Topic starter
14/09/2026 10:09 am
TL;DR: Disconnected legacy applications still block recertification and provisioning at scale, and Opnova says one bank cut 15,000 manual tickets while shrinking six-month connector work into hours. The real issue is not automation speed, but governance coverage across the long tail of applications that IGA tools cannot reach.
Editorial analysis by NHI Mgmt Group, based on content published by Opnova: “Closing Identity Governance's Last Mile: Sinan Eren on Opnova's Black Hat Win”.
By the numbers:
- A bank can burn through three to five million dollars and still only cover 20 to 30 percent of its footprint.
Key questions
Q: What breaks when applications are disconnected from IGA workflows?
A: Recertification, provisioning, and audit evidence break first because the governance system can no longer observe or enforce entitlements on those applications.
Q: Why do disconnected apps create so many audit problems?
A: Because auditors need proof that access was granted, reviewed, and revoked consistently, not just a statement that policy exists.
Q: How should IAM teams prioritise disconnected application remediation?
A: Start with systems that are business critical, heavily privileged, or tied to quarterly access reviews, because those create the highest risk if they remain outside governance.
Practitioner guidance
- Inventory disconnected application coverage Identify every application that still depends on manual admin actions, flat files, or CSV exports, and classify each one by business criticality and governance gap.
- Measure recertification failure points Track which entitlements cannot be certified on schedule because the application is unreachable from the IGA workflow, and use that list to prioritise remediation.
- Standardise learned workflow reviews Require identity engineers to review recorded workflows before production use, especially where the system path includes exceptions, screen changes, or human fallback.
Bottom line: Disconnected applications remain a structural weak point in identity governance because they sit outside the normal certification and provisioning lifecycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/09/2026 10:10 am
Disconnected applications create governance debt, not just technical debt: identity programmes fail when a material portion of the application estate sits outside standard recertification and provisioning control. The article's core point is that long-tail coverage gaps persist because legacy platforms were never designed to participate in modern governance workflows. The implication is that IGA maturity should be measured by reach, not by the sophistication of the core platform.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How can security teams tell whether automation is helping or harming identity governance?
A: Automation is helping when it reduces manual handling without creating duplicate records, orphaned entitlements, or unclear ownership. It is harming governance when integrations spread identity state across systems faster than teams can validate, audit, and correct it.
👉 Read our full editorial: Identity governance’s last mile: what disconnected apps change