Topic starter
01/08/2026 10:46 pm
TL;DR: Up to 80% of enterprise applications sit outside traditional SSO and remain largely invisible to security teams, according to Unixi, while password managers do little to enforce policy, prevent phishing, or offboard users cleanly. The deeper issue is identity sprawl beyond governed control, not simply weak user behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by Unixi: “The Great Password Manager Myth”.
By the numbers:
- even in mature organizations, up to 80% of the application stack exists outside of traditional SSO and thus beyond the view and control of security teams
Key questions
Q: What breaks when access sits outside SSO and the IdP cannot govern it?
A: When access sits outside SSO, the identity provider no longer has authority over the full lifecycle of the account.
A: Encrypted vaults can still be dangerous because the surrounding metadata often reveals which users belong to which SaaS apps, along with duplicate passwords.
Q: How should teams handle shared and utility accounts that sit outside normal identity workflows?
A: Treat shared and utility accounts as governed assets with named owners, documented purpose and a defined revocation path.
Practitioner guidance
- Map the unmanaged application estate Create a separate inventory for non-SAML apps, shared utility accounts and shadow SaaS that sit outside the identity provider.
- Differentiate vault storage from lifecycle control Review every password vault deployment to confirm it does not get treated as an access governance control.
- Assign explicit owners to shared accounts For shipping, security, social and root-style accounts, name a business owner, define approval rules and require periodic review.
Bottom line: The article argues that SSO does not remove access risk when large parts of the application stack remain outside federation and lifecycle control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:55 pm
Identity dark matter is a governance failure, not a user habit problem. The article’s central point is that large parts of the access estate remain outside federated control even in mature environments. That means the programme is not missing only stronger passwords or better user training, it is missing authoritative coverage of where identity actually lives. The practitioner conclusion is to treat unmanaged access as a structural governance gap, not a behaviour issue.
A question worth separating out:
Q: When does SSO coverage give a false sense of security?
A: SSO coverage becomes misleading when the visible federated apps are treated as the whole estate. If business portals, shadow SaaS and shared logins still authenticate locally, the programme is only governing part of the environment. Teams should assume coverage is incomplete until they can prove where access actually terminates.
👉 Read our full editorial: Identity dark matter shows why SSO and vaults miss core access risk