TL;DR: Average confidence in knowing every self-hosted or disconnected app was 2.2 out of 5, while nearly 80% of participants said they do not know what they do not know, underscoring how unmanaged apps, orphaned tokens, and drifting service accounts are outrunning visibility, according to Orchid Security. The real issue is not more automation, but governance that can see and contextualise identity behaviour before drift becomes systemic.
At a glance
What this is: This is a CAB-based identity governance analysis showing that unmanaged applications, orphaned tokens, and drifting service accounts are expanding faster than enterprise visibility.
Why it matters: It matters because IAM teams cannot govern what they cannot inventory, and hidden identity surfaces weaken access reviews, privilege control, and onboarding discipline across both human and machine estates.
Context
Identity dark matter is the unmanaged or partially governed identity surface that sits outside normal IAM visibility, including disconnected applications, orphaned tokens, and drifting service accounts. The article argues that this hidden layer is now expanding faster than visibility, so programmes built around known assets are no longer seeing the full identity estate.
The governance gap is not just technical discovery. It is a control problem: if app onboarding, privilege review, and machine identity oversight depend on a complete inventory, then any blind spot becomes a permanent exception rather than a temporary gap. The CAB feedback suggests that this is now a common operating condition rather than an edge case.
Key questions
Q: How should IAM teams handle identity dark matter they cannot fully inventory?
A: Start by assuming partial visibility is a control failure, not just a discovery gap. Build a map of disconnected apps, orphaned tokens, and service accounts that sit outside normal onboarding, then tie each one to an owner, authentication path, and business function. Without that inventory, recertification and lifecycle enforcement will keep missing the identities that matter most.
Q: Why do hidden service accounts and orphaned tokens increase governance risk?
A: Because they remove the visibility needed to judge ownership, scope, and drift. A credential that is still active but no longer governed can keep authenticating long after the programme has lost track of who created it, why it exists, or whether its access still matches the business need.
Q: What are the signs that identity visibility is failing in practice?
A: Common signs include repeated escalations that cannot be scoped quickly, stale entitlements that still appear usable, and service accounts or contractors that lack clear ownership. If responders must open multiple tools to answer what an identity can reach, visibility is fragmented and the control is not operationally ready.
Q: How should organisations decide which hidden identities to remediate first?
A: Prioritise the identities with the highest impact potential: the ones that can reach the most sensitive systems, change behaviour without notice, or create the largest blast radius if compromised. That is a better triage model than sorting by role names, ticket age, or which application was easiest to discover.
Technical breakdown
Why disconnected identity surfaces evade IAM control
Identity governance tools are only as complete as the systems they can observe. Self-hosted applications, disconnected platforms, and shadow integrations often authenticate outside the normal provisioning and review workflows, so the IAM layer sees the account or token but not the application behaviour behind it. That makes discovery, ownership, and lifecycle enforcement fragmentary. The result is not just a missing inventory item. It is a control plane that cannot tell whether the identity is active, stale, or dangerously over-scoped.
Practical implication: teams need application-layer discovery that ties identities back to real authentication paths and owners.
How drift turns hidden identities into governance debt
Drift is the gradual divergence between what the programme believes is true and what the system is actually doing. In this article, that shows up in service accounts, tokens, and permissions that change between audits, often without a corresponding governance event. Once drift is invisible, recertification becomes retrospective rather than preventive. This is especially problematic in hybrid estates where machine identities move faster than manual review cycles.
Practical implication: governance teams should track drift as a live control signal, not a quarterly audit finding.
Why privilege must be judged by impact potential
A title or role name is a poor proxy for risk when machine identities, API keys, and background processes can reach critical systems silently. Contextual privilege scoring measures what an identity can reach, how it behaves, and what the blast radius would be if it were compromised. That approach shifts the control question from 'who has access?' to 'which identity would hurt most if it failed?'. For dark matter environments, that distinction is decisive.
Practical implication: prioritise remediation by impact potential, not by whether the identity looks administrative on paper.
NHI Mgmt Group analysis
Identity dark matter is now a governance category, not a metaphor: the article shows that unmanaged applications, orphaned tokens, and drifting service accounts are large enough to distort programme assumptions. Once those identities sit outside the visible estate, access governance becomes partial by design. Practitioners should treat hidden identity surfaces as an inventory and control-plane problem, not an isolated hygiene issue.
Context is becoming the real control boundary: the article’s emphasis on App DNA reflects a broader shift in identity security from counting accounts to understanding behaviour. That matters because the same credential can carry very different risk depending on what the underlying application does and how it authenticates. Teams that cannot correlate identity to application behaviour will keep over-managing low-risk objects and under-managing high-risk ones.
Privilege is no longer a hierarchy problem: a forgotten API key or background process can carry more operational risk than a human administrator. This reframes privilege as impact potential, which aligns better with machine identity reality than role-based assumptions alone. The practitioner lesson is to score identities by reachable systems, behavioural drift, and compromise blast radius.
Identity onboarding is being priced by uncertainty: the article’s $12,000 to $15,000 per app estimate shows that lack of visibility directly inflates governance cost. When teams must first teach owners how an app authenticates, the programme is paying for discovery after the fact. That is a strong signal that onboarding models built for known, managed assets do not scale to dark matter estates.
Visibility is necessary but not sufficient: seeing hidden identities is only the first step, because the real challenge is deciding which ones matter and what context changes their risk. That is where governance programmes need to mature from detection-led reporting to risk-led prioritisation. The field should expect identity operations to converge with application telemetry and contextual risk scoring.
What this signals
Identity dark matter changes the operating model for IAM teams: programmes that rely on complete inventories, periodic reviews, and clean onboarding workflows will keep missing the identities that sit outside those assumptions. The practical shift is toward continuous discovery tied to application behaviour, because visibility without context still leaves the highest-risk identities unmanaged.
App-layer telemetry becomes a governance input: once teams can correlate authentication paths with ownership and usage patterns, identity programmes can start separating noise from risk. That is especially important in hybrid environments where service accounts, tokens, and disconnected applications evolve faster than manual governance cycles.
Contextual privilege scoring is emerging as the more useful control model: hidden identities are not all equal, and the ones with the biggest blast radius deserve first attention. A mature programme will rank identities by reachable systems and behaviour, not by whether they sit in a human, machine, or application bucket.
For practitioners
- Map hidden identity surfaces Inventory self-hosted apps, disconnected systems, orphaned tokens, and drifting service accounts that do not flow through standard IAM onboarding.
- Correlate identity to application behaviour Capture application-layer authentication and authorisation patterns so each identity can be linked to the systems it actually reaches and how it behaves.
- Treat drift as a live control signal Track changes in permissions, token use, and service-account behaviour continuously rather than waiting for quarterly access reviews to surface them.
- Prioritise by impact potential Score identities by reachable systems, behavioural anomaly, and likely blast radius so remediation work follows exposure, not titles or manual backlog order.
Key takeaways
- Identity dark matter describes the unmanaged identity surface that conventional IAM programmes do not fully see or govern.
- The article’s polling shows that confidence in knowing every self-hosted or disconnected app is low, while uncertainty about what is unknown is widespread.
- The control answer is better discovery plus contextual prioritisation, so teams can govern hidden identities before drift turns into systemic exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Orphaned tokens and drifting service accounts persist after governance should have ended. |
| NHI-05 — Overprivileged NHI | The article centers on identities whose impact potential exceeds their visible governance. | |
| NHI-09 — NHI Reuse | Disconnected apps and reused identity patterns are part of the hidden estate problem described here. | |
| Recommendation — Map hidden identities to NHI-01 and revoke those that no longer have a clear owner or business need. Apply NHI-05 to rank service accounts and tokens by reachable systems and blast radius. Use NHI-09 to find repeated identity patterns that mask ownership and complicate lifecycle control. | ||
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems are inventoried | The article’s core gap is incomplete inventory of identity-connected applications and accounts. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | Hidden identities become risky when permissions are not continuously understood in context. | |
| Recommendation — Extend inventory processes to cover disconnected apps, tokens, and service accounts as governed assets. Review identity permissions in context of actual application behaviour and reachable systems. | ||
| NIST SP 800-53 Rev 5 | AC-2 — Account Management | The article highlights unmanaged accounts and lifecycle blind spots across the identity estate. |
| IA-5 — Authenticator Management | Orphaned tokens and drifting service accounts are authenticator lifecycle issues. | |
| Recommendation — Enforce account ownership, lifecycle tracking, and removal criteria for every non-standard identity. Manage tokens and service-account credentials as lifecycle-bound authenticators with explicit renewal and revocation. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Unmanaged tokens and service accounts can be abused to preserve access and expand reach. |
| Recommendation — Map hidden identity exposures to credential-access and lateral-movement detection logic. | ||
Key terms
- Identity Dark Matter: Identity dark matter is the hidden mass of old grants, unused credentials, and inherited access that exists in an environment but is not actively understood. In NHI programmes it becomes dangerous because autonomous systems can discover and reuse it at machine speed.
- Application-layer telemetry: Telemetry collected from the application itself rather than only from perimeter or directory systems. It shows how an app authenticates, authorises, and behaves in practice, which makes it useful for discovering hidden identities and validating whether onboarding records are accurate.
- Contextual privilege scoring: A way of judging privilege by what an identity can reach, how it behaves, and how much damage it could cause if compromised. It shifts the focus away from role titles and raw permission counts, which often understate the real blast radius of machine identities.
- Identity Drift: Identity drift is the gap between the access path originally approved and the behavior that exists later. For browser extensions, drift can appear through updates, remote configuration, publisher changes, or permission expansion, turning a trusted integration into a materially different risk.
Deepen your knowledge
NHI governance, machine identity security, and identity lifecycle management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 6, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org