Notifications
Clear all
Topic starter
14/08/2026 6:37 pm
TL;DR: Hidden identity paths persist across large estates, with 48% of applications storing credentials in cleartext, 44% bypassing the corporate Identity Provider, and 37% failing to enforce access controls, according to Orchid Security. The practical lesson is that discovery without flow-level visibility leaves identity programmes blind to the controls attackers actually abuse.
NHIMG editorial — based on content published by Orchid Security: Identity Security Readiness Checklist
By the numbers:
- 48% of applications store credentials in cleartext.
- 44% of applications have authentication paths that bypass the corporate Identity Provider (IdP).
- 37% of applications failed to enforce access controls consistently or at all.
Questions worth separating out
Q: How should security teams map application identity flows across legacy and modern systems?
A: Start by inventorying every authentication path, including local logins, federated login, service-to-service calls, and any exception routes that bypass central IAM.
Q: Why do IdP bypass paths create governance risk for IAM programmes?
A: Because they create a second authentication regime outside the controls that IAM teams expect to own.
Q: What breaks when applications store credentials in cleartext or weak hashes?
A: Rotation, revocation, and accountability become fragmented because the secret is no longer governed as a managed identity asset.
Practitioner guidance
- Map every application authentication path Trace each login, token exchange, and service-to-service credential path back to the authoritative identity control point.
- Remove hard-coded credentials from code and config Search source repositories, deployment manifests, and runtime configuration for cleartext credentials or weak hashing patterns.
- Revalidate access controls at the application layer Do not rely on directory roles alone.
What's in the full article
Orchid Security's full analysis covers the operational detail this post intentionally leaves for the source:
- Application-level findings on which identity controls are most frequently missing across discovered environments.
- The checklist mapping between common application gaps and the top missing identity controls.
- Operational guidance for using continuous discovery to surface hidden authentication paths and embedded credentials.
- Context on how the reported breach examples relate to credential exposure and bypassed identity controls.
👉 Read Orchid Security's analysis of application identity control gaps →
Application identity gaps: what controls are teams missing most?
Explore further
14/08/2026 6:44 pm
Application identity security is now a control-plane problem, not a login problem. When nearly half of applications still store credentials in cleartext and many bypass the corporate Identity Provider, the true trust boundary has shifted into the application estate itself. IAM cannot govern a pathway it does not discover, and that makes application-level identity flow mapping a prerequisite for credible assurance.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which is why hidden application identity paths remain difficult to govern.
A question worth separating out:
Q: Who is accountable when application authentication bypasses the corporate Identity Provider?
A: The application owner, the platform team, and the IAM function all share accountability, but only if the bypass is documented and assigned. If no owner can explain why the exception exists and when it will be removed, the organisation should treat it as an unmanaged identity risk with no clear control boundary.
👉 Read our full editorial: Identity control gaps in applications expose hidden access paths
