Identity dark matter: what IAM teams miss outside SSO and vaults

TL;DR: Up to 80% of enterprise applications sit outside traditional SSO and remain largely invisible to security teams, according to Unixi, while password managers do little to enforce policy, prevent phishing, or offboard users cleanly. The deeper issue is identity sprawl beyond governed control, not simply weak user behaviour.

NHIMG editorial — based on content published by Unixi: Identity Dark Matter: The Security Risk Hidden Beneath SSO and Password Managers

By the numbers:

• up to 80% of the application stack exists outside of traditional SSO and thus beyond the view and control of security teams.
• 84% of users openly admit to reusing passwords across multiple applications.
• 70% of end users simply avoid the password manager altogether.

Questions worth separating out

Q: What breaks when organisations rely on SSO and password managers as their main identity controls?

A: The control model breaks when major parts of the application estate sit outside federation and the vault only stores secrets instead of enforcing policy.

Q: Why do unmanaged identities increase IAM risk even when SSO and MFA are deployed?

A: Because SSO and MFA only cover interactive human authentication, not the full set of service accounts, secrets, and delegated machine credentials that operate outside login flows.

Q: How do security teams know whether a password vault is actually reducing risk?

A: They should look for three signals: whether the vault is tied to application-level revocation, whether it supports audit evidence for access reviews, and whether users still possess alternate ways to authenticate.

Practitioner guidance

• Map the unmanaged access estate Build an application and credential inventory that includes non-SAML portals, shared utility accounts, shadow SaaS, and AI tools used outside IT oversight.
• Separate storage from enforcement Do not count a password manager as a control unless it is paired with application-level revocation, audit logging, and policy enforcement.
• Extend lifecycle reviews to shared and delegated accounts Include service accounts, shared logins, and utility credentials in access reviews, ownership assignment, and offboarding workflows.

What's in the full article

Unixi's full blog post covers the operational detail this post intentionally leaves for the source:

• The article's full comparison of password vault behaviour versus application-level access control for non-SAML apps
• The specific examples of residual access, offboarding gaps, and shared account misuse that support the argument
• The vendor's architecture claims around Universal SSO and decentralized key handling, which this analysis does not evaluate
• The forensic-audit positioning for identifying unmanaged apps, missing MFA, and shadow SaaS profiles

👉 Read Unixi's analysis of identity dark matter, password managers, and unmanaged access →

Identity dark matter: what IAM teams miss outside SSO and vaults?

Explore further

View Full Forum →  |  NHI Foundation Course →