Identity dark matter shows why SSO and vaults miss core access risk

At a glance

What this is: This analysis argues that migrating core apps to SSO does not eliminate identity risk because much of the application estate still sits outside governed control.

Why it matters: IAM and security teams need to account for unmanaged apps, shared accounts and shadow SaaS because access risk persists where SSO coverage ends and lifecycle controls do not reach.

By the numbers:

• even in mature organizations, up to 80% of the application stack exists outside of traditional SSO and thus beyond the view and control of security teams

Context

Identity dark matter is the unmanaged portion of an organisation’s application and access estate. In this article, Unixi argues that many teams mistake SSO coverage for identity control, even though large parts of the business still rely on password-based logins, shared accounts and shadow SaaS.

The governance gap is not just visibility. When credentials are stored, copied, reused or left behind outside the identity provider, policy enforcement becomes fragmented and offboarding becomes partial. That is the core IAM problem the article raises, not simply poor password hygiene.

The article also extends the issue beyond classic enterprise apps to utility accounts and unapproved tools, which makes the risk relevant to workforce identity, service access and lifecycle governance at the same time.

Key questions

Q: What breaks when access sits outside SSO and the IdP cannot govern it?

A: When access sits outside SSO, the identity provider no longer has authority over the full lifecycle of the account. That breaks ownership, review and offboarding because the application may still accept local credentials after central policy changes. The result is a parallel access plane that security teams can neither reliably certify nor revoke.

Q: Why do stolen password vaults create so much enterprise risk even when the vault contents are encrypted?

A: Encrypted vaults can still be dangerous because the surrounding metadata often reveals which users belong to which SaaS apps, along with duplicate passwords. That combination gives attackers a ready-made map for account takeover across the SaaS layer. The result is not one broken account but repeated access attempts across many services that security teams may not even know exist.

Q: How should teams handle shared and utility accounts that sit outside normal identity workflows?

A: Treat shared and utility accounts as governed assets with named owners, documented purpose and a defined revocation path. If an account cannot be tied to one accountable lifecycle, it should be removed, replaced or isolated. The key control is ownership plus offboarding, not just stronger secrets handling.

Q: When does SSO coverage give a false sense of security?

A: SSO coverage becomes misleading when the visible federated apps are treated as the whole estate. If business portals, shadow SaaS and shared logins still authenticate locally, the programme is only governing part of the environment. Teams should assume coverage is incomplete until they can prove where access actually terminates.

Technical breakdown

Why SSO coverage stops short of real identity control

SSO centralises authentication for applications that support federation, but it does not automatically govern applications that remain password-based, shared or unmanaged. When an app sits outside the identity provider, its access lifecycle often lives elsewhere, so joining, moving and leaving events are no longer enforced through one control point. That creates a split estate: some identities are policy-managed, others are manually handled, and many are invisible to the security team. The technical issue is not SSO itself, but the assumption that SSO coverage equals full control over access.

Practical implication: teams must map which applications are actually federated and which still rely on local credentials or shared logins.

Why password vaults do not equal governance

A password vault stores and autofills credentials, but storage is not the same as authorisation control. If users can still see, copy or reuse credentials, the vault does not stop phishing, social engineering or password replay. It also does not revoke the target application account when a person leaves, which means the credential repository and the application lifecycle drift apart. In governance terms, the vault manages convenience and retrieval, while the real access decision remains outside its scope. That is why vaults can reduce friction without shrinking the underlying attack surface.

Practical implication: treat vaults as a user convenience layer, not as a substitute for lifecycle revocation or access policy enforcement.

How unmanaged utility accounts become lateral movement paths

Shared shipping accounts, security platform logins, social media profiles and root-style credentials are all examples of identity assets that often escape normal lifecycle and accountability controls. Because these accounts are reused across teams or functions, a compromise does not stay local to one user. Instead, the attacker inherits broad operational access and can move from one business system to another without triggering the normal identity boundaries that SSO and MFA are meant to support. The architectural problem is not only credential secrecy, but the absence of clear ownership and offboarding rules for these accounts.

Practical implication: inventory shared and utility accounts separately from human user accounts and assign explicit owners, revocation rules and review cycles.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity dark matter is a governance failure, not a user habit problem. The article’s central point is that large parts of the access estate remain outside federated control even in mature environments. That means the programme is not missing only stronger passwords or better user training, it is missing authoritative coverage of where identity actually lives. The practitioner conclusion is to treat unmanaged access as a structural governance gap, not a behaviour issue.

Password managers create an illusion of control because they manage secrets, not access. A vault can store credentials and help users retrieve them, but it cannot force policy enforcement on the target application, revoke local copies, or guarantee clean offboarding. That distinction matters because identity governance is about lifecycle control, not just credential storage. The practitioner conclusion is that secret handling and access governance must be designed as separate control layers.

Identity dark matter: unmanaged applications, shared accounts and shadow SaaS create a parallel identity plane that SSO cannot see. Once access exists outside the IdP, the organisation loses a single source of truth for entitlement, ownership and revocation. That makes recertification incomplete and remediation reactive. The practitioner conclusion is that the hidden plane, not the visible SSO layer, defines the real blast radius.

Shared utility accounts are the clearest example of access without accountability. When shipping, security or root-style accounts are shared across people and teams, lifecycle governance breaks because no single user owns the credential or the risk. Those accounts can persist long after the original need has changed, which creates an exposure window that SSO-centric programmes routinely miss. The practitioner conclusion is to govern these accounts as controlled assets, not as informal conveniences.

Unmanaged identity should be measured by revocation depth, not by login count. The article shows that the operational question is not how many users have a password, but how many access paths remain outside policy-enforced lifecycle control. That shifts the programme metric from authentication volume to governance reach. The practitioner conclusion is to measure where offboarding, review and ownership actually terminate.

What this signals

Identity dark matter: security programmes need a control model for the apps and accounts that never enter the IdP, because those assets are where lifecycle governance most often breaks. The practical shift is from cataloguing authenticated users to proving where revocation actually reaches.

The next maturity step is to separate secret storage from access governance in operating metrics. If a tool stores credentials but does not remove the underlying application access, the programme still has unmanaged exposure outside policy enforcement.

Identity provider and SSO governance becomes incomplete the moment teams assume federation coverage equals enterprise coverage. The identity programme should be measured by how much of the estate can actually be owned, reviewed and offboarded.

For practitioners

• Map the unmanaged application estate Create a separate inventory for non-SAML apps, shared utility accounts and shadow SaaS that sit outside the identity provider. Tag each item by owner, authentication method and offboarding path.
• Differentiate vault storage from lifecycle control Review every password vault deployment to confirm it does not get treated as an access governance control. Document which applications still require direct revocation and which still allow local password reuse.
• Assign explicit owners to shared accounts For shipping, security, social and root-style accounts, name a business owner, define approval rules and require periodic review. Shared credentials without ownership should be treated as unmanaged risk.
• Close the offboarding gap for non-federated apps Build a leaver process that identifies accounts outside SSO and confirms the target application access is removed, not just the vault entry. Residual access should be tracked until the application itself is closed.

Key takeaways

• The article argues that SSO does not remove access risk when large parts of the application stack remain outside federation and lifecycle control.
• The most important failure mode is unmanaged identity sprawl across non-SAML apps, shared accounts and shadow SaaS.
• The practical fix is to govern ownership, revocation and review for the hidden estate, not to treat password storage as a substitute for access control.

Key terms

• Identity Dark Matter: Identity dark matter is the hidden mass of old grants, unused credentials, and inherited access that exists in an environment but is not actively understood. In NHI programmes it becomes dangerous because autonomous systems can discover and reuse it at machine speed.
• Federated Access: A delegated access model that lets an AI client act through controlled identity flows instead of embedded long-lived secrets. For agentic systems, federation improves accountability because credentials can be scoped, tracked, and revoked more cleanly.
• Shared Account: An account used by more than one person or process, often for convenience in operational environments. In identity governance, shared accounts weaken attribution, complicate auditing and make it difficult to prove who performed an action during production or maintenance activity.
• Password Vault: A password vault is a central store for user credentials protected by a master secret or device. It reduces user friction, but it also concentrates risk because compromise of the vault can expose many downstream accounts and create a broad identity blast radius.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.