this →

capability 04 / 05in production

IBM Verify SaaS integration

Workforce and customer sign-in on IBM Verify SaaS, with SAML and OIDC applications, MFA policy and provisioning to downstream directories.

talk to an engineer about this →

capability 05 / 05in production

Adapter development and support

Identity adapters for the applications IBM doesn't cover, plus health checks of adapters, reconciliation schedules and error queues.

talk to an engineer about this →

typical situations

IBM Verify situations we walk into

We pieced these together from IBM Verify situations that come up a lot. They're patterns. You won't find a specific client in them.

case file 01

A dozen Verify Access 10.0 appliances and junctions nobody will claim

composite · not a client story

Beforethe situation

Security Verify Access 10.0.x appliances front most internal web apps. Support moved to Extended on 30 April 2026, and the junction list has grown for years with no record of who owns each one.
What we dothe work

We export every reverse proxy configuration and match junctions against request logs to find the ones nobody uses. The rest get owners. Then Verify Identity Access 11.0 goes up beside production and junctions move across in groups.
Afterwhere you end up

The team retires junctions nobody uses, moves the rest to a supported release and has an owner to call for every application.

case file 02

ISIM provisioning an estate that includes RACF

composite · not a client story

Beforethe situation

ISIM still provisions Active Directory and mainframe RACF accounts. The adapters work, but no one has tested a move to Verify Identity Governance and the ISIM skills on the team are thin.
What we dothe work

We document provisioning policies, adapters and workflows, map them to Verify Identity Governance, and rehearse the migration on a production copy with RACF and AD test targets before scheduling cut-over.
Afterwhere you end up

Provisioning now runs on Verify Identity Governance, same policies as before. And the team has documentation, which it never had for ISIM.

case studies

IBM Verify case studies

All case studies

migration Identity and access

IBM ISIM, Oracle OIM or homegrown provisioning to SailPoint or Saviynt

Getting off IBM ISIM, Oracle OIM or homegrown provisioning scripts and onto SailPoint or Saviynt, with provisioning, certifications and audit history intact.

read the case study

approach

How a IBM Verify engagement runs

We don't start a step until the last one has produced something you can check.

step 01
Version and support inventory

Every appliance, governance server and adapter goes on the list, with version, fix pack and IBM support date. We write the current IBM Verify name next to the old one.
step 02
Configuration export

We export reverse proxy instances, junctions, AAC policies, federation partners, adapters and workflows, and each one gets an owner. That way the upgrade scope is a list and not a guess.
step 03
Rebuild and rehearse

We stand up Verify Identity Access 11.0 or the new Verify Identity Governance release beside production. Then we import the configuration and test sign-in and provisioning against real applications.
step 04
Cut-over and handover

Traffic moves in waves by junction or application group. Each wave has a rollback path, and the team that'll run it afterwards gets the runbooks.

ai on ibm verify

Where AI fits on IBM Verify, and where it needs guardrails.

In September 2026 IBM opened IBM Agent Identity to public preview. It's in the IBM Verify portfolio and is meant to register and authenticate AI agents and then govern them. IBM Verify Identity Protection now has AI-powered threat detection that also covers agentic identities. Neither product removes the upgrade work on Verify Identity Access 11.0 or Identity Governance. For us, that work still drives most timelines.

AI agentasks for data or an action

Scoped identityonly the access it needs

MCP serverthe one door into the platform

Logged, approveda person signs off on writes

IBM Verifydoes the work

IBM doesn't currently document an MCP server for IBM Verify, so agents call the IBM Verify REST APIs with an API client limited to the needed entitlements and short-lived tokens. We log every call and put a human approval step in front of writes.

IBM Agent Identity (public preview)

It registers agents with central ownership and issues short-lived task-scoped tokens through delegated authorization. Audit trails link humans, agents and policy decisions. Access needs IBM's approval, and features may change before GA. So for us it's a pilot on one low-risk agent.

IBM Verify Identity Protection

IBM's pitch includes discovering human, non-human and agentic identities and running behavioral analytics for compromised agent behavior. It monitors agent-to-agent communication too. For us the first step is connecting your directories, so the inventory is complete before anyone tunes alerts.

AI help with Verify Identity Access upgrades

Moving from 10.0.x to 11.0 means going through junction, policy and mapping rule configuration. For us, an AI assistant drafts the inventory and flags changed settings, then an engineer verifies each one on a test appliance.

architecture

Where IBM Verify sits between your users, your apps and the accounts behind them

People sign in through IBM Verify SaaS or through the Verify Identity Access reverse proxies that sit in front of the web apps. Behind that, Verify Identity Governance pulls joiners and leavers from HR, pushes accounts out through adapters and runs the access reviews auditors ask for.

use cases

Typical IBM Verify projects

The work teams usually bring us, and the platforms IBM Verify has to talk to while we do it.

IBM-01 Your Security Verify Access 10.0 appliances are on paid Extended Support and still unpatched common request
IBM-02 ISIM or IGI still handles provisioning and nobody has planned the move to Verify Identity Governance common request
IBM-03 The team isn't sure which renamed IBM product it actually licenses common request
IBM-04 Junctions have piled up for years and nobody knows who owns half of them common request
IBM-05 You want sign-in on IBM Verify SaaS but need governance to stay in your own data center common request

IBM Verify · connected platforms

IBM Microsoft Entra ID Okta SAP S/4HANA ServiceNow CyberArk IBM Z Mainframe

you keep

What a IBM Verify engagement leaves behind

These are working documents, written against your configuration, so your team can run them without us.

document01

A spreadsheet of every appliance and server, its fix pack and when IBM support runs out
yours to keep
document02

Junctions matched to request logs, so you know which ones still get used and who owns them
yours to keep
runbook03

Verify Identity Access 11.0 upgrade runbook with rollback per wave
yours to keep
inventory04

A mapping sheet that shows where each ISIM or IGI policy, adapter and workflow ends up after the move
yours to keep
document05

An adapter health check: how long reconciliations take and what's stuck in the error queues
yours to keep

talent and delivery · ibm verify

Certified engineers, wherever you need them.

Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.

Onsite

Engineers at your sites in the US

Nearshore

Overlapping hours with US teams

Offshore

Overnight progress on your backlog

All time zones

Coverage handed over across time zones

24-hour coverage · US Central time

OnsiteUS business hours

Nearshoreoverlapping US hours

Offshoreovernight progress

Combinedhandover, not hand-off

certifications our engineers hold

IBM Certified Deployment Professional - Security Verify Access V10.0IBM
IBM Certified Administrator - Security Verify SaaS v1IBM

roles we staff

IBM Verify Identity Access engineer (reverse proxy, AAC)
Verify Identity Governance developer (adapters, workflows)
ISIM to Verify Governance migration lead
IBM Verify SaaS integration engineer
IAM support engineer for IBM appliances

due diligence · ibm verify

Questions to ask any partner, including us.

Put these to anyone bidding on your IBM Verify work. The ones who've done it answer differently from the ones who've read about it.

Q1
Do we have appliances or servers on Extended Support today, and what will it cost to stay?
IBM put Verify Access 10.0.x on Extended Support in April 2026. What that contract costs often decides whether the upgrade happens this year or slips to next.
Q2
Which junctions and federation partners would you delete before the upgrade, and how would you prove nobody uses them?
Moving dead configuration to a new release adds test effort for nothing. Matching junctions to logs before the upgrade shrinks the scope.
Q3
How will custom AAC policies and mapping rules be tested on 11.0?
Custom authentication logic is where upgrades fail in production. Each policy needs a test case, not a visual check of the admin console.
Q4
Some of our ISIM adapters are custom. What happens to the ones with no Verify Governance equivalent?
Older custom adapters may need rework in Verify Identity Governance. Knowing which ones early keeps provisioning from going dark at cut-over.
Q5
Who will run the platform after you leave?
IBM Verify skills are scarce. A handover with runbooks, or a plan to staff the role, matters as much as the upgrade.

01What is IBM Security Verify called now?

IBM uses IBM Verify for the whole family now. Security Verify Access became IBM Verify Identity Access at version 11.0, and Security Verify Governance is IBM Verify Identity Governance. You'll still trip over ISAM, ISIM and IGI in support pages and URLs.

02Our Verify Access appliances are on 10.0. How urgent is the upgrade?

Patch first, then plan. 10.0.9.4 fixes the October code-execution flaws, but standard support for 10.0.x ended on 30 April 2026 and you now pay for Extended Support, which stops on 30 April 2029. The cost of that contract usually sets the date for the 11.0 move.

03We're on 11.0.3.1. Which version fixes CVE-2026-78406?

Verify Identity Access 11.0.3.2 or Security Verify Access 10.0.9.4. Anything up to 11.0.3.1 or 10.0.9.3 is exposed, appliances and containers alike, and IBM gives no workaround. The same releases also close CVE-2026-109126, the hard-coded credential flaw, so plan one window for both.

04Our governance servers run 10.0. When does IBM stop supporting them?

Standard support ends on 30 April 2028. Extended Support, which costs extra, carries 10.0.x to 30 April 2031. Fix Pack 1 for 11.0 is already out, so you can rehearse the upgrade on a copy of production before the contract question comes up.

05We have hundreds of junctions. How long will the move to 11.0 take?

It depends on how many reverse proxy instances and junctions you run, how much custom authentication you built in AAC or federation, and how many environments need the same change. We export the configuration first and size the work from what is actually there.

06Can you migrate us off ISIM?

Yes. In version 10.0 IBM folded ISIM into what is now Verify Identity Governance. We map ISIM provisioning policies, adapters and workflows to Verify Identity Governance and rehearse the move on a copy of production.

services

Related services

Projects on IBM Verify usually end up touching one of these, so they're worth a look.

you are hereIBM Verify

fact-checked Checked against vendor and official documentation last checked 2026-11-05 content fingerprint e9f73a4c

01Book a 30-minute working sessionsenior engineer
02Talk to an engineer about your setupreply within 24 hours
03See how similar projects wentcase studies

Reviewed by the Cohash team IBM Verify is a trademark of its owner, used here to identify the platform. how we handle facts and data →

next step

Tell us what you're running. We'll tell you what we'd do first.

A 30-minute working session with a senior engineer. No slides.

Book a working session See the case studies

useful to bring

The platform and the version you're on
Where you need to get to, and by when
What's custom: rules, plugins, integrations
Any audit finding or deadline driving it

Patch IBM Verify now, then get off the versions IBM is about to stop supporting.

From the first call to a setup your own team can run.

Why teams reach out

How we solve it

Our approach

What changes

Our IBM Verify work

Verify Identity Access 11.0 upgrades

Verify Identity Governance upgrades

ISIM and IGI migrations

IBM Verify SaaS integration

Adapter development and support

IBM Verify situations we walk into

IBM Verify case studies

IBM ISIM, Oracle OIM or homegrown provisioning to SailPoint or Saviynt

How a IBM Verify engagement runs

Version and support inventory

Configuration export

Rebuild and rehearse

Cut-over and handover

Where AI fits on IBM Verify, and where it needs guardrails.

IBM Agent Identity (public preview)

IBM Verify Identity Protection

AI help with Verify Identity Access upgrades

Where IBM Verify sits between your users, your apps and the accounts behind them

Typical IBM Verify projects

What a IBM Verify engagement leaves behind

Certified engineers, wherever you need them.

Onsite

Nearshore

Offshore

All time zones

Questions to ask any partner, including us.

Do we have appliances or servers on Extended Support today, and what will it cost to stay?

Which junctions and federation partners would you delete before the upgrade, and how would you prove nobody uses them?

How will custom AAC policies and mapping rules be tested on 11.0?

Some of our ISIM adapters are custom. What happens to the ones with no Verify Governance equivalent?

Who will run the platform after you leave?

Related services

Tell us what you're running. We'll tell you what we'd do first.