Notifications
Clear all
Topic starter
14/08/2026 6:38 pm
TL;DR: IAM gaps often surface as engineering workarounds that preserve delivery speed while creating hidden identity debt, audit pain, and unmanaged access in complex estates, according to Orchid Security. The real failure is structural: compliance-driven IAM assumes onboarding can keep pace with software delivery, but infrastructure teams optimise for uptime and velocity instead.
NHIMG editorial — based on content published by Orchid Security: the overlooked engineering toll of IAM workarounds and identity debt
By the numbers:
- 48% of applications store credentials in cleartext.
- 44% of applications have authentication paths that bypass the corporate Identity Provider (IdP).
- 37% of applications failed to enforce access controls consistently or at all.
Questions worth separating out
Q: How should security teams reduce IAM workarounds in fast-moving engineering environments?
A: Start by moving identity controls earlier in the delivery process, so new applications cannot ship with undocumented access paths.
Q: Why do IAM workarounds create more risk than they remove?
A: They solve a delivery bottleneck by creating unmanaged identity state that security cannot reliably review later.
Q: What breaks when nonhuman identities are managed like simple service accounts?
A: Static service-account management breaks when identities are ephemeral, cross-platform, or context-sensitive.
Practitioner guidance
- Embed identity requirements into application onboarding Define a minimum identity control set that every new application must satisfy before release, including auth paths, account ownership, and reviewable access evidence.
- Inventory unmanaged credentials and service accounts Build a complete register of local accounts, static secrets, and service accounts that exist outside central IAM.
- Remove identity logic from code and pipelines where possible Replace hardcoded secrets, embedded keys, and pipeline-stored credentials with managed secret handling and workload identity patterns.
What's in the full article
Orchid Security's full analysis covers the operational detail this post intentionally leaves for the source:
- Application-level discovery methods for finding identities embedded in binaries, configs, and infrastructure code.
- The practical onboarding workflow for correlating unmanaged accounts with central IAM records.
- Examples of identity debt in audit, incident response, and infrastructure operations.
- How Orchid frames attribution and dynamic authorisation for AI-driven operators.
👉 Read Orchid Security's analysis of IAM workarounds and identity debt →
IAM workarounds and identity debt: what teams miss?
Explore further
14/08/2026 6:44 pm
Identity debt is a governance failure, not an engineering preference. When infrastructure teams use local accounts, static IAM users, or hardcoded secrets to keep delivery moving, they are not choosing convenience over security in a narrow sense. They are creating a second identity plane that compliance teams cannot reliably certify and security teams cannot fully observe. The implication is that identity governance must be measured by what the application actually enforces, not by what the directory claims.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared with nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: How do teams know whether application-level identity discovery is working?
A: Look for reduced blind spots between application reality and governance records. If discovery is working, unmanaged accounts, bypass paths, and embedded credentials should become visible quickly, remediation queues should be prioritised by risk, and audit evidence should become easier to assemble without manual reconstruction.
👉 Read our full editorial: IAM workarounds shift hidden cost to infrastructure teams
