Topic starter
11/06/2026 11:13 pm
TL;DR: Access now escapes the control surface of traditional identity tools, according to 1Password’s 2025 Annual Report, which says 52% of employees downloaded apps without IT approval, 73% were encouraged to use AI, and 74% of security and IT professionals said SSO is not enough. The real problem is not adoption itself but governance built for a slower, more visible workplace than the one employees actually use.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “1Password’s Annual Report 2025: The Access-Trust Gap Reveals Widening Access-Trust Gap in the AI Era”.
By the numbers:
- 52% of employees downloaded apps without IT approval.
- 73% of employees were encouraged to use AI.
- 74% of security and IT professionals said SSO is not a complete solution for securing employee identities.
Key questions
Q: How should security teams govern AI tools that connect to SaaS data?
A: Treat each AI tool as a non-human identity with an owner, a defined scope, and an expiry path.
Q: Why do unsanctioned AI tools create so much identity risk?
A: Unsanctioned AI tools bypass the directory, policy, and audit paths that make identity governance work.
Q: What are the signs that access reviews are no longer keeping up with SaaS sprawl?
A: Common signs include long review backlogs, repeated exceptions, unknown applications in use, and licence data that does not match actual business activity.
Practitioner guidance
- Map unmanaged access paths Inventory the SaaS and AI tools employees use outside federated sign-on, then classify which of those paths carry company data or privileged workflows.
- Extend policy to shadow AI Write enforceable rules for approved AI services, prohibited data types, and personal-device use so policy applies at the point of data entry.
- Treat offboarding as access-path removal Verify that prior-employer accounts, unsanctioned apps, and ad hoc sharing links are removed when a user leaves or changes role.
Bottom line: The report’s core message is that identity control is no longer coextensive with authentication, because employees are using tools and data paths that sit outside traditional governance boundaries.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 7:47 am
Access control has become a boundary problem, not a login problem. Traditional IAM was designed to secure known sign-in flows and centrally managed applications. The article shows that workers now use SaaS and AI tools faster than identity teams can catalogue them, which means the real failure is control-plane coverage. The practitioner conclusion is that access governance has to extend to unmanaged applications and non-federated workflows, not only to the managed estate.
A question worth separating out:
Q: What is the difference between SSO and continuous access assurance?
A: SSO authenticates a user to a service, while continuous access assurance evaluates whether the app, device, data type, and policy state still justify that access. In modern SaaS and AI environments, authentication alone does not prove the access path is sanctioned, monitored, or safe for the data involved.
👉 Read our full editorial: The access-trust gap widens as SaaS and AI outpace IAM
This post was modified 1 day ago by NHI Mgmt Group