Topic starter
05/07/2026 9:28 pm
TL;DR: Enterprises now have identity attack surfaces that extend far beyond what IAM, PAM and IGA tools can see, because shadow SaaS and AI tools are adopted outside IT control and can carry ungoverned access and data paths, according to Zluri. The central issue is not tool weakness but a visibility model built for a slower, centrally managed procurement era.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Your Identity Attack Surface Is Bigger Than Your IAM, PAM, IGA Tools Can See”.
Key questions
Q: What breaks when identity tools only govern sanctioned applications?
A: When IAM, PAM, and IGA only cover sanctioned applications, the environment still contains unmanaged identities, entitlements, and data paths that attackers can use first.
Q: Why do shadow AI tools create identity risk for IAM programmes?
A: Shadow AI creates identity risk because hidden tools often inherit access through secrets, service accounts, or delegated APIs without review.
Q: How should security teams measure identity attack surface risk?
A: Measure identity attack surface risk by the number of high-risk identities found, the number of exposed credentials revoked, the number of dormant accounts removed, and the reduction in attack paths.
Practitioner guidance
- Map the unmanaged application estate Build a discovery process that finds SaaS and AI tools adopted outside procurement, using browser signals, finance data, and direct API inspection where available.
- Track application-level entitlements Record who has admin, read-only, and delegated access inside each application so privilege drift is visible at the permission layer, not just the app layer.
- Include OAuth grants in offboarding Remove connected account grants when employees leave or change roles, especially for AI tools that maintain access to email, documents, or internal data sources.
Bottom line: The article frames identity risk as a visibility problem, not a failure of IAM, PAM, or IGA mechanics.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 9:31 pm
Identity attack surface visibility is now a governance discipline, not a tooling feature. The article is right to separate visibility from the controls that consume visibility. IAM, PAM, and IGA can only govern what they can discover, which means the programme question is no longer whether the controls exist, but whether the organisation has mapped the identities and access paths those controls never ingest. Practitioners should treat discovery as part of identity governance itself.
A few things that frame the scale:
- Only 36% of health IT leaders say their organisation applies a privileged access strategy consistently across the enterprise, according to Ponemon Institute research.
A question worth separating out:
Q: What should organisations do when visibility tools and governance tools disagree?
A: They should assume the visibility tools are exposing scope the governance tools were never asked to manage, then reconcile that gap before trusting analytics or certification results. The right question is not which tool is right, but which access paths exist outside the current identity model.
👉 Read our full editorial: Identity attack surface visibility is outpacing IAM, PAM and IGA