Notifications
Clear all
Topic starter
16/09/2026 9:21 am
TL;DR: 48% of applications store credentials in cleartext, 44% use authentication paths that bypass the corporate IdP, and 37% fail to enforce access controls consistently, according to Orchid Security, underscoring how legacy and acquired apps keep identity risk hidden. The real issue is not discovery alone but proving which application-level identity flows still sit outside governed IAM boundaries.
NHIMG editorial — based on content published by Orchid Security: Readiness Checklist and analysis of missing identity controls
By the numbers:
- 48% of applications store credentials in cleartext.
- 44% of applications have authentication paths that bypass the corporate Identity Provider.
- 37% of applications use outdated or non-standard authentication protocols.
Questions worth separating out
Q: What breaks when applications bypass the corporate Identity Provider?
A: When applications bypass the corporate Identity Provider, central IAM policies stop being the enforcement point.
Q: Why do cleartext credentials in applications create such a high breach risk?
A: Cleartext credentials turn application storage into usable access material.
Q: How do teams know if identity security controls are actually working?
A: Identity security controls are working when teams can show a current view of high-risk entitlements, detect privilege drift quickly, and remove access before exposure spreads.
Practitioner guidance
- Inventory application authentication paths Identify every application that authenticates users or services outside the corporate IdP, including local accounts, legacy protocols, and alternate login routes.
- Eliminate cleartext credential storage Search code, configuration, and supporting services for stored credentials, then replace them with managed secrets or federated identity patterns.
- Modernise protocol exceptions Track every outdated or non-standard authentication protocol as identity control debt, not a temporary compatibility choice.
What's in the full article
Orchid Security's full article covers the operational detail this post intentionally leaves for the source:
- Per-application findings on where cleartext credentials, bypass routes, and non-standard protocols were discovered
- The checklist used to identify missing identity controls across discovered applications
- The broader workflow for continuous discovery, gap analysis, and remediation tracking
- Examples of how acquired or legacy applications can be folded into an identity posture programme
👉 Read Orchid Security's analysis of application identity posture gaps and missing controls →
Application identity posture: are hidden auth flows still slipping past IAM?
Explore further
16/09/2026 9:21 am
Application identity posture is now a first-order governance issue, not a code-quality side topic. The article shows that identity controls can fail inside applications even when the central IAM stack looks intact. That means IAM, IGA, and PAM teams must treat embedded authentication, credential storage, and protocol choice as part of the identity estate, not as separate engineering concerns. The practitioner conclusion is simple: if the application is the enforcement point, it is inside the governance boundary.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
A question worth separating out:
Q: Should organisations prioritise legacy protocol remediation before application consolidation?
A: Yes, when legacy protocols are still carrying active access. Consolidation can reduce sprawl, but it does not remove identity risk if outdated authentication paths remain in production. Remediating the protocols that block federation, lockout, and modern policy enforcement usually delivers the faster security gain.
👉 Read our full editorial: Application identity gaps expose cleartext credentials and IdP bypasses
