Notifications
Clear all
Topic starter
06/06/2026 11:26 am
TL;DR: Disconnected apps force manual joiner-mover-leaver workflows that consume thousands of hours, delay access changes, weaken auditability, and leave orphaned accounts active, according to Cerby and customer examples from monday.com and ClickUp. The real issue is not inconvenience but a structural lifecycle gap that keeps governance from reaching critical applications.
NHIMG editorial — based on content published by Cerby: the real cost of manual identity execution in disconnected apps
By the numbers:
- For monday.com, manual identity lifecycle work consumed 3,300+ hours per year and cost over $250,000 annually.
- Fully 20% of licenses were unnecessary, allowing the company to save more than $130,000 annually on app licensing.
Questions worth separating out
Q: How should security teams govern access in disconnected apps?
A: Security teams should treat disconnected apps as lifecycle exceptions and enforce a manual control model that records every joiner, mover, and leaver action.
Q: Why do disconnected apps increase security risk?
A: Disconnected apps increase risk because accounts can remain active after a user leaves or changes role, creating an uncontrolled access window.
Q: How do you know if lifecycle governance is working across all apps?
A: Lifecycle governance is working when access changes are completed quickly, consistently, and with evidence across every application, including the ones outside standard IAM coverage.
Practitioner guidance
- Inventory disconnected applications by lifecycle dependency Classify each app by how joiner-mover-leaver actions are executed today, then flag every system that still depends on tickets, email, scripts, or direct admin work as a lifecycle exception.
- Measure deprovisioning lag by application Track the time between a leaver or mover event and actual access removal in each disconnected app, then prioritise the longest gaps first because they create the largest uncontrolled access windows.
- Reconcile access evidence with application logs For apps outside central identity control, pair access review evidence with local logs and admin records so certifiers can verify who had access and when, even without SIEM integration.
What's in the full article
Cerby's full post covers the operational detail this analysis intentionally leaves for the source:
- Step-by-step examples of the manual workflows teams use for disconnected apps, including tickets, email chains, and direct admin actions.
- Specific cost breakdowns from customer examples, including time spent on provisioning, deprovisioning, and audit work.
- The practical mechanics of extending lifecycle automation to apps without standard identity APIs.
- The full argument for how lifecycle coverage changes audit evidence, access control, and license management.
👉 Read Cerby's analysis of the cost of manual identity execution in disconnected apps →
Disconnected apps and manual lifecycle work: what teams miss?
Explore further
06/06/2026 12:14 pm
Disconnected apps create a lifecycle governance gap, not just an operations burden. The article shows that manual provisioning and deprovisioning are the root cause, while tickets and scripts are only the visible symptoms. Once identity control stops at the boundary of the app estate, access, audit, and cost all degrade together. Practitioners should treat disconnected applications as governance blind spots, not workflow nuisances.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do when an app cannot support identity automation?
A: Organisations should document the gap, assign a named owner, and define a compensating control that covers provisioning, deprovisioning, and review evidence. If the app cannot support automation, it still needs a repeatable governance process rather than ad hoc manual handling.
👉 Read our full editorial: Disconnected apps turn identity lifecycle gaps into security cost
