Notifications
Clear all
Topic starter
14/08/2026 6:38 pm
TL;DR: Audits fail when enterprises cannot prove who accessed what, when, and why across managed, unmanaged, and shadow applications, with the source article citing 48% of applications storing credentials in cleartext and 44% bypassing the corporate identity provider. That makes continuous discovery and evidence mapping a governance requirement, not an audit convenience.
NHIMG editorial — based on content published by Orchid Security: continuous audit-ready evidence for identity controls across applications
By the numbers:
- 48 % of applications store credentials in cleartext.
- 44 % of applications have authentication paths that bypass the corporate Identity Provider (IdP).
- 37 % of applications failed to enforce access controls consistently or at all.
Questions worth separating out
Q: How should security teams prove what identities are actually doing inside applications?
A: They should combine identity governance records with application-layer telemetry, then validate live actions against policy instead of relying on certification alone.
Q: Why do unmanaged or shadow applications create audit failures?
A: They create audit failures because identity controls cannot be proven where the enterprise cannot see the application.
Q: What do security teams get wrong about least privilege in IAM?
A: They often treat least privilege as a policy statement instead of an entitlement design problem.
Practitioner guidance
- Build a live in-scope application register Continuously discover managed, unmanaged, and shadow applications, then tag each one by ownership, authentication path, and compliance scope before the next audit window.
- Map identity controls to each application's actual login path Document whether the app uses the corporate IdP, local authentication, or a bypass path, and retain evidence for MFA, lockout, session handling, and access governance.
- Tie joiner, mover, and leaver records to application events Keep timestamped provisioning, access change, and deprovisioning evidence for every in-scope application so lifecycle claims can be proven during review.
What's in the full article
Orchid Security's full post covers the operational detail this post intentionally leaves for the source:
- Step-by-step audit preparation workflow for defining scope, ownership, and baseline dashboards.
- Per-control evidence mapping for MFA, lockout, session handling, and separation of duties across discovered apps.
- Application-by-application gap analysis against PCI DSS 4.0, ISO 27001, NIS2, and FedRAMP obligations.
- Operational guidance for exporting continuous audit-ready reports and unified identity logs.
👉 Read Orchid Security's analysis of continuous audit-ready identity evidence →
Application inventory gaps and identity controls: are audits failing you?
Explore further
14/08/2026 6:44 pm
Application inventory is now an identity control, not an asset-management task. Audits fail when the organisation cannot prove the full application estate, because identity controls only matter where the enterprise knows they exist. Managed apps are easy to claim, but unmanaged and shadow applications are where evidence collapses first. The practical conclusion is that identity programmes must treat discovery as a control plane, not a one-time inventory exercise.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Which compliance frameworks are most affected by missing application identity evidence?
A: Frameworks that expect traceable access control, lifecycle management, and authentication evidence are affected first, especially PCI DSS 4.0, ISO 27001, NIS2, and FedRAMP. The practical question is not whether the framework mentions the control, but whether the organisation can produce the underlying proof at application level.
👉 Read our full editorial: Continuous application discovery closes audit visibility gaps
