Notifications
Clear all
Topic starter
12/06/2026 9:41 pm
TL;DR: Manual application onboarding can take six to eight weeks per app, leaving hundreds of business systems ungoverned and creating visibility and compliance gaps, according to SailPoint. The real issue is not onboarding speed alone but the governance window that opens whenever accounts remain uncorrelated and least privilege is not enforced.
NHIMG editorial — based on content published by SailPoint: A day in the life with AI-powered identity security: Application onboarding
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- NHIs now outnumber human identities by 144:1 in enterprise environments, a 44% increase year-over-year driven by AI agents, CI/CD automation, and third-party integrations.
Questions worth separating out
Q: How should security teams reduce application onboarding backlog without weakening governance?
A: Start by ranking applications by business criticality, data sensitivity, and access risk, then automate discovery and connector setup for the highest-value targets first.
Q: Why do uncorrelated accounts create so much identity risk?
A: Because an uncorrelated account cannot be reliably tied to an owner, a purpose, or an offboarding path.
Q: What do organisations get wrong about AI-assisted application onboarding?
A: They assume automation can replace the governance judgment that decides what should be onboarded, in what order, and under what permissions.
Practitioner guidance
- Measure onboarding backlog as a governance risk Track how many applications remain outside the identity programme, how long each stays ungoverned, and which business functions they support.
- Require account correlation before access certification Do not let applications move into routine review cycles until identities are mapped to all active accounts.
- Constrain connector defaults before scaling deployment Review default authentication modes, permission scope, and read-write behaviour for every connector.
What's in the full article
SailPoint's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how the discovery connectors and browser extension identify new applications across enterprise systems.
- Practical detail on the Express Setup wizard and the specific configuration flow used to speed connector creation.
- The account correlation workflow, including how the AI recommendations are generated and accepted by admins.
- Examples of the human-in-the-loop guardrails that keep AI recommendations from being committed automatically.
👉 Read SailPoint's blog on AI-powered application onboarding →
Application onboarding with AI: what it means for IAM teams?
Explore further
12/06/2026 11:56 pm
Application onboarding is an identity control, not an admin convenience task. The article correctly frames onboarding as the point where governance either begins or fails. When applications remain outside the identity programme, every later control inherits partial data, incomplete account mappings, and weak accountability. That is why onboarding backlog becomes a security and compliance issue, not merely an operational delay. Practitioners should treat onboarding throughput as a governance KPI, not a service desk metric.
A few things that frame the scale:
- NHIs now outnumber human identities by 144:1 in enterprise environments, a 44% increase year-over-year driven by AI agents, CI/CD automation, and third-party integrations, according to The NHI and Secrets Risk Report.
- Only 5.7% of organisations have full visibility into their service accounts, which explains why onboarding and correlation gaps persist even in mature IAM programmes.
A question worth separating out:
Q: How does application onboarding support zero-trust access decisions?
A: It gives the identity programme the asset inventory, account linkage, and connector controls needed to apply least privilege consistently. Without onboarding discipline, zero trust becomes an aspirational model rather than an enforced one because access decisions are being made against incomplete system knowledge.
👉 Read our full editorial: AI-powered application onboarding exposes the identity governance bottleneck
