TL;DR: Most IGA programmes still govern the 30% to 40% of applications they can see while the 60% to 70% shadow layer remains outside reviews, provisioning, and audit evidence, according to Zluri's analysis. The governance problem is not weak policy design, but incomplete discovery that leaves access truth fragmented across systems and teams.
At a glance
What this is: This guide argues that identity governance breaks when organisations try to certify access before they can see the full application and identity estate.
Why it matters: For IAM, IGA, and NHI teams, incomplete discovery means reviews, offboarding, and compliance reporting only cover a fraction of real access.
Context
Identity governance depends on knowing what exists before deciding who should access it. In this article, the core failure is not weak policy design but incomplete visibility into applications, identities, and entitlements across the environment.
That gap matters because access reviews, provisioning, and offboarding only work against the estate you can discover and map. When visibility stops at the IdP, governance becomes partial by definition and audit evidence starts to diverge from actual access.
The article frames this as an IGA problem first, but the governance lesson extends to NHI and other machine identities as well: if you cannot inventory the subject, you cannot govern its access lifecycle.
Key questions
Q: What breaks when organisations do not have a complete inventory of applications and identities?
A: A partial inventory breaks governance before it breaks technology. Teams cannot consistently onboard apps, map access, detect violations, or prove who has access to what. That leads to shadow applications, stale privileges, weak remediation, and poor audit readiness. In practice, missing inventory means identity controls cover only the known environment while risk accumulates in the rest.
Q: Why do access reviews miss real access in shadow IT environments?
A: Because review scopes usually follow the systems tied to the IdP, not the full application estate. If an application is not discovered, it cannot be placed into certification, and its entitlements are effectively invisible. That makes review completeness dependent on discovery completeness.
Q: How can security teams tell whether IGA coverage is actually complete?
A: They should compare the number of applications in governance workflows with the number of applications found through discovery and network evidence. If those counts diverge materially, the programme is only covering the visible layer. Completeness, not process activity, is the real success measure.
Q: Should organisations prioritise discovery before automation in identity governance?
A: Yes. Automation amplifies whatever inventory it is built on, so automating a partial view only produces faster partial governance. Discovery first gives the programme a complete control surface, which makes reviews, provisioning, and offboarding materially more reliable.
Technical breakdown
Why access reviews fail without complete discovery
Access reviews assume the reviewer can enumerate the full population of identities and entitlements under review. In practice, many organisations only see federated applications in their IdP while team-managed apps, shadow IT, and unfederated systems remain outside the review scope. That creates a structural mismatch between certified access and actual access, which is why audit evidence often covers less than the real estate. The technical issue is not the review workflow itself, but the discovery layer feeding it incomplete data.
Practical implication: validate application discovery before using access certification as evidence of governance.
How shadow applications break provisioning and deprovisioning
Provisioning and deprovisioning workflows are only as complete as the connectors and inventory behind them. When an organisation assumes every meaningful application is tied to the IdP, offboarding may disable the obvious accounts while leaving independent credentials active in unfederated tools. The same gap appears in joiner-mover-leaver processes: role changes update visible systems but leave old access behind in systems the workflow never reached. Over time, that creates access accumulation and orphaned entitlements.
Practical implication: extend lifecycle workflows beyond federated systems and measure offboarding completeness, not just workflow completion.
Why audit evidence diverges from real access
Audit reporting depends on a stable relationship between the inventory, the entitlement model, and the access records. If discovery misses a large share of the application estate, reports will still look clean for the visible subset while the hidden subset continues to carry unmanaged access. That is why the article treats visibility as the foundation of identity governance rather than a nice-to-have feature. Once discovery is partial, every downstream control inherits the same blind spot and becomes less reliable as evidence.
Practical implication: treat incomplete application discovery as an evidence-quality problem, not only a security issue.
NHI Mgmt Group analysis
Visibility is not a supporting control in identity governance. It is the control boundary that determines whether governance exists at all. When organisations certify access against an incomplete inventory, they are not governing the estate, only the portion already mapped by their tools. That distinction matters because IGA can look mature while still missing a large share of actual access. The practitioner conclusion is simple: governance coverage must be measured against the full application surface, not the federated subset.
Access reviews built on IdP visibility create a certification illusion. The process may be procedurally correct, yet still fail to reflect who can reach data through unfederated systems, local accounts, or shadow applications. This is why the article's strongest point is operational, not rhetorical: compliance evidence built on partial discovery will always be narrower than the real risk surface. Practitioners should treat review scope as a discovery problem before it is a policy problem.
Shadow IT is now a governance design problem, not merely a procurement problem. Once teams buy software outside central control, the identity estate fragments into visible and invisible layers with different lifecycle paths. That fragmentation weakens recertification, offboarding, segregation of duties, and auditability at the same time. Identity programmes that do not continuously rediscover the estate will keep producing clean reports for incomplete control coverage.
Access visibility is the named concept that explains why many IGA programmes plateau at partial coverage. The article shows that organisations often automate the visible 30% to 40% and mistake that efficiency for control maturity. The underlying issue is not automation quality but estate completeness, which determines whether governance workflows can touch the full access graph. Practitioners should anchor IGA design around discovery completeness, not tool adoption.
Identity governance and administration now functions as a cross-domain lifecycle discipline, not a standalone compliance layer. The same visibility gap affects human identities, service accounts, and other non-human access paths whenever identity records and application truth diverge. That means recertification, offboarding, and evidence collection must be built around the identity object actually present in each system. The practitioner takeaway is to govern the real estate, not the directory.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Identity Visibility and Intelligence Platforms (IVIP) Guide
What this signals
Discovery completeness is now the decisive IGA maturity signal. Organisations that automate reviews against only the federated portion of their estate will keep mistaking workflow speed for control coverage. The stronger test is whether identity governance can see and govern the same application surface that business users actually touch.
Access visibility debt: this is the point at which unreadable estates turn routine governance into exception handling. Once hidden applications accumulate, offboarding, recertification, and SoD analysis all inherit the same blind spots and become weaker forms of assurance.
Teams should expect the visibility problem to widen as application buying decentralises and identity records fragment across more systems. That makes continuous discovery a governance requirement, not an implementation detail.
For practitioners
- Map the full application estate before certifying access Build a current inventory of all applications, including shadow IT, team-managed tools, and unfederated systems, before relying on access reviews.
- Reconcile IdP records against application logs Compare directory access with application-side evidence so you can see where the IdP undercounts actual users or misses local identities.
- Extend offboarding to non-federated applications Verify that leaver workflows revoke access in systems outside SSO, especially tools where credentials or local accounts persist independently.
- Measure governance coverage as a completeness metric Track the percentage of total applications with discovery, review, and lifecycle coverage, not just the number of apps connected to the IdP.
Key takeaways
- Identity governance fails when review and lifecycle workflows only cover the applications the IdP can already see.
- Zluri's analysis shows the visible layer is often only 30% to 40% of the estate, leaving most access outside routine governance.
- The control that changes outcomes is not a better review checklist but broader discovery that makes the full access graph governable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article shows offboarding fails when unknown apps stay outside lifecycle workflows. |
| NHI-03 — Vulnerable Third-Party NHI | Unmanaged external apps and shadow tools create third-party identity exposure outside governance. | |
| Recommendation — Extend offboarding coverage to every discovered application, not only the IdP-connected subset. Inventory third-party and shadow applications before relying on governance evidence. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing permissions across visible and invisible applications. |
| Recommendation — Map entitlements across the full application estate and verify review scope against actual usage. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle gaps appear when offboarding and provisioning do not reach all systems. |
| Recommendation — Centralise account inventory and removal processes so every application is covered. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Hidden entitlements prevent organisations from enforcing least privilege consistently. |
| Recommendation — Use least-privilege reviews against complete application discovery, not directory-only views. | ||
Key terms
- Access Visibility: Access visibility is the ability to see, in one place, which identities can reach which data, applications, and services. For IAM and data security teams, it is the difference between reviewing isolated permissions and understanding real blast radius across environments.
- Shadow IT: Shadow IT is the use of applications or services outside formal enterprise approval or visibility. In SaaS environments, it often includes department-purchased tools and unsanctioned integrations that create hidden identity, data, and access paths the security team cannot readily govern.
- Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 9, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org