Topic starter
14/08/2026 6:38 pm
TL;DR: 51% of identity implemented across European enterprises sits in an unmanaged layer it calls identity dark matter, while 48% of applications store credentials in cleartext and 44% bypass the corporate identity provider, according to Orchid Security. That gap means traditional IAM coverage, not just policy intent, now defines real exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Orchid Security: “The State of Identity in Europe”.
By the numbers:
- 51% of identity implemented throughout European enterprises sits in an unmanaged layer the article calls identity dark matter.
Key questions
Q: What breaks when identity data remains siloed across IAM controls?
A: Siloed identity data produces blind spots, duplicate work, and slower response because each control sees only a partial version of the truth.
Q: Why do local authentication paths and cleartext credentials create such high risk?
A: They let attackers bypass federation and reuse static secrets without defeating the central identity provider.
Q: How do teams know whether identity dark matter is actually shrinking?
A: They should look for fewer application-local accounts without owners, fewer credentials found in code, and fewer access paths that bypass centralized identity providers.
Practitioner guidance
- Inventory application-level identity paths Discover every authentication flow, local account, alternate login method, and shadow identity path across the application estate, including legacy and self-hosted systems.
- Reconcile central controls to application reality Compare directory, PAM, and IGA coverage against what each application actually enforces, then mark gaps where local access still bypasses corporate identity controls.
- Target cleartext and weakly protected credentials Prioritise applications that store cleartext credentials, use weak hashing, or fail to enforce token expiry, because those weaknesses create the most direct compromise paths.
Bottom line: Identity dark matter describes the gap between central IAM design and the access behaviour actually embedded in applications.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/08/2026 6:44 pm
Identity dark matter is not an edge condition; it is the operating reality of large application estates. Central IAM programs describe intent, but the application layer determines whether that intent is enforced. When local authentication, orphaned accounts, and alternate access paths exist, policy coverage and actual exposure diverge. Practitioners should treat hidden identity paths as a primary governance domain, not a cleanup task.
A question worth separating out:
Q: Who is accountable when an application keeps its own identity model?
A: The application owner, IAM team, and security governance function all share accountability, but the system owner is responsible for exposing how identity is implemented at runtime. Regulators and auditors care about effective control, not internal ownership charts. If the application can authenticate or authorize independently, that fact must be owned and evidenced.
👉 Read our full editorial: Identity dark matter shows why IAM controls miss real exposure