Topic starter
25/06/2026 12:53 am
TL;DR: EMEA enterprises are seeing identity and access management strain as SaaS sprawl, regulatory fragmentation, and lean teams leave many applications outside core IAM controls, according to Cerby. The result is not just higher risk but a widening operational burden that makes identity debt a governance problem, not only a security one.
Editorial analysis by NHI Mgmt Group, based on content published by Cerby: “Rethinking Identity Security in EMEA: What Israel Can Teach Us About the Future of IAM”.
By the numbers:
- Less than 60% of SaaS applications are integrated into core IAM platforms on average, according to Cerby.
- One Israeli scale-up said more than 25% of its helpdesk tickets were identity-related, according to Cerby.
- An AI-focused Israeli company said bots and automation tools make up 60% of active identities, according to Cerby.
Key questions
Q: What breaks when applications sit outside IAM integration?
A: When applications sit outside IAM integration, provisioning, revocation, and access review become fragmented.
Q: Why do disconnected apps create operational and compliance risk?
A: Disconnected apps create risk because the organisation cannot consistently prove who has access, who owns the account, or whether access was removed at the right time.
Q: What are the warning signs that identity debt is getting out of control?
A: Common warning signs include offboarding that takes days, helpdesk tickets dominated by access issues, large numbers of applications outside the IdP, and unclear ownership for SaaS accounts.
Practitioner guidance
- Map application coverage against IAM integration Inventory every SaaS and internal application, then classify whether provisioning, authentication, and offboarding are centrally enforced or still manual.
- Extend joiner-mover-leaver controls to disconnected apps Require a named owner, a removal path, and a recertification cadence for every application that stores corporate identities.
- Track offboarding latency by application class Measure how long it takes to disable access across integrated and non-integrated apps separately.
Bottom line: Disconnected apps turn IAM into a partial control system, because the most important access paths are often the ones least visible to central governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:57 am
Identity debt is now a first-order governance problem, not a side effect of SaaS growth. The article shows that every unmanaged application creates an ownership, review, and revocation gap that core IAM cannot see unless it is integrated. That makes identity debt structurally different from ordinary IT sprawl because the risk sits in the control plane itself. Practitioners should treat integration coverage as a governance metric, not an implementation afterthought.
A question worth separating out:
Q: How should organisations govern non-human identities in fragmented app estates?
A: Organisations should put machine accounts, automation tools, and bots into the same ownership, inventory, and retirement model used for human identities. The key is to require a business owner, lifecycle visibility, and a revocation path so those identities do not persist beyond the task or system they support.
👉 Read our full editorial: Disconnected apps and unmanaged identities are reshaping EMEA IAM