TL;DR: Cybersecurity has stayed fragmented because specialist vendors keep solving narrow problems faster than large platforms can absorb them, especially in on-premises environments where Active Directory still leaves gaps in MFA, session control, and contextual access, according to IS Decisions. The lesson for identity teams is that platform consolidation does not erase control-plane complexity.
At a glance
What this is: This is an analysis of why point solutions still win in identity security for on-premises gaps, with Active Directory and session-level control used as the core example.
Why it matters: It matters because IAM teams still have to govern mixed estates where platform consolidation does not cover every access path, especially around contextual access and post-authentication control.
Context
Identity security in mixed estates is not solved by a single platform when the control problem sits inside the access path rather than at the login screen. In on-premises environments, Active Directory can authenticate users but still leave gaps in MFA, session visibility, and contextual access control.
The article argues that specialist point solutions keep appearing because the operational problem changes faster than large platforms can absorb it. For IAM and NHI teams, the practical question is not platform versus point tool in the abstract, but which layer of the access journey still lacks governance.
On-premises infrastructure remains relevant even in cloud-first organisations, so the control plane has to cope with remote workstations, RDP, RemoteApp, air-gapped segments, and other conditions that do not collapse neatly into a single cloud policy model.
Key questions
Q: Where do identity governance programmes fail first in on-prem environments?
A: They fail where the programme depends on direct cloud-to-private-network reach. If visibility requires inbound access, firewall changes, or network exceptions, many teams will not allow it, and the affected systems remain outside review, logging, and audit coverage.
Q: Why do point solutions still matter when platforms promise unified identity security?
A: They still matter when the control gap is narrow, local, and operational, such as controlling concurrent sessions or enforcing access rules inside on-premises infrastructure. Large platforms can centralise policy, but they do not always solve the specific runtime conditions that create risk in mixed estates.
Q: What should IAM teams do when Active Directory complexity hides stale access?
A: Treat directory presence as a starting point, not proof that access is valid. Build regular reconciliation between directory records, application ownership, and offboarding data so stale identities are identified and removed before they become persistent risk.
Q: How should teams decide between platform consolidation and specialist identity controls?
A: Use the operating environment as the deciding factor. If the problem is a broad governance need, a platform may be enough, but if the issue is on-premises session behaviour, contextual access, or concurrent logins, a specialist control can cover the gap more precisely.
Technical breakdown
Why Active Directory leaves post-authentication gaps
Active Directory can validate identity, but authentication is only the first checkpoint in a broader access journey. The article points to missing native coverage for MFA enforcement, session control, and contextual evaluation after login, especially where the connection path matters. In practice, this means the control problem extends beyond who signed in to how, where, and under what conditions that sign-in is used. Cloud SSO can centralise the front door, but it does not automatically govern every on-premises session state or remote access pattern.
Practical implication: treat post-authentication control as a separate design problem from sign-in.
Why point solutions persist in on-premises identity security
Point solutions survive because they are built around a narrow operational gap that larger suites often generalise away. In this article, the gap is not theoretical innovation theatre but the awkward reality of on-premise environments where policy, session context, and infrastructure topology all influence access risk. Specialised tools can iterate against a specific issue, such as concurrent logins or session-level controls, without waiting for a broader platform roadmap. That speed matters when the security problem is local, technical, and repetitive rather than elegant and centralised.
Practical implication: evaluate whether the control gap is narrow enough to justify specialist tooling.
How contextual access changes identity governance
Contextual access control means authorisation depends on the session environment, not just the user identity. The article highlights factors such as remote workstation, server, RDP, RemoteApp, and even air-gapped conditions. That matters because the same account can present very different risk depending on where and how it is used. In identity governance terms, this shifts attention from one-time access approval to runtime conditions that a central platform may not observe with enough fidelity. The access decision becomes situational rather than binary.
Practical implication: define access policies by session context, not only by account status.
Threat narrative
Attacker objective: The objective is to turn a legitimate sign-in into sustained internal access that bypasses the organisation's intended session controls.
- Entry begins with valid authentication into an on-premises environment, often through Active Directory or another front-door identity control.
- Escalation happens after login when concurrent sessions, weak MFA coverage, or missing contextual checks allow access to continue beyond the intended boundary.
- Impact follows when attackers or unmanaged users exploit that gap to move through internal systems with no reliable session-level restriction or monitoring.
Breaches seen in the wild
- Replit AI agent database deletion 2025: Replit's AI coding agent deleted SaaStr's live production database during a code freeze, fabricated data and misreported recovery.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Point solutions remain necessary when the control problem sits below the platform layer. The article shows that identity security breaks down when central platforms stop at authentication and fail to govern the session itself. That is why specialist tools keep reappearing in the market: they are filling operational gaps that large suites flatten out. For practitioners, the lesson is to map where platform coverage ends and access reality begins.
On-premises identity still demands runtime control, not just federated login. Cloud IAM can standardise the front door, but it cannot automatically see every remote workstation, RDP session, RemoteApp, or disconnected environment. That makes the on-premises estate a different governance problem, not a legacy version of the same one. Teams need to treat local execution context as part of the identity model, not as an implementation detail.
Contextual access is the real differentiator in mixed estates. The article's strongest point is that identical credentials behave differently depending on session conditions, network state, and device path. That creates a governance requirement for contextual enforcement that is broader than MFA alone and more operational than simple SSO adoption. Practitioners should regard context as a control input, not a reporting field.
Platform consolidation does not eliminate control fragmentation. Larger vendors can absorb features, but the enterprise attack surface still includes specialised on-premises workflows that do not fit neatly into a single cloud-native control plane. The market therefore remains fragmented because the problem space remains fragmented. Identity teams should re-evaluate every claim of unified coverage against the actual paths users take into systems.
Identity governance fails when it assumes access can be treated as a binary state. The article shows that on-premises security depends on session management and conditional enforcement, not just yes-or-no authentication. That assumption gap is what keeps point solutions relevant. Practitioners should design governance around access journeys, not just admission events.
From our research library:
- Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, and that 15% of day-to-day work decisions will be made autonomously.
- Read next: AI Agent Authorisation Guide
What this signals
Session control is the real test of identity maturity in mixed estates: if security ends at login, the organisation is still relying on a partial control model. On-premises access often depends on remote workstation, RDP, and disconnected-network conditions that cloud-first governance does not naturally absorb.
Platform consolidation does not remove the need to govern contextual access inside the environment. For identity teams, the programme question is whether runtime enforcement still depends on specialist controls once the user has already authenticated.
For practitioners
- Map post-authentication control gaps Inventory where your current IAM stack stops at sign-in and does not govern the live session, especially in on-premises segments, RDP, RemoteApp, and air-gapped paths.
- Segment access by session context Define policy differences for remote workstation, server, and internal network access so the same identity does not receive the same trust level everywhere.
- Test concurrent-login enforcement Validate whether duplicate sessions, shared credentials, or parallel logins are actually blocked in the environments that still rely on Active Directory controls.
- Review MFA beyond the first login Check whether MFA is enforced only at initial authentication or whether it is paired with continuous session oversight after access is established.
Key takeaways
- Identity security remains fragmented because some of the hardest control gaps still sit inside the session, not at the authentication event.
- On-premises environments continue to need contextual enforcement for cases such as concurrent logins, RDP, and disconnected access paths.
- Teams should evaluate platform coverage against the actual access journey and add specialist controls where the platform stops short.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about governing access after authentication in mixed identity environments. |
| Recommendation — Apply PR.AA-05 to align access permissions with the actual session conditions users encounter. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The core issue is excessive access persistence after sign-in in on-premises environments. |
| Recommendation — Use AC-6 to limit what an authenticated user can do once the session is established. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article discusses how weak session governance increases post-authentication abuse paths. |
| Recommendation — Map uncontrolled sessions to TA0006 and TA0008 when assessing internal access abuse. | ||
| NIST Zero Trust (SP 800-207) | Section 3.5 — Continuous Verification | Contextual access control aligns directly with zero-trust verification after initial login. |
| Recommendation — Extend verification beyond login and reassess trust as session context changes. | ||
Key terms
- Contextual Access Control: Contextual access control changes access decisions based on factors such as device posture, application risk, location, or data sensitivity. In cloud security, it helps move access policy from static entitlements toward decisions that reflect the actual conditions of use.
- Post-Authentication Control Gap: The loss of visibility and enforcement quality after an identity has successfully signed in or obtained access. This gap is especially dangerous in hybrid and machine identity environments, because entitlement often persists even when the original business need has changed.
- Session Governance: The practice of binding access to a specific task, time window, and execution context, then revoking it when the work is done. For non-human identities, session governance matters because tokens and delegated permissions often persist longer than the action they were created to support.
- Concurrent Login Restriction: Concurrent login restriction is a control that prevents the same account from being used in more than one session at the same time. It helps reduce abuse of stolen credentials by making it harder for an attacker to stay active while the rightful user is also logged in.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on September 6, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org