Topic starter
10/06/2026 11:22 pm
TL;DR: Most organisations can identify apps behind SSO, but far fewer can see the shared and sensitive logins teams use outside it, creating governance blind spots that complicate revocation, rotation, and auditability, according to 1Password. The underlying issue is that zero trust breaks down when credential-based access sits outside the control plane, not because the apps themselves are hard to secure.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “New integrations between 1Password SaaS Manager and EPM”.
Key questions
Q: What breaks when shared logins sit outside SSO governance?
A: Shared logins outside SSO break inventory, ownership, and revocation discipline.
Q: Why does non-SSO access create a governance gap for identity teams?
A: Non-SSO access creates a governance gap because authentication telemetry and credential governance are not the same thing.
Q: How can security teams tell whether credential governance is mature enough?
A: Look for measurable controls, not claims of modernisation.
Practitioner guidance
- Map non-SSO credential estates Inventory shared and sensitive logins across vaults, browsers, and unmanaged repositories so you know which access paths sit outside SSO governance.
- Correlate vault data with SaaS usage Use credential storage signals and SaaS activity together to identify applications that are being used with credentials the IT team does not currently govern.
- Build role-change and offboarding workflows Require transfer of account control, followed by revocation and credential rotation, whenever an employee changes role or leaves the organisation.
Bottom line: The core issue is not that SSO fails, but that many organisations still govern only the federated portion of access while credential-based paths remain fragmented.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
12/06/2026 5:17 am
SSO visibility is not the same as access governance. The article shows that most organisations can account for apps behind SSO, yet still lack control over shared and sensitive logins that live elsewhere. That is a governance blind spot, not a mere tooling gap, because the control plane stops where credential-based access begins. Practitioners should treat non-SSO access as a separate governance domain with its own inventory and lifecycle rules.
A few things that frame the scale:
- 73% of vaults are misconfigured, leading to unauthorised access and exposure of sensitive data, according to the Ultimate Guide to NHIs.
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
A question worth separating out:
Q: What is the difference between SSO governance and credential governance?
A: SSO governance controls federated authentication into applications, while credential governance controls the secrets, shared logins, and access paths that remain outside federation. The first is about identity assertion at sign-in. The second is about custody, visibility, rotation, and revocation of the credentials that still authorize real access.
👉 Read our full editorial: Zero trust beyond SSO exposes the real credential governance gap
This post was modified 2 days ago by NHI Mgmt Group