Notifications
Clear all
Topic starter
30/07/2026 10:51 pm
TL;DR: Incomplete identity visibility leaves unmanaged privileged accounts, orphaned service accounts, broken offboarding, and Active Directory complexity in place long enough for attackers to exploit them, according to SPHERE. The central problem is not discovery alone, but the governance gap between finding identities and proving ownership, lifecycle status, and remediation.
NHIMG editorial — based on content published by SPHERE: Identity Blind Spots Across Your Core Systems
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
Questions worth separating out
Q: How do security teams reduce identity blind spots across code and cloud?
A: They reduce blind spots by correlating GitHub activity with cloud identity signals, enforcing least privilege on repository and workflow permissions, and treating exposed secrets as lifecycle events.
Q: Why do orphaned service accounts create so much risk after an acquisition?
A: Orphaned service accounts are dangerous because they often keep working after the original owner has left or the original environment has changed.
Q: What breaks when offboarding does not include secret revocation?
A: The former identity may be removed in IAM while the credential itself remains usable by the ex-employee or by any system that still knows it.
Practitioner guidance
- Inventory every privileged and orphaned identity Reconcile directory accounts, service accounts, and application credentials into a single inventory that records owner, purpose, last use, and business justification.
- Attach lifecycle controls to non-human identities Require provisioning, recertification, rotation, and offboarding for service accounts and API-linked identities using the same governance ownership model as human access.
- Prioritise remediation by privilege and persistence Rank identities by administrative reach, stale ownership, and lack of rotation so the highest-risk blind spots are closed first.
What's in the full article
SPHERE's full article covers the operational detail this post intentionally leaves for the source:
- How the article maps unmanaged privileged accounts to real identity hygiene failure points.
- The specific ways Active Directory complexity creates visibility gaps in large environments.
- Why continuous identity discovery matters operationally when remediation workflows are fragmented.
- The article's own framing of ownership and remediation as the practical next steps.
👉 Read SPHERE's analysis of identity blind spots across core systems →
Core identity blind spots: what IAM teams are missing in practice?
Explore further
30/07/2026 10:58 pm
Identity blind spots are a lifecycle failure before they are a visibility failure. Organisations often treat discovery as the finish line, but discovery without ownership, recertification, and offboarding only creates a longer list of unmanaged identities. The governance problem is that an identity no one owns is already outside control, even if it is still technically visible. Practitioners should treat inventory accuracy and lifecycle accountability as one control domain, not two.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, which makes blind spots far more dangerous once identities are discovered and left in place.
A question worth separating out:
Q: How do teams know whether identity hygiene is actually improving?
A: Look for fewer dormant accounts, fewer orphaned privileges, and shorter time-to-removal for leavers and role changes. A healthy programme can show that identity objects are being retired as fast as business context changes, rather than accumulating hidden access over time.
👉 Read our full editorial: Identity blind spots across core systems create hidden credential risk
