TL;DR: KuppingerCole’s 2026 Leadership Compass, according to READI, highlights a structural IGA connector gap: disconnected legacy applications, terminal systems and custom tools remain outside modern governance because RPA and ticketed workarounds break when interfaces change. The real issue is not connector breadth but whether governance can reach the systems where privilege drift actually accumulates.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on READI's blog post: KuppingerCole’s 2026 IGA evaluation shows that disconnected applications remain a category-wide governance gap, especially where RPA and manual workarounds replace durable connectors.
Why it matters: This matters because IAM and IGA programmes are judged on the systems that are hardest to govern, not the ones with clean API coverage and easy certification workflows.
Context
Identity governance still fails most visibly where the application cannot be reached through standard connectors. Legacy platforms, terminal-driven systems, and custom tools create a governance blind spot because the control model assumes the application can be queried, reconciled and remediated through ordinary integration paths.
The practical problem is not just onboarding friction. When access moves through tickets, scripts or human follow-up instead of governed integration, review evidence becomes weaker and revocation becomes slower. NHI lifecycle management matters here because disconnected applications still need the same provisioning, rotation and offboarding discipline as modern systems.
KuppingerCole's 2026 IGA evaluation makes that gap visible across the market rather than in a single product category. The uncomfortable point is that these applications are often the ones with the highest privilege density and the weakest operational visibility.
Key questions
Q: How should teams govern disconnected applications that do not expose APIs?
A: Treat them as governed exceptions with a defined workflow, not as informal manual tasks. The control design should preserve approval, execution, and evidence capture in one path so the identity record stays complete enough for audit and access review.
Q: Why do RPA-based connectors break in identity governance programmes?
A: RPA-based connectors break because they depend on user-interface automation rather than stable application APIs, so small screen, workflow or field changes cause failures and control drift. They also make entitlement mapping, exception handling and audit evidence brittle, because the bot often acts through a shared account or captured session instead of a governed service identity.
Q: What is the best way to handle access reviews for disconnected systems?
A: The best way is to use access-state evidence from the disconnected system itself, such as exports of local accounts, group membership, privilege lists and application logs, then reconcile that data to the identity governance record. Where no API exists, schedule controlled extracts and preserve reviewer attestations so the review is based on actual current access, not stale certification data.
Q: When should organisations prioritise legacy application onboarding over new SaaS connectors?
A: Prioritise legacy application onboarding when those systems still hold critical data, drive business processes, or use brittle credentials that cannot be governed through modern connectors. Legacy platforms often rely on service accounts, static secrets, file shares or local administrator access, so onboarding them first reduces unmanaged access and improves rotation, ownership and revocation across disconnected systems.
Technical breakdown
Why disconnected applications defeat standard IGA connectors
Disconnected applications resist standard IGA integration because they do not expose the same control surfaces as modern SaaS or directory-backed systems. A connector can only govern what it can reliably query, change, and reconcile. When the target is a terminal session, a mainframe screen, or a custom legacy interface, the identity workflow has to infer state from the UI or from indirect signals instead of from an API response. That increases fragility, especially when the interface changes, the workflow depends on a specific screen layout, or the application owner cannot guarantee stable semantics across releases. See the Entitlement Catalogue and Application Onboarding Guide.
Practical implication: Treat disconnected applications as a distinct governance class, not as a minor integration exception.
Why RPA-based governance breaks under interface drift
RPA works by replaying scripted user interactions against an interface. That makes it useful for repetitive tasks, but brittle for governance if the application changes in ways the script does not anticipate. A button relabel, field reorder, or screen refresh can break provisioning, deprovisioning, or reconciliation without the failure becoming obvious immediately. In identity programmes, that creates a hidden backlog: access remains in place even though the workflow appears to exist. The problem is not automation itself, but automation that cannot prove stable control over the target system over time. See the Breach and Attack Simulation (BAS) Guide.
Practical implication: Audit RPA-covered applications for silent workflow breakage and unresolved access changes.
How governance works when the system of record cannot reach the app
In a disconnected estate, the IGA platform may remain the policy authority and system of record, but execution happens through an intermediary layer. That layer must both enact access decisions and feed results back so the governance platform can reconcile what actually changed. Without that bidirectional loop, certification and offboarding become theoretical. Identity teams then know what should have happened, but not whether it did. The architectural question is therefore not only how to extend provisioning, but how to preserve auditability when the target application cannot participate in normal connector patterns. See the IGA Buyer's Guide.
Practical implication: Require reconciliation evidence for every disconnected-app workflow, not just a successful task trigger.
Breaches seen in the wild
- Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
The connector gap is a category problem, not a vendor defect. KuppingerCole's 2026 IGA evaluation surfaces the same limitation across multiple platforms because the hardest applications to govern are often the least cooperative ones. Legacy terminals, mainframes, and internally built tools do not fit the assumptions that standard connector libraries were built around. The implication is that IGA maturity has to be judged by coverage of the difficult estate, not by catalogue size alone.
Disconnected applications concentrate governance risk because they escape normal lifecycle controls. When access must be handled through tickets, scripts, or manual follow-up, leaver actions and recertification lose precision. That creates a durable privilege drift problem in the very systems that usually carry the most sensitive entitlements. Practitioners should treat offboarding latency in disconnected apps as a first-order governance metric, not a back-office inconvenience.
RPA does not equal governable connectivity. Scripted interface automation can extend reach, but it inherits every interface change as a maintenance event. That means the control is only as reliable as the last UI state it was written against, which is not a governance model but a fragile workaround. The lesson for IAM teams is to separate temporary coverage from durable control and to measure both accordingly.
Legacy application governance needs a separate operating model. The right question is not whether a connector exists in theory, but whether the organisation can continuously prove access state, entitlement change, and revocation success in systems that cannot speak modern protocols. That is a governance design issue, not a tooling detail, and it should shape platform evaluation, renewal, and exception management.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
- Read next: NHI Lifecycle Management Guide
What this signals
Disconnected application governance is now a maturity test. IAM teams can no longer measure success by the size of a connector catalogue if the hardest systems still rely on scripts and manual follow-up. The programme signal to watch is whether leaver actions, entitlement changes, and audit evidence can be proven in systems that do not expose modern interfaces.
Connector resilience will matter more than connector count. Legacy application coverage becomes meaningful only when the control survives interface drift, release changes, and ownership turnover. That shifts evaluation away from feature lists and toward operational proof that governance still works after the environment changes.
For practitioners
- Establish a disconnected-application inventory Classify every terminal, mainframe, and custom application that cannot be governed through standard API-based connectors, then assign each one a risk owner and lifecycle path.
- Measure offboarding latency for legacy systems Track the time between a leaver event and confirmed removal of access in applications that rely on tickets, scripts, or manual updates, then escalate exceptions as control failures.
- Require reconciliation evidence for indirect connectors Do not accept a successful automation run as proof of governance unless the identity platform can verify the resulting access state in the target system. See the Access Reviews and Certification Guide.
- Separate temporary coverage from durable governance Use RPA or assisted workflows only where they can be monitored, tested, and replaced, and avoid treating them as equivalent to native connector governance.
Key takeaways
- Disconnected applications remain the weakest point in many IGA programmes because standard connector patterns assume systems that are easier to query and control.
- The governance failure is practical, not abstract: when interfaces drift or manual workarounds replace native integration, access can persist without reliable evidence.
- Practitioners should evaluate legacy-app coverage by confirmed revocation, reconciliation quality, and exception handling rather than by connector catalogue size.
Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · Access Reviews and Certification Guide · Entitlement Catalogue and Application Onboarding Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-06 — Insecure Cloud Deployment Configurations | Legacy governance gaps emerge where applications cannot be integrated through standard identity controls. |
| Recommendation — Map disconnected application exceptions to NHI-06 and close them with governed access paths, not ad hoc scripts. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about entitlement governance across hard-to-reach applications. |
| Recommendation — Apply PR.AA-05 to verify that entitlements in disconnected systems are reviewed, approved, and revoked on time. | ||
| CIS Controls v8 | CIS-5 — Account Management | Disconnected application governance depends on reliable account lifecycle control and removal. |
| Recommendation — Use CIS-5 to govern account creation, review, and removal in legacy systems that lack modern connectors. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Manual and scripted access paths still depend on controlled credential lifecycle and revocation. |
| Recommendation — Apply IA-5 to manage credential lifecycle and revocation for accounts that support disconnected systems. | ||
| MITRE ATT&CK | TA0003;TA0008 — Persistence; Lateral Movement | Lingering access in disconnected applications increases persistence and movement opportunities after compromise. |
| Recommendation — Use TA0003 and TA0008 to hunt for stale access paths in legacy applications and remove them. | ||
Key terms
- Disconnected Application: An application that is not integrated with the organisation's central identity and access stack. Access is often managed through shared passwords, manual approval, or local admins, which makes revocation, evidence, and ownership harder to enforce consistently across the application lifecycle.
- IGA connector: A connector is the integration layer that lets an identity governance and administration platform read accounts, groups, and entitlements from an application and, when permitted, write changes back. In practice, the connector defines whether the governance programme can only observe a system or can also enforce access decisions inside it.
- RPA Connector: An RPA connector is an integration that lets a robotic process automation bot move data between systems or trigger actions in an application. It usually works by screen interaction, file exchange or scripted steps when a direct API is absent, so changes to the interface or workflow can break the automation.
- Reconciliation: Reconciliation is the independent review step that checks whether an action, record, or entitlement matches what should have happened. In IAM and NHI governance, it helps prove that access changes, transactions, and privileged operations were not only performed, but correctly validated by a separate control path.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 5, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org