Notifications
Clear all
Topic starter
05/07/2026 6:47 pm
TL;DR: Modern IGA platforms govern what they can see, but most organisations still miss a large share of their real application and access footprint, according to Zluri's analysis of visibility-first access management. The governance case is no longer about better workflows alone; it is about discovering the full scope before automation and reviews can be trusted.
NHIMG editorial — based on content published by Zluri: Access Management Access Visibility: Why Visibility-First Beats Governance-First
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: What breaks when identity governance starts before access visibility?
A: Governance breaks at the scope layer.
Q: Why do SaaS environments make access governance harder than traditional directories?
A: SaaS adoption happens outside central control through direct signups, free tiers, departmental purchases, and personal accounts used for work.
Q: How do teams know whether access visibility is actually working?
A: They can answer who has access to what across the full environment, including shadow applications, dormant accounts, service accounts, and privileged users.
Practitioner guidance
- Map the complete application estate first Correlate identity provider logs, finance records, browser telemetry, and direct application APIs to build a single inventory before expanding review scope.
- Separate known control scope from actual business usage Document which systems are governed today and which are merely visible in the business, then route unknown applications into a discovery-backed remediation queue.
- Anchor offboarding to hidden access paths Extend leaver workflows to catch direct signups, personal accounts used for work, and service accounts that sit outside standard joiner-mover-leaver processes.
What's in the full article
Zluri's full analysis covers the operational detail this post intentionally leaves for the source:
- A phased 30-day visibility implementation timeline across identity, finance, endpoint, and API sources
- Practical discovery methods for shadow SaaS, including SSO gaps, direct signups, and free-tier tools
- Examples of how access visibility changes provisioning, deprovisioning, and access review scope
- Metrics for measuring application sprawl, dormant access, and governance coverage after discovery
👉 Read Zluri's analysis of why visibility-first access management beats governance-first →
Access visibility and identity governance: where do teams start?
Explore further
05/07/2026 7:05 pm
Access visibility is not an enhancement to identity governance. It is the prerequisite that determines whether governance is real or performative. A programme that can only review known applications is not governing the environment, only the subset it has mapped. That distinction matters across human access, service accounts, and workload identities because the same blind spot lets dormant privilege persist in every actor class. Practitioners should treat incomplete visibility as a scope failure, not a workflow issue.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when hidden applications remain outside governance scope?
A: Accountability sits with the programme owners who accepted partial scope as if it were complete. IAM, IGA, security, and compliance leaders all share responsibility for proving that discovery covers the full estate before they certify access controls or sign off on audits.
👉 Read our full editorial: Access visibility is the missing foundation of identity governance
