Topic starter
06/06/2026 2:33 am
TL;DR: Thirty percent of enterprise applications are disconnected from identity systems, many of them business-critical, leaving access, audit evidence, and lifecycle controls dependent on manual workarounds, according to Cerby. The maturity gap is no longer about SSO coverage alone, but whether identity programmes can reach the full application estate.
Editorial analysis by NHI Mgmt Group, based on content published by Cerby: “New Ponemon research reveals the risky IAM blind spot most organizations miss”.
Key questions
Q: What breaks when disconnected applications are not brought into identity governance?
A: When disconnected applications sit outside the identity system, provisioning, review, and offboarding become inconsistent and hard to evidence.
Q: Why do disconnected apps create so many audit problems?
A: Because auditors need proof that access was granted, reviewed, and revoked consistently, not just a statement that policy exists.
Q: How should IAM teams prioritise disconnected application remediation?
A: Start with systems that are business critical, heavily privileged, or tied to quarterly access reviews, because those create the highest risk if they remain outside governance.
Practitioner guidance
- Inventory disconnected application coverage Build a separate inventory of SaaS and on-prem applications that cannot currently be governed through SAML, OIDC, or SCIM, and classify them by business criticality, data sensitivity, and access method.
- Separate evidence collection from manual workflows Define a minimum evidence standard for provisioning, access review, and deprovisioning in disconnected apps so auditors are not forced to rely on spreadsheets and screenshots.
- Prioritise business-critical disconnected apps first Focus remediation on the applications that support core workflows or store sensitive data, because those are the systems where manual governance creates the largest exposure.
Bottom line: Disconnected applications create a blind spot where identity controls stop working even though the programme appears mature on paper.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 4:17 am
Disconnected applications are not an edge case, they are a governance boundary failure. Identity programmes often assume that once IdP, MFA, and IGA are deployed, the control plane reaches most of the environment. That assumption fails when applications do not support federation or automated provisioning, because policy cannot be enforced where the control surface ends. The implication is that identity maturity must be judged by coverage, not by control adoption.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How should organisations measure identity maturity beyond access reviews?
A: Measure identity maturity by linking access governance to operational outcomes such as response time, helpdesk demand, and audit effort. A mature programme reduces the time needed to detect and contain identity-driven incidents, while also lowering recurring access friction. If those outcomes do not improve, the programme is producing activity but not control.
👉 Read our full editorial: Disconnected applications are the next identity maturity gap