Topic starter
14/08/2026 6:38 pm
TL;DR: Audits fail when teams cannot prove who accessed what, when, and why across managed, unmanaged, and shadow applications, according to Orchid Security, which reports that 48% of applications store credentials in cleartext while 44% bypass the corporate identity provider. Continuous discovery and compliance-mapped evidence shift audit readiness from a one-time exercise to an always-on governance requirement.
Editorial analysis by NHI Mgmt Group, based on content published by Orchid Security: “Audit Playbook: Continuous Application Inventory Reporting”.
By the numbers:
- 48% of applications store credentials in cleartext.
- 44% of applications have authentication paths that bypass the corporate Identity Provider.
- 40% of applications lack baseline controls like rate limiting, account lockout and password complexity.
Key questions
Q: What breaks when Shadow IT apps are not in the identity inventory?
A: Identity governance breaks first, because you cannot sanction, classify, or revoke access for applications you do not know exist.
Q: Why do unmanaged applications create audit and compliance risk?
A: They often sit outside central identity controls, so access, session handling, and deprovisioning can happen without a reliable audit trail.
Q: How can security teams know if cloud identity governance is actually working?
A: The clearest signals are fewer unresolved access findings, shorter evidence-collection cycles, lower counts of stale keys, and reduced reliance on manual review.
Practitioner guidance
- Define audit scope across the full application estate Include managed SaaS, on-prem applications, unmanaged apps, and shadow systems in the audit boundary before evidence collection begins.
- Baseline identity controls per application Check each in-scope application for MFA, account lockout, password complexity, session handling, and access enforcement, then compare the results against the required framework.
- Track joiner-mover-leaver events everywhere Confirm that account creation, role change, access approval, and deprovisioning are recorded in both centrally managed and locally administered systems.
Bottom line: Incomplete application inventories are the main reason identity audits fail, because auditors cannot validate controls for systems they cannot see.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:44 pm
Application inventory is now an audit control, not a housekeeping task: Audits fail when the organisation cannot prove the full set of in-scope applications. Managed-only inventories create a false sense of governance because shadow and unmanaged systems can still hold credentials, expose sessions, and retain access paths. The practitioner conclusion is straightforward: if the inventory is incomplete, the evidence is incomplete.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should auditors ask for when access governance spans multiple application types?
A: They should ask for evidence that each in-scope app enforces access controls, records approvals, and supports session and authentication logging. The question is not whether a central platform exists, but whether the application estate can prove control coverage end to end.
👉 Read our full editorial: Continuous application discovery closes audit visibility gaps