Notifications
Clear all
Topic starter
10/06/2026 10:56 pm
TL;DR: Shadow IT is no longer just an app sprawl problem: 52% of employees have downloaded apps without IT approval, and unmanaged SaaS and AI tools can create authenticated access paths that traditional IAM monitoring misses, according to 1Password. The governance issue is not discovery alone, but whether teams can see, review, and revoke non-SSO access before it becomes standing privilege.
NHIMG editorial — here’s why we think this discussion matters
By the numbers:
- 52% of employees have downloaded apps without IT approval.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
Questions worth separating out
Q: How should security teams govern SaaS and AI tools that sit outside SSO?
A: Start by inventorying every out-of-band access path, including OAuth grants, shared credentials, and vendor-specific admin accounts.
Q: Why do unmanaged SaaS apps create identity risk even when users sign in legitimately?
A: Because valid authentication does not equal valid governance.
Practitioner guidance
- Inventory unmanaged SaaS and AI access paths Pull together OAuth grants, browser-extension sign-ins, shared vault credentials, and vendor-specific admin accounts into one reviewable list so you can see where access lives outside SSO and who owns each grant.
- Classify access by lifecycle state Tag each discovered app or tool as approved, tolerated, or orphaned, then assign a named owner and retirement date so the access object can move through joiner-mover-leaver controls instead of remaining in limbo.
- Review OAuth scopes and token lifetime Compare each third-party connection against actual business need, remove elevated scopes where possible, and shorten token lifetime where the tool does not require persistent access.
What to expect at the briefing
1Password's full webinar recap covers the operational detail this post intentionally leaves for the source:
- A live demo of Vault Insights and Browser Insights for discovering risky logins and unapproved app usage.
- The Account Risk Report workflow for prioritising discovered credentials by exposure level.
- Account Governance actions for taking over or remediating sensitive and shared accounts.
- The AI integration walkthrough covering ChatGPT, Claude, Cursor, and Google Gemini lifecycle administration.
👉 Read 1Password's webinar recap on governing SaaS apps and AI tools outside SSO →
Unmanaged SaaS and AI tools outside SSO: are controls keeping up?
Explore further
12/06/2026 4:40 am
Unmanaged access is now a lifecycle problem, not just a discovery problem. The article shows that the real failure is not whether a tool exists outside SSO, but whether it ever enters the governance lifecycle at all. Once access is approved informally and then forgotten, traditional review processes never see it again. That means IAM, IGA, and NHI controls have to govern the same access path from first grant to final revocation, or they are operating on an incomplete estate.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: Who is accountable when unsanctioned AI tools or shadow SaaS access cause an incident?
A: Accountability usually sits with the business owner who allowed the tool, the identity team that failed to govern the grant, and the security function that did not maintain visibility. The clearest answer comes from documenting ownership at the moment access is created and keeping revocation authority explicit.
👉 Read our full editorial: SaaS and AI tools outside SSO expose unmanaged identity risk
