TL;DR: Large enterprises can have strong identity policies on paper yet still leave major systems outside IGA and PAM coverage because legacy platforms, undocumented permissions, and service-account sprawl do not map cleanly to modern connectors, according to Hydden. The practical lesson is that identity governance fails when data extraction and lifecycle visibility stop at the edge of the infrastructure estate.
At a glance
What this is: This is an analysis of why identity hygiene stalls in large enterprises when modern governance tools cannot see legacy platforms, custom permission stores and service-account sprawl.
Why it matters: It matters because IAM, IGA and PAM programmes only reduce risk when they can ingest reliable identity data from every material system, not just the modern ones.
Context
Large enterprises often have identity policies that look complete on paper, but the real control gap is between policy and infrastructure. When core systems predate modern connectors and standards, governance breaks down because the tools cannot reliably discover accounts, permissions or lifecycle events.
In this case, the challenge is not identity basics in theory, but identity hygiene at scale in heterogeneous estates. For IAM and PAM leaders, the practical problem is continuous visibility into legacy platforms, custom databases and non-human identities that do not fit cleanly into standard connectors.
Key questions
Q: What breaks when identity governance cannot reach legacy and core systems?
A: Access reviews, entitlement discovery, and compliance evidence all become partial. The programme may still operate for modern cloud apps, but the most sensitive systems remain outside its control. That gap creates unmanaged risk, delayed remediation, and audit findings that are harder to defend.
Q: Why do legacy entitlements and service accounts create residual risk?
A: They remain risky because they often persist without ownership, rotation or reliable mapping to business roles. When those identities carry admin or DBA rights, the organisation can believe access is governed while the highest-risk accounts stay outside normal lifecycle controls.
Q: How can IAM teams tell whether access review coverage is actually meaningful?
A: They should measure what was excluded as well as what was approved. A strong completion percentage over a weak denominator hides the systems, roles, and accounts that never entered the campaign, and those blind spots are often where stale access survives longest.
Q: Should organisations prioritise legacy data extraction or new governance features first?
A: They should prioritise data extraction when the existing governance stack cannot see critical systems. New features add little if the underlying entitlement data is incomplete, because visibility is the prerequisite for certification, offboarding and privileged access control.
Technical breakdown
Why modern connectors miss legacy identity data
Modern IGA and PAM platforms are usually built for systems that expose clean APIs, LDAP or SCIM. Legacy environments often store access in proprietary tables, local profiles or application-specific structures that are hard to normalise into a governance model. If the connector cannot reliably map an entitlement to a person, the control becomes partial even if the policy is sound. This is why technical debt in the identity layer becomes governance debt: the system can be secure in one domain and invisible in another.
Practical implication: inventory which critical systems cannot produce trustworthy identity and entitlement data for your governance stack.
Why service-account sprawl defeats identity hygiene
Service accounts are non-human identities that often outnumber human users in older enterprises. They are especially difficult to govern when they are hard-coded into scripts, left orphaned after projects end or granted administrative rights without clear ownership. In that state, PAM may not onboard them and access reviews may never touch them. The issue is not only overprivilege, but unmanaged persistence: credentials live on long after the business reason for the account has disappeared.
Practical implication: treat unmanaged service accounts as a separate governance class, not as a minor subset of user access.
Why point-in-time reviews create identity drift
Quarterly reviews based on manual exports can confirm compliance at a single moment, but they do not keep pace with daily changes in infrastructure and access. Identity drift appears in the gap between an unauthorised change and the next review cycle, especially where manual spreadsheets still mediate approvals. In practice, this means the programme measures snapshots instead of exposure. For large enterprises, the technical failure is not lack of policy, but lack of continuous data flow into the governance engine.
Practical implication: move high-risk systems from manual certification snapshots to continuous or near-continuous identity data feeds.
Threat narrative
Attacker objective: The objective is to use unmanaged or invisible identities to preserve access inside systems the organisation believes are governed.
- Entry occurs through legacy systems, custom databases or scripts that sit outside modern identity tooling and therefore escape normal discovery.
- Credential or account abuse follows when service accounts or local user profiles remain active without ownership, rotation or PAM coverage.
- Impact arrives as invisible privilege accumulation, manual review failure and a widened identity attack surface that the governance stack cannot see in time.
Breaches seen in the wild
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity hygiene at scale fails because policy does not govern what the platform cannot see. Large enterprises often assume written standards translate into enforceable controls across the estate, but legacy systems and custom data stores break that assumption. When entitlement data cannot be extracted and normalised, access governance becomes partial by design. The practitioner conclusion is that visibility, not policy language, is the real limiting factor.
Service-account sprawl is a governance failure mode, not an operational nuisance. In mature estates, non-human identities often outnumber human ones and carry the highest residual privilege. When those accounts are hard-coded, orphaned or unmapped to owners, they become outside the reach of standard lifecycle and certification workflows. The implication is that NHI governance has to be treated as a first-class control plane, not an exception process.
Identity drift is the more accurate measure of enterprise risk than review completion. A quarterly certification can be technically complete while still leaving weeks or months of unauthorised change unobserved. That gap widens when manual data pulls are the only path from infrastructure to the governance engine. Practitioners should read apparent compliance cautiously when source-of-truth data is stale or incomplete.
Persistent identity data bridges are now the real infrastructure for IAM, IGA and PAM. The article points to a named concept we would call the identity data bridge gap: the distance between governed policy and the operational systems that actually hold access truth. If that bridge is missing, organisations buy tooling but do not buy coverage. The field should measure governance by data reach, not by platform deployment.
AI-assisted extraction changes the economics of legacy governance, but not the governance problem itself. The value is in turning unstructured or inaccessible identity records into usable entitlement data faster than manual connector development allows. That does not eliminate the underlying debt in the estate, but it can make the scope visible enough to govern. The practitioner conclusion is to prioritise data extraction pathways where the risk surface is largest.
What this signals
Identity data bridge gap: The enterprise problem is no longer whether a policy exists, but whether the governance stack can consume trustworthy data from every material system. If legacy platforms, custom tables and local profiles stay outside that bridge, IAM programmes will keep producing partial assurance. The practical signal is to treat data reach as a control objective in its own right.
Large estates expose a structural mismatch between the pace of infrastructure change and the cadence of manual reviews. That mismatch creates identity drift, where unauthorised access can persist long enough to matter but not long enough to be captured by a quarterly process. For practitioners, this is a programme design issue, not just an operations issue.
For practitioners
- Map identity data blind spots Identify every critical system that your IGA and PAM stack cannot currently inventory, certify or onboard, then rank them by privilege exposure and business criticality.
- Separate non-human identity governance Create a dedicated inventory and ownership model for service accounts, local system users and script-bound credentials so they are not hidden inside human user review cycles.
- Replace spreadsheet-led certifications Use automated or semi-automated data extraction for legacy platforms where manual access reviews are still the only path to entitlement evidence.
- Establish persistent data bridges Build durable pipelines from legacy and non-standard systems into the governance layer so access changes are observed continuously rather than at audit time.
- Reclassify out-of-scope systems Treat any system that cannot produce reliable identity data as a control gap, not a tooling exception, and escalate it into remediation planning.
Key takeaways
- Large enterprises can have mature identity policy language and still fail to govern the systems that carry the real risk.
- Legacy platforms, custom permission stores and service-account sprawl are the main reasons identity hygiene breaks at scale.
- The deciding control is trustworthy identity data flow into IGA and PAM, not another layer of policy wording.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Orphaned service accounts and retired project credentials are central to the article's risk pattern. |
| NHI-05 — Overprivileged NHI | The article highlights admin and DBA service accounts that remain highly privileged and poorly visible. | |
| NHI-07 — Long-Lived Secrets | Legacy scripts and dormant accounts keep passwords and credentials alive long after their intended lifecycle. | |
| Recommendation — Audit legacy estates for non-human identities that survive project or system retirement and retire them from governance scope. Review high-risk service accounts for privilege creep and remove excess access from unmanaged non-human identities. Replace long-lived credentials with tighter lifecycle controls for legacy service accounts and script-bound access. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about incomplete entitlement visibility and weak certification coverage. |
| Recommendation — Apply PR.AA-05 to ensure entitlements are discovered, reviewed and corrected across legacy and modern systems. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account inventory and lifecycle management are the core control gaps in the piece. |
| Recommendation — Use CIS-5 to inventory, govern and remove stale accounts across both human and non-human identities. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article's examples show how hidden credentials and overprivileged accounts enable attacker movement. |
| Recommendation — Map legacy credential exposure to TA0006 and TA0008 to prioritise accounts that expand attack reach. | ||
Key terms
- Identity Data Bridge: The set of pipelines and mappings that move entitlement, account and ownership data from source systems into governance tools. In large enterprises, this bridge determines whether identity controls are real or only documentary, because policy cannot be enforced on assets the platform cannot see.
- Identity Drift: Identity drift is the gap between the access path originally approved and the behavior that exists later. For browser extensions, drift can appear through updates, remote configuration, publisher changes, or permission expansion, turning a trusted integration into a materially different risk.
- Service-account sprawl: Service-account sprawl is the accumulation of shared or long-lived machine identities that are created for convenience and then reused across teams or workflows. It increases governance friction because the account no longer maps cleanly to one operator, one purpose, or one lifecycle event.
- Time To Governance Coverage: Time to governance coverage is the interval between a new system, entitlement or identity type appearing and that access being brought under policy and review. In mature programmes, the interval is short enough that business change does not create a prolonged blind spot.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 23, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org