Identity fragmentation across 100+ tools is the real security gap

At a glance

What this is: This is an analysis of why fragmented identity data across 100+ tools creates blind spots for human, machine, and AI-linked access.

Why it matters: It matters because identity teams cannot govern least privilege, offboarding, or exposure reduction if each system sees only a partial access picture.

By the numbers:

• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
• Only 5.7% of organisations have full visibility into their service accounts.

👉 Read Unosecur's analysis of identity fragmentation across 100+ tools

Context

Identity governance breaks down when access lives across cloud platforms, SaaS apps, collaboration tools, and AI-connected services that do not share a common view of entitlements. In that environment, the primary problem is not the number of tools but the absence of correlation across them, which leaves teams unable to answer basic questions about ownership, privilege, and exposure.

For NHI, IAM, and emerging agent governance programmes, this fragmentation matters because service accounts, API keys, tokens, and agent-linked access often accumulate outside the main identity provider. The article's core point is straightforward: without cross-tool visibility, security teams are managing separate access islands rather than an identity estate. That is now the typical enterprise condition, not an edge case.

Key questions

Q: What breaks when identity tools cannot see each other's access data?

A: Access reviews, privilege cleanup, and offboarding all become incomplete because each tool only sees local entitlements. Shadow admins, toxic combinations, and stale access survive when the organisation cannot correlate identity data across systems. The result is not just poor reporting. It is a blind spot in governance that attackers can exploit with legitimate credentials.

Q: Why do disconnected identity systems increase breach risk?

A: Disconnected systems hide overprivileged accounts, orphaned identities, disabled authentication controls, and exposed credentials. Attackers do not need every system to fail, only one unobserved path into the identity graph. Once access relationships are fragmented across tools and teams, security teams lose the ability to assess blast radius or prioritise the right remediation.

Q: How should security teams build a complete identity inventory?

A: Start by reconciling HR, directory, cloud, application, and privileged-access sources into one operating view. Then validate ownership and purpose for each account, especially service accounts and elevated roles. A complete inventory is not a spreadsheet export. It is a continuously refreshed record of what exists, who or what owns it, and whether the access still has a business need.

Q: Who is accountable when a partially offboarded account is still active?

A: Accountability should sit with the system owner who can prove revocation, not with the team that first created the access. When offboarding crosses multiple tools, each owner must validate that their part of the access path is removed. If no one can prove closure, the account should be treated as still live and therefore still risky.

Technical breakdown

Why fragmented identity data creates shadow access paths

Fragmentation creates shadow access because each platform only understands its own entitlements. A user can inherit privilege through nested groups, app-local roles, or indirect permissions that no single console will label as risky. The security issue is not just missing records. It is missing relationships between records, which is what makes privilege paths and toxic combinations visible. In practice, identity governance depends on joining directory, cloud, SaaS, and ticketing signals into one entitlement graph.

Practical implication: build cross-system entitlement correlation before you attempt broad access cleanup or recertification.

How standing privilege survives across disconnected systems

Standing privilege is access that was granted for a task but never removed. In fragmented estates, that access may sit in a cloud role, a SaaS admin group, a service account policy, or a delegated token chain, each with its own lifecycle. The control failure is not the grant itself. It is the lack of a unified revocation model that follows the identity across systems. When ownership changes or a project ends, the stale access remains available for abuse.

Practical implication: map every privileged grant to an owner, expiry condition, and revocation path across all connected systems.

Why AI-connected tools expand the identity surface

AI-connected tools add another layer where access can be created, delegated, and forgotten. Even when the AI component is not fully autonomous, it may interact with data sources, SaaS APIs, and workflow systems under credentials that are hard to trace back to a person or service owner. That makes governance harder because the control boundary is no longer just the directory or the cloud provider. It now includes the tools the model or agent can reach during runtime.

Practical implication: inventory AI-connected access the same way you inventory service accounts and API tokens, not as a separate exception.

Threat narrative

Attacker objective: The objective is to exploit disconnected identity controls to gain durable, legitimate-looking access across multiple systems without triggering coordinated detection.

1. Entry occurs when an identity is created or over-permissioned in one tool that the security team does not monitor in context with the rest of the stack.
2. Escalation happens when indirect group memberships, toxic permission combinations, or stale privileged grants let the identity do more than the original request implied.
3. Impact follows when the attacker or insider uses legitimate credentials to move across systems, access data, or operate undetected because no single tool shows the full path.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Snowflake breach — Snowflake breach compromised Ticketmaster, Santander and others via cloud credential abuse.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity fragmentation is now an entitlement graph problem, not a tooling problem. The core security failure is the absence of a correlated view across cloud, SaaS, collaboration, and AI-linked systems. When access decisions are distributed across tools, teams lose the ability to see privilege paths, toxic combinations, and ownership drift as a single identity event. Practitioners should treat cross-platform correlation as the governance layer, not the reporting layer.

Shadow admins are the natural outcome of local privilege logic. A person or service can become effectively administrative through nested groups, indirect roles, and delegated permissions that look harmless in isolation. This is a structural weakness in siloed IAM and IGA processes, because local policy engines do not understand global privilege context. The practical conclusion is that admin status must be evaluated across the full stack, not inside one platform at a time.

Standing privilege in fragmented estates becomes invisible persistence. Access granted for a temporary purpose often survives because revocation responsibility is split across teams and systems. That means the problem is not merely excess privilege but ownership decay, where nobody is accountable for removal once the original task ends. Identity programmes should therefore focus on lifecycle closure, not just initial grant approval.

Cross-tool visibility changes what least privilege means in practice. In a fragmented environment, least privilege is not a static role design exercise. It is an ongoing exercise in reconciling where access exists, how it is used, and whether it is still justified across multiple control planes. The field should stop treating integration as convenience and start treating it as the condition for governance at all.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
• That visibility gap is why the Ultimate Guide to NHIs should be read alongside remediation planning, not after it.

What this signals

Identity fragmentation will push more teams toward correlation-led governance. The practical shift is away from isolated access reviews and toward joined-up identity intelligence that can connect cloud roles, SaaS permissions, collaboration-tool entitlements, and AI-linked access paths. Without that join, most remediation programmes will continue to miss the accounts that matter most.

Unified visibility is becoming the baseline for lifecycle control. Offboarding, recertification, and privilege right-sizing all depend on knowing where an identity exists outside the primary directory. Teams that still treat peripheral systems as exceptions will keep discovering access after the business thinks it has been removed.

Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs, which means the margin for error in fragmented estates is still extremely large. The governance response is not more manual review, but a control model that can prove ownership and revocation across the full stack.

For practitioners

• Build a cross-system identity inventory Combine directory, cloud, SaaS, ticketing, and collaboration data into one entitlement view so privilege paths can be traced end to end. Include non-human identities, delegated tokens, and app-local admin roles, not just directory accounts.
• Map standing privilege to expiry and ownership Assign each privileged grant an owner, a purpose, and a revocation trigger across every connected system. Prioritise accounts that were created for projects, support tasks, or migrations and never revalidated.
• Reconcile partial offboarding across peripheral tools Check whether departed users, contractors, and project staff still retain access in SaaS, collaboration, and code repositories after their main account is disabled. Treat every missed peripheral system as an active governance failure.
• Extend governance to AI-connected access paths Track which credentials, tokens, and service accounts AI-connected tools can use at runtime, then review them with the same ownership and lifecycle controls applied to other non-human identities.

Key takeaways

• Modern identity risk is increasingly created by fragmentation between tools, not by any single platform in isolation.
• Correlation across cloud, SaaS, collaboration, and AI-connected systems is what turns identity data into actionable governance.
• If revocation and ownership are not traceable across the stack, least privilege and offboarding are only partially real.

Key terms

• Identity Entitlement Graph: A connected view of who or what has access across multiple systems and how those permissions relate to each other. It matters because isolated access lists miss indirect privilege, inherited rights, and toxic combinations that only appear when the full identity path is joined together.
• Shadow admin: A shadow admin is an account or role with elevated privileges that exists outside normal governance, monitoring, or approval workflows. These accounts often appear through cloud sprawl, delegated access, or temporary exceptions, and they create hidden pathways for misuse, accidental overreach, or compromise.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Offboarding: Offboarding is the controlled retirement of a workload, service account, token, certificate, or other non-human identity when it is no longer needed. It includes revoking credentials, removing permissions, and verifying that no residual trust path remains available to attackers.

What's in the full article

Unosecur's full blog covers the operational detail this post intentionally leaves for the source:

• A connector-by-connector view of how the 100+ integrations span cloud, SaaS, ticketing, and AI-related systems.
• Examples of the specific identity exposures surfaced by correlation across tools, including shadow admins and toxic privilege combinations.
• The practical rationale for the minute-scale integration approach and what that changes for onboarding identity sources.
• The article's own walkthrough of how visibility becomes intelligence and then action across a fragmented stack.

👉 The full Unosecur post explains how cross-tool correlation exposes shadow admins, stale access, and identity drift.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.