Notifications
Clear all
Topic starter
10/06/2026 12:17 am
TL;DR: Disconnected applications create an identity governance blind spot because organisations cannot continuously manage who has access to what across the long tail of systems, according to Opnova. The governance problem is not execution speed alone, but the fact that access control assumptions break where platforms cannot reach consistently.
NHIMG editorial — based on content published by Opnova: Happy Second Birthday, Opnova! Celebrating two years of automating identity governance for disconnected applications
Questions worth separating out
Q: How should teams govern disconnected applications that sit outside identity platforms?
A: Treat disconnected applications as a distinct governance tier rather than an exception to be ignored.
Q: Why do disconnected applications create identity governance risk?
A: They create risk because the organisation cannot reliably see, certify, or revoke access through the same control plane used for integrated systems.
Q: What do security teams get wrong about automating governance for legacy applications?
A: They often assume automation alone solves the problem, when the real issue is whether the workflow has authority, auditability, and exception handling across applications that do not share a common identity model.
Practitioner guidance
- Classify disconnected applications by governance criticality Build a segmented inventory that separates natively integrated systems from partially connected and fully disconnected applications, then assign different review and revocation paths to each group.
- Define bounded execution rules for AI-driven operations Before allowing any AI-assisted workflow to touch access state, specify the exact actions it may perform, the systems it may touch, and the exception path when it encounters ambiguity.
- Make audit evidence a release criterion Require every identity governance workflow to produce a traceable record of who initiated the action, what changed, and which application state was observed before and after execution.
What's in the full article
Opnova's full blog covers the operational detail this post intentionally leaves for the source:
- The specific product features behind reflexive memory and video-learning for deterministic execution.
- Details on how the platform is applied to disconnected application workflows in production environments.
- Information on the SailPoint integration and alliance context behind the governance use case.
- The company's framing of its first proprietary computer-use model and how it fits into its roadmap.
👉 Read Opnova's anniversary update on automating identity governance for disconnected applications →
Disconnected applications and identity governance: what teams miss?
Explore further
11/06/2026 2:00 am
Disconnected application blind spots are a governance failure, not a visibility nuisance. The article's central problem is that enterprises cannot manage access consistently across systems that sit outside modern identity platforms. That breaks the assumption that governance can be exercised across the full application estate on a continuous basis. The implication is that identity programmes need a separate operating model for the long tail, not just more reporting.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
A question worth separating out:
Q: How can organisations tell if identity automation for disconnected systems is working?
A: Look for reduced manual handling without losing traceability. If the team can show complete before-and-after access state, clear ownership of each action, and predictable handling of failures, the automation is supporting governance rather than obscuring it.
👉 Read our full editorial: Disconnected application governance is the real identity gap
12/06/2026 3:35 am
Disconnected application blind spots are a governance failure, not a visibility nuisance. The article's central problem is that enterprises cannot manage access consistently across systems that sit outside modern identity platforms. That breaks the assumption that governance can be exercised across the full application estate on a continuous basis. The implication is that identity programmes need a separate operating model for the long tail, not just more reporting.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
A question worth separating out:
Q: How can organisations tell if identity automation for disconnected systems is working?
A: Look for reduced manual handling without losing traceability. If the team can show complete before-and-after access state, clear ownership of each action, and predictable handling of failures, the automation is supporting governance rather than obscuring it.
👉 Read our full editorial: Disconnected application governance is the real identity gap
