IBM Security Verify Review: Usage Pricing, Fit and Catches

Short answer: IBM Security Verify, now sold as IBM Verify, fits large enterprises with hybrid estates, legacy web apps and compliance demands that want one vendor for workforce IAM, customer IAM and governance. It does not fit small teams: IBM publishes no prices on its own site, the public AWS contract rate is sold in 100-user blocks, and reviewers report a steep setup.

IBM Security Verify at a glance

Who IBM Security Verify is for

IBM Security Verify fits a 10,000-employee insurer or bank that still runs on-prem web apps behind a reverse proxy, keeps an LDAP directory, and needs modern MFA in front of all of it. IBM's product page lists an Application Gateway that "extends modern authentication to legacy applications without code changes," alongside Verify Directory and Verify Identity Governance (IBM Verify).

It also fits organizations that must run customer identity and workforce identity on one platform. IBM sells Verify Customer Identity and Access Management (CIAM) next to Workforce Identity, and prices SSO, MFA and adaptive access by monthly active users per use case (IBM Verify pricing).

A third fit is a US public-sector agency or contractor. IBM Verify for Government is described as a FedRAMP certified workforce and customer IAM offering (IBM Verify).

Teams already paying for IBM software and support gain one more benefit: fewer vendors in the identity stack.

Who should not buy IBM Security Verify

Small and mid-sized businesses that want a clear per-user price should look elsewhere. IBM's own pricing page publishes no figures, and the public AWS Marketplace listing sells Verify Workforce in units of 100 users at $15,899.29 per unit per year, so a 30-person company pays the same as a 100-person one.

Teams without dedicated IAM engineers should expect friction. Eight AWS Marketplace reviewers between March and June 2026 describe initial setup and configuration as complex, and at least two say the documentation lacks step-by-step guidance for complex environments (AWS Marketplace reviews).

Buyers who need an exit clause in year one should be careful with the marketplace route: the AWS listing states that all orders are non-cancellable and non-refundable.

For lighter needs, compare vendors in the identity and access management category.

Features that matter

Authentication, MFA and adaptive access

IBM Security Verify provides SSO, multifactor authentication and adaptive access, which IBM describes as "adaptive risk evaluation" across authentication, lifecycle governance, delegation, consent and continuous audit (IBM Verify). The IBM Verify mobile app, listed on Google Play and the Apple App Store, is the authenticator most search traffic for the name is actually looking for.

AWS Marketplace reviewers in May and June 2026 repeatedly praise risk-based authentication that weighs device and location context (AWS Marketplace reviews).

Hybrid and legacy application coverage

IBM Verify is unusual in selling both SaaS and self-managed software. The self-managed line, IBM Verify Identity Access v11.0 (formerly IBM Security Verify Access), reached general availability in December 2024 and runs as a hardware appliance, in containers including Kubernetes, or in cloud deployments (IBM release notification).

That release added Microsoft SQL Server and PostgreSQL 16 support, magic link authentication and FIDO2 improvements. Gen2 hardware appliance support ended September 30, 2025, per the same notice.

Governance, privileged identity and directory

IBM lists Verify Identity Governance (provisioning, audit and access reporting), Verify Privileged Identity for privileged accounts across hybrid multi-cloud, Verify Directory, Identity Protection for AI-based identity risk detection, and Verify Trust (IBM Verify). Buying all of these from one vendor is the main reason large enterprises shortlist IBM.

Compliance and government

IBM's Verify SaaS FAQ lists support for SOC 2, SOC 3, ISO 27001, HIPAA and PCI DSS, and points government buyers to the FedRAMP IBM Verify for Government offering (IBM Verify SaaS FAQ). Request the actual reports during procurement; the page does not link them.

Day-to-day admin and scale

A typical IBM Security Verify rollout starts with the 90-day SaaS trial, which IBM's documentation says covers SSO, MFA, analytics, data privacy and consent, and user lifecycle governance for unlimited applications (IBM trial documentation). Use that window to connect your directory, onboard a pilot group and wire up your hardest legacy app first.

Admin console reports from AWS Marketplace reviewers are mixed. At least two reviewers between March and May 2026 describe scattered settings, fragmented dashboards or slow navigation, while others value the visibility into user activity and authentication flows (AWS Marketplace reviews). Two June 2026 reviewers praise the drag-and-drop editor for building authentication journeys.

IBM does not publish API rate limits, bulk provisioning limits or directory sync intervals on the pages reviewed here. Ask for them in the POC, along with RBAC granularity for delegated admins.

Admin tip: decide early whether each app belongs on SaaS or on IBM Verify Identity Access. The two have different licensing models: the v11 notice says Application Gateway consumes processor-based licenses under IVIA.

The fine print

• Licensing tiers and feature gates: IBM sells use cases, not editions. SSO, MFA and adaptive access are priced by total active monthly users per use case; lifecycle and provisioning are priced by total users per use case (IBM Verify pricing).
• SSO and SCIM plan requirements: SSO is a priced use case. Which use case includes SCIM provisioning is not published.
• Agent or extension footprint: the IBM Verify authenticator app is required for push MFA. A Verify Gateway for Windows Login extension exists for desktop MFA (IBM X-Force App Exchange). Resource requirements are not published on the pages reviewed.
• API access by plan: not published.
• Key integrations: IBM does not list Entra ID, Intune, Google Workspace or Okta connectors on the product page reviewed. Not published here; confirm in the POC.
• Data residency and hosting regions: not published on the pages reviewed.
• Compliance reports: SOC 2, SOC 3, ISO 27001, HIPAA, PCI DSS listed; FedRAMP through IBM Verify for Government.
• MSP multi-tenancy: not published.
• Trial realities: 90 days, all use cases, unlimited applications; card requirement not stated.
• Contract terms: AWS Marketplace offers 12, 24 and 36-month contracts, and orders are non-cancellable and non-refundable (AWS Marketplace).

Watch out: the 100-user AWS unit means you pay for headroom. A 120-person workforce needs two units, or $31,798.58 a year.

Support

IBM Security Verify support runs through IBM's documentation hub, the IBM community forum and IBM support pages (IBM Verify SaaS FAQ). The AWS listing names a vendor sales contact and notes that AWS Premium Support covers the AWS infrastructure side only. IBM does not publish a response-time SLA for Verify on the pages reviewed. At least two AWS Marketplace reviewers in May and June 2026 mention documentation gaps for complex scenarios (AWS Marketplace reviews). Ask for the support tier, hours and escalation path in writing.

Exit and lock-in

IBM does not publish an export format, post-cancellation access window or deletion timeline for IBM Verify SaaS on the pages reviewed. Lock-in risk sits mostly in configuration: authentication journeys built in the visual editor, adaptive access policies and gateway rules for legacy apps do not move to another vendor. Standard SAML and OIDC federation keeps app-side changes small, but plan to rebuild policies. Customers on IBM Verify Identity Access keep their own infrastructure, which gives more control over data at exit.

IBM Security Verify pricing

IBM Security Verify has no public price list on ibm.com. The only published list rate found is the AWS Marketplace contract for Verify Workforce.

IBM Verify Workforce on AWS Marketplace, checked September 22, 2026:

At full utilization, one unit works out to about $13.25 per user per month. CIAM pricing is usage-based and not listed on this AWS page. Direct IBM quotes and enterprise agreements may differ; IBM points buyers to a pricing estimator and sales.

Pricing note: figures from the AWS Marketplace listing, checked September 22, 2026; IBM's own page lists no prices.

Security and reliability record

IBM credits researchers from the NATO Communication and Information Agency with reporting the November 2024 flaws. Those CVEs affect the self-managed appliance, not the SaaS service. Uptime for IBM Verify SaaS is not published by the vendor on the pages reviewed.

IBM Security Verify vs the alternatives

Competitor prices will be added when their reviews are published.

Bottom line

Shortlist IBM Security Verify if you run a large hybrid estate with legacy web apps, need CIAM and workforce identity together, or need a FedRAMP option, and use the 90-day trial to prove your hardest app first. Skip it if you have fewer than a few hundred users or no IAM engineer, because the 100-user pricing blocks and setup effort work against you. The verdict flips if IBM quotes you a smaller unit or a cancellable term. Build a side-by-side list with the shortlist builder.