Notifications
Clear all
Topic starter
14/08/2026 6:38 pm
TL;DR: Identity dark matter hides shadow IT, orphaned accounts, unmanaged authentication flows, and other invisible controls, leaving enterprises unable to answer auditors’ harder question, what is missing, according to Orchid Security. The real governance problem is not coverage claims, but continuous proof of what identity flows exist, where they bypass the IdP, and which accounts still operate outside oversight.
NHIMG editorial — based on content published by Orchid Security: Identity dark matter and the blind spots in enterprise IAM
By the numbers:
- 48% of applications store credentials in cleartext.
- 44% of applications have authentication paths that bypass the corporate Identity Provider (IdP).
- 40% of applications lack baseline controls like rate limiting, account lockout, and password complexity.
Questions worth separating out
Q: How should security teams find identity blind spots before an audit?
A: Security teams should use continuous discovery across cloud, legacy, and homegrown systems, then validate authentication paths, local accounts, and entitlements against the IAM record.
Q: Why do orphan accounts create so much risk?
A: Orphan accounts matter because they preserve valid access paths after the original business owner is gone.
Q: What do organisations get wrong about visibility in identity governance?
A: They often assume that seeing an identity relationship is the same as controlling it.
Practitioner guidance
- Inventory authentication paths, not just applications Map every application’s login route, including local auth, legacy protocols, and IdP bypasses, so your control coverage reflects real access behavior rather than system lists.
- Flag orphaned and locally managed accounts for lifecycle review Tie account ownership to decommissioning, mergers, and app retirement so orphaned accounts are revoked when business purpose ends.
- Add continuous discovery to audit preparation Use telemetry-driven discovery across cloud, legacy, and homegrown systems to keep compliance evidence current between formal reviews.
What's in the full article
Orchid Security's full post covers the operational detail this post intentionally leaves for the source:
- Detailed discovery workflow for surfacing unmanaged apps, accounts, and identity flows across hybrid estates.
- Examples of toxic identity combinations and the remediation mapping used to close them.
- Benchmark-style evidence from the State of Identity Security 2025 findings on missing controls and bypass paths.
- Implementation guidance for executives, IAM teams, and IR teams managing identity posture at scale.
👉 Read Orchid Security's analysis of identity dark matter and audit blind spots →
Identity dark matter: what are IAM teams missing in audits?
Explore further
14/08/2026 6:44 pm
Identity dark matter is a governance failure, not just a visibility gap. The article correctly shifts the question from what the IAM stack covers to what still operates outside it. That matters because unmanaged applications, local accounts, and bypassed authentication flows are not edge cases once organisations grow through cloud adoption, acquisition, and application sprawl. Practitioners should treat unseen identity paths as evidence that the control plane is incomplete.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
A question worth separating out:
Q: Who should be accountable when an unmanaged identity is used in a breach?
A: Accountability should sit with the team that owns the identity lifecycle, not only the team that stores the credential. If the underlying service account or agent was never assigned purpose, review, and offboarding responsibility, governance has failed before the incident begins. That is why IAM, PAM, and IGA ownership must be explicit.
👉 Read our full editorial: Identity dark matter exposes the blind spots in enterprise IAM
