TL;DR: IAM adoption now sits at 95% and the market is expected to reach $45 billion by 2032, but Unixi’s analysis shows that scaling identity governance, de-provisioning, password discipline, compliance, and third-party integrations remain the five recurring failure points. The core problem is not IAM coverage, but keeping access decisions aligned with organisational change.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Unixi's blog post: Five IAM pain points grow organisations hit first, with scaling identity governance and de-provisioning emerging as the most persistent control problems.
Why it matters: IAM practitioners should treat growth, role churn, and external integrations as governance stress tests, because access drift and weak control alignment become harder to detect as the organisation expands.
By the numbers:
- IAM adoption is at 95% according to Unixi.
- The IAM market is expected to reach $45 billion by 2032 according to Unixi.
Context
IAM works only when access decisions stay aligned with how an organisation actually changes. Once teams expand, roles shift, cloud services proliferate, and third-party tools multiply, the governance model becomes harder to keep current than the authentication stack itself.
Unixi’s article frames five recurring failure points: scaling identity governance, de-provisioning after role changes, password weakness and sharing, third-party integrations, and compliance reporting. The underlying issue is not whether IAM exists, but whether it still matches the operating shape of the business.
For identity teams, that is the practical divide between deployment and control. The article is about how IAM programmes lose precision as complexity rises, which is where IGA, lifecycle processes, and auditability start to matter more than simple access coverage.
Key questions
Q: Where does IAM fail first when an organisation grows quickly?
A: IAM usually fails first at governance consistency, not at login. When organisations add branches, SaaS apps, and non-human systems, access rules drift from the real operating model. The result is mismatched entitlements, fragmented enforcement, and more manual exceptions, especially where identity decisions are spread across connected platforms.
A: Delayed deprovisioning extends the life of accounts and privileges after a person changes role or leaves, which widens the window for unauthorized access. Manual provisioning also increases error rates and slows enforcement of policy. In practice, that combination creates orphan accounts, dormant access, and audit gaps that are difficult to detect before they are abused.
Q: What are the signs that IAM controls are not keeping pace with operational risk?
A: Common warning signs include excessive permissions, incomplete provisioning, delayed deprovisioning, inconsistent policy enforcement, and weak audit visibility. In cloud and hybrid environments, these gaps often appear when access reviews are irregular or when users retain access after role changes. If identity controls are not regularly tested and reviewed, unauthorized access and privilege abuse become more likely.
Q: How should teams balance IAM integration complexity with resilience?
A: Teams should treat integrations as part of identity governance, not just plumbing. Each link to MFA, SSO, security operations, or device management needs ownership, failure impact analysis, and recovery planning. Otherwise, an outage or misconfiguration can either block legitimate work or weaken access enforcement across the environment.
Technical breakdown
Why identity governance frays as organisations scale
Identity governance is the policy layer that decides who should have access, under what conditions, and in which context. As organisations add offices, cloud services, SaaS applications, and non-human systems, those decisions become harder to centralise because not every platform federates cleanly back to one control plane. The technical problem is not authentication alone, but entitlement consistency across multiple systems with different access models. When location-based rules, device access, and software identities all enter the mix, the governance model has to span more than a single directory.
Practical implication: map where access decisions are still being made outside the authoritative IAM or IGA process.
Why de-provisioning fails after role changes
De-provisioning is the removal of access that no longer matches a user’s current job, team, or status. In growing organisations, that removal often lags behind role change, creating a window where old access remains active even though the business justification has expired. That gap becomes more dangerous when cloud and SaaS applications manage identity separately from the core IAM platform, because stale entitlements can persist beyond the main review cycle. The technical weakness is lifecycle synchronisation, not merely approval workflow.
Practical implication: verify that role changes trigger revocation in every connected system, not only the primary directory.
How third-party integrations change the IAM risk surface
IAM rarely operates in isolation. It depends on integrations with MFA, SSO, security operations, device management, and enterprise applications, which means the control plane is only as reliable as its dependencies. Each integration adds availability risk, configuration drift, and failure modes that can break access for legitimate users or leave blind spots in enforcement. For growing organisations, the challenge is not just connectivity, but governance over the trust relationships between systems that were never designed to age at the same pace.
Practical implication: inventory every IAM dependency and treat integration failure as a governance risk, not just an uptime issue.
Breaches seen in the wild
- Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
IAM success creates its own governance debt: once identity becomes the default control plane, every business change becomes an access-change problem. That is why IAM challenges intensify with scale rather than disappear with adoption. The discipline works best when governance, lifecycle, and integration management are treated as a single operating model, not separate projects.
De-provisioning is the first real test of identity maturity: the article correctly shows that stale access is not a theoretical edge case but a normal outcome when role change outpaces entitlement cleanup. Access that survives a move, transfer, or departure is a lifecycle failure, not merely an admin oversight. The practical conclusion is that revocation precision matters as much as provisioning speed.
Third-party integrations are now part of the identity boundary: IAM no longer ends at the directory or SSO layer. Every connected SaaS app, MFA tool, and device management platform extends the control surface and can also fragment accountability. That shifts the programme from pure access administration toward ecosystem governance.
Compliance exposes whether identity controls are operational or cosmetic: audit readiness depends on whether access can actually be evidenced, explained, and revoked at the pace the organisation changes. When reporting has to cover role churn, BYOD, and external integrations, the quality of the underlying lifecycle model is what determines whether controls stand up in review.
Named concept, governance drift gap: the article points to a gap between the pace of organisational change and the pace at which identity controls are updated. That gap is where excessive access, failed revocation, and audit exposure accumulate. Practitioners should treat it as a structural programme issue, not an isolated IAM defect.
What this signals
Governance drift is the hidden scaling risk in IAM: the more systems and locations identity spans, the easier it is for access rules to lag behind how the business now operates. That makes lifecycle review, role mapping, and exception management more important than simply expanding login coverage.
The practical signal for teams is whether revocation and review still work when identity spans cloud, SaaS, and external integrations. If access cleanup depends on manual reconciliation, the IAM programme is already absorbing organisational change instead of controlling it.
For practitioners
- Tighten identity governance around organisational change Align access approval, role mapping, and periodic reviews to the actual pace of hiring, transfers, branch expansion, and SaaS adoption. The goal is to keep entitlement rules current when the operating model changes.
- Automate revocation after role changes and exits Ensure role changes trigger removal of old entitlements in every connected system, including cloud and SaaS tools that may not inherit revocation from the primary IAM stack.
- Harden password and sharing controls Enforce strong password policy, investigate shared credentials in administrative accounts, and separate high-risk access paths from ordinary user authentication.
- Govern IAM integrations as dependencies Track each integration with MFA, SSO, security operations, and device management as part of the control surface, with ownership and failure impact documented.
- Test audit evidence against live access state Confirm that reports, certifications, and exception records reflect the same entitlements that exist in production, especially where role churn and BYOD complicate reviews.
Key takeaways
- IAM adoption does not eliminate governance risk when organisations scale faster than their entitlement model can keep up.
- Delayed de-provisioning, weak passwords, and fragile integrations are the recurring failure points that turn identity growth into exposure.
- Teams need lifecycle precision, integration oversight, and audit evidence that matches live access state if IAM is going to remain trustworthy.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on entitlement control, role drift, and access cleanup across changing environments. |
| Recommendation — Review entitlements against PR.AA-05 and remove access that no longer matches current job or system context. | ||
| CIS Controls v8 | CIS-5 — Account Management | The de-provisioning and shared-password risks are classic account management failures. |
| Recommendation — Apply CIS-5 to ensure accounts are disabled, reviewed, and separated when roles or employment status change. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Role changes and stale access show the failure of least privilege over time. |
| Recommendation — Use AC-6 to continuously reduce standing access as users move roles or leave the organisation. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article’s de-provisioning problem mirrors offboarding failures for non-human identities too. |
| NHI-05 — Overprivileged NHI | Retained access after role changes is the same overprivilege pattern seen in machine identities. | |
| Recommendation — Apply NHI-01 controls to revoke access promptly when an identity, human or non-human, is no longer needed. Map stale access to NHI-05 and remove unnecessary permissions from identities that outlive their purpose. | ||
Key terms
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
- De-provisioning: De-provisioning is the process of removing access when an identity no longer needs it. In distributed environments, it must reach every connected app, token, and delegated permission, not only the primary login path, or the identity may retain access after the official offboarding step is complete.
- Third-Party App Integration: A third-party app integration is a connection that allows an external service to access data or functions inside another platform. These integrations expand capability, but they also expand trust boundaries, create hidden access paths, and can become a breach route when permissions are excessive or poorly governed.
- Answer Drift: Answer drift is the gradual change in a model’s responses over time, often showing up as reduced consistency or increasing error rates. It can signal degraded grounding, shifting data quality, or prompt and retrieval issues. Monitoring drift helps teams catch reliability problems before they become widespread user-facing failures.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 27, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org