Topic starter
30/07/2026 10:51 pm
TL;DR: Incomplete identity visibility leaves unmanaged privileged accounts, orphaned service accounts, broken offboarding, and Active Directory complexity in place long enough for attackers to exploit them, according to SPHERE. The central problem is not discovery alone, but the governance gap between finding identities and proving ownership, lifecycle status, and remediation.
Editorial analysis by NHI Mgmt Group, based on content published by SPHERE: “Identity Blind Spots Across Your Core Systems”.
Key questions
Q: What breaks when organisations cannot see all of their non-human identities?
A: What breaks is governance itself.
A: Security teams should prioritize automated rotation where possible, because service accounts and privileged accounts are often missed in manual processes.
Q: How do teams know whether identity hygiene is actually improving?
A: Look for fewer dormant accounts, fewer orphaned privileges, and shorter time-to-removal for leavers and role changes.
Practitioner guidance
- Map every identity to an accountable owner Require a named business or technical owner for privileged accounts, service accounts, and directory-based identities, and block exceptions that cannot be remediated quickly.
- Reconcile discovery with lifecycle status Compare discovered identities against active employment, application ownership, and known service dependencies so orphaned accounts can be classified, not just counted.
- Shorten the remediation window Set operational SLAs for removing stale privileged access and abandoned service accounts, then track time from discovery to revocation as a control metric.
Bottom line: Hidden identity risk emerges when organisations can see accounts but cannot prove who owns them or why they still exist.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:58 pm
Identity blind spots are a governance failure, not just a visibility gap. The central issue is not that organisations cannot search for identities, but that they cannot consistently prove ownership, lifecycle state, and remediation status. That is why unmanaged privileged accounts and orphaned service accounts survive inside supposedly mature identity programmes. The practitioner conclusion is simple: if identity state cannot be proven, it is not governed.
A few things that frame the scale:
- 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
A question worth separating out:
Q: What should IAM teams do when Active Directory complexity hides stale access?
A: Treat directory presence as a starting point, not proof that access is valid. Build regular reconciliation between directory records, application ownership, and offboarding data so stale identities are identified and removed before they become persistent risk.
👉 Read our full editorial: Identity blind spots across core systems create hidden credential risk