TL;DR: The biggest IAM gap is not control design but enforcement gaps around legacy, homegrown, self-hosted, and enterprise-tier-locked applications that sit outside SSO, SCIM, MFA, lifecycle automation, and access reviews, according to Way Security research. The control stack only matters when it reaches every application, including the ones that have been treated as exceptions.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Way Security's blog post: Identity programmes often fail at the last mile because hard-to-integrate applications remain outside enforcement for SSO, MFA, lifecycle automation and reviews.
Why it matters: IAM teams need to treat enforcement coverage as the control objective, because exceptions create blind spots where production access, privileged accounts and deprovisioning gaps persist.
Context
Identity programmes often assume that once SSO, MFA, and provisioning are designed, they apply across the estate. In practice, the hardest applications are the ones most likely to fall outside modern control planes, which means the programme looks complete on paper while enforcement stops at the edge.
The real governance problem is not whether an application can be connected in theory, but whether the stack reaches it in a way that holds over time. For legacy, self-hosted, or enterprise-locked systems, the control gap is usually operational: no live enforcement, no reliable lifecycle integration, and no trustworthy review signal.
Key questions
Q: How should security teams add MFA to legacy apps without changing the origin?
A: Place the authentication decision at the front door, such as CloudFront or another reverse proxy layer, and preserve only the minimum state needed to complete the login flow. Encrypt any temporary data, keep challenge state short-lived, and test the full redirect path so the origin remains unchanged but the sign-in policy is still enforced.
Q: What breaks when identity lifecycle management depends on custom connectors?
A: Custom connectors usually fail when the target application changes its API, data model, or interface. That creates recurring maintenance work, delayed offboarding, and gaps in audit evidence. Over time, the connector becomes a hidden operational dependency rather than a stable control, which means governance quality drops whenever the app vendor ships updates.
Q: How can teams tell whether an access review is based on live data?
A: A live access review is based on the current entitlement state, drawn from the source of truth for identities, roles, groups and privileged access rather than a spreadsheet or cached export. Review evidence should show current assignments, last-updated timestamps, and any pending joiner-mover-leaver changes, so revoked access, orphaned accounts and newly granted rights are visible before approval.
Q: What is the best way to manage applications that fall outside the identity stack?
A: Applications outside the identity stack are managed as governed exceptions, with a named owner, documented access model, and a compensating control where automated provisioning, SSO or SCIM is not available. The exception register should cover authentication method, privileged access, account lifecycle, and periodic review so shadow access does not persist unnoticed.
Technical breakdown
Why custom connectors become integration debt
Hand-built connectors look like a practical bridge until the application changes underneath them. They rely on fixed schemas, manual scoping, and assumptions about how authentication and provisioning will behave over time. When the app updates, the connector can fail quietly, which is worse than a visible outage because access and deprovisioning can drift without an obvious fault signal.
Practical implication: Treat every bespoke connector as a governed dependency with continuous validation, not a one-time implementation project.
How external enforcement changes the identity control model
External enforcement wraps an application with standard identity controls rather than waiting for the application owner to rebuild it. In practice, that means pushing authentication through the IdP, keeping provisioning aligned to source-of-truth lifecycle events, and observing the app from outside so control gaps are visible before enforcement is trusted. The architectural shift matters because the application no longer has to be identity-native to be governed. Read the Ultimate Guide to NHIs: What are Non-Human Identities.
Practical implication: Use externally enforced SSO, SCIM, and lifecycle controls where changing application code is unrealistic.
Why access reviews fail when they rely on stale exports
A quarterly spreadsheet is not a review of live access, it is a snapshot of whatever was exported at a point in time. If provisioning breaks, the review process can still appear healthy while the actual entitlement state has already drifted. That is why review quality depends on current entitlement data, not on the existence of a review cadence.
Practical implication: Base recertification on live entitlement data rather than CSV exports or hand-maintained inventories.
Threat narrative
Attacker objective: The attacker’s objective is to exploit unmanaged application access paths to maintain or expand access to production systems without being caught by standard IAM controls.
- Entry occurs through applications that sit outside standard identity enforcement, where local passwords, stale admin accounts, or ungoverned login paths remain active.
- Escalation follows when provisioning and deprovisioning drift from source-of-truth events, leaving access in place after role changes or departure.
- Impact comes from production data exposure, privileged account persistence, or payment-flow abuse in systems that the identity stack no longer controls.
Breaches seen in the wild
- PyPI secrets exposure 2023: Researchers found 3,938 unique secrets in published PyPI packages, 768 still valid; a new release or yank does not remove them.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Last-mile enforcement is the real IAM boundary: An identity programme is only as complete as the applications it can actually govern. If SSO, MFA, lifecycle automation, and access reviews stop at the exception list, the programme has not failed at design, it has failed at coverage. The practitioner conclusion is simple: measure enforcement reach, not policy intent.
Bespoke connectors create control debt, not just technical debt: When a connector depends on manual scoping and brittle assumptions, the integration becomes a maintenance obligation that can silently weaken governance. That is not just an implementation nuisance, it is an operating model flaw in NHI risk scoring terms because the highest-risk apps are often the least observable. The practitioner conclusion is to treat connector fragility as a risk signal.
Live entitlement state matters more than review cadence: Reviews built from quarterly exports can miss the period when access has already drifted but no one has noticed yet. That means the review process can be procedurally correct while materially ineffective. The practitioner conclusion is to anchor certification in current access data, not exported spreadsheets.
Identity control coverage should be measured by enforcement, not by connector count: A programme can accumulate integrations and still leave high-risk systems outside governed authentication and lifecycle control. The practical distinction is whether the app enforces the identity stack or merely participates in a partial workflow. The practitioner conclusion is to evaluate coverage at the application level, not by how many connectors exist.
Legacy and enterprise-tier-locked applications expose a governance gap, not a protocol gap: The issue is rarely that modern controls do not exist. The issue is that the organisation has accepted a subset of applications as outside the rules because integration looks expensive or inconvenient. The practitioner conclusion is to challenge exception culture before it becomes permanent architecture.
What this signals
Coverage will matter more than policy completeness: Identity teams should expect pressure to prove which applications actually enforce the control stack, not which policies exist on paper. The hard part will be operational proof across legacy and self-hosted systems where integration is expensive and drift is common.
Exception lists are becoming governance liabilities: The more an organisation tolerates partial coverage, the more it normalises apps that sit outside lifecycle and access review discipline. That shifts the programme from control design to exception management, which is a weaker security posture and a harder audit story.
Control enforcement has to move to the application edge: Where native integration is unavailable, the programme needs a way to impose identity controls externally and verify that they continue to hold. Otherwise, the gap between policy and actual access will keep widening as apps evolve.
For practitioners
- Define enforcement coverage as a programme KPI Track how many production applications actually enforce SSO, MFA, provisioning, deprovisioning, and review data, not how many are merely catalogued.
- Classify exception-list applications by control gap Separate legacy, self-hosted, homegrown, and enterprise-locked systems so remediation paths match the reason they fell out of scope.
- Validate connectors against live schema drift Test read paths first, then prove write and provisioning flows in staging before production, and keep monitoring for changes that would break enforcement.
- Replace quarterly exports with live access data Run access reviews from current entitlement state so movers and leavers are assessed against what exists now rather than what was exported last quarter. Read the Ultimate Guide to NHIs: Regulatory and Audit Perspectives.
- Extend lifecycle controls to hard applications Tie joiner, mover, and leaver actions to the source of truth so access changes happen even when the target application has no native identity integration.
Key takeaways
- The core risk is not a missing identity policy, but production applications that sit outside the enforcement boundary.
- Legacy systems, self-hosted apps, and enterprise-tier-locked SaaS can preserve access paths that MFA, JML, and reviews never fully touch.
- Identity programmes need to measure live enforcement coverage and connector reliability, not just integration inventory.
Related NHI Mgmt Group resources: Top 10 NHI Issues · Ultimate Guide to NHIs: What are Non-Human Identities · NHI Risk Scoring Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | Exception apps and brittle integrations create exposure paths similar to vulnerable third-party NHI trust relationships. |
| NHI-05 — Overprivileged NHI | Legacy and unmanaged apps often retain excess access when identity controls do not reach them. | |
| Recommendation — Review external app integrations as governed trust relationships and remove weak or stale dependencies. Reduce standing access in hard-to-integrate applications to the minimum needed for operation. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about whether access permissions are enforced across the full application estate. |
| Recommendation — Verify that permissions and entitlements are enforced consistently across every production application. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | MFA and local password paths are central to the last-mile enforcement gap described here. |
| Recommendation — Apply authenticator lifecycle controls so hard-to-reach applications do not retain weak login paths. | ||
| CIS Controls v8 | CIS-5 — Account Management | Leaver handling and mover updates are core to the JML gaps in exception-list applications. |
| Recommendation — Inventory and manage application accounts so lifecycle changes are reflected everywhere access exists. | ||
Key terms
- Exceptions List: A configuration list of identifier names that a renaming transformation must leave unchanged. It is used when a name cannot be safely rewritten because dynamic references, evaluated strings, or other static-analysis limits could break execution. This provides a practical safety valve for obfuscation workflows.
- Identity Enforcement: Identity enforcement is the act of checking and controlling who or what can access a system, service, or data set. In practice, it uses authentication, authorization, policy evaluation, and session control to confirm identity, apply least privilege, and block actions that violate security rules across human and non-human identities.
- Lifecycle Automation: The automation of identity events such as onboarding, access changes, and revocation so governance follows the full user or account lifecycle. It reduces manual errors, shortens exposure windows, and helps organisations enforce consistent access controls at scale.
- Scim: System for Cross-domain Identity Management is the standard used to exchange user and group lifecycle data between an identity provider and an application. In production, the protocol only solves part of the problem. The harder issue is whether the implementation preserves attributes, order, and tenant scope consistently across real directory sources.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on November 4, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org