Notifications
Clear all
Topic starter
27/08/2026 8:35 am
TL;DR: Identity-first security is gaining traction as perimeter controls lose relevance, but SaaS fragmentation still blocks consistent SSO coverage and leaves many enterprises with separate identity stores, shadow accounts, and manual governance overhead, according to Unixi. The real constraint is not the model itself but the operational gap between identity-first intent and SaaS reality, where least privilege and centralized verification remain incomplete.
NHIMG editorial — based on content published by Unixi: Identity-first security and universal SSO for SaaS
By the numbers:
- 97% of organizations had zero trust or were planning to put the framework to use in 2022.
- The average organization now uses 130 SaaS apps, creating a large integration burden for identity teams.
Questions worth separating out
Q: How should security teams govern SaaS applications that rely on integrations and shared data?
A: Treat SaaS governance as a combined identity, data, and integration problem.
Q: Why does shadow SaaS weaken identity-first security?
A: Because accounts created outside approved processes bypass joiner-mover-leaver controls, access reviews, and deprovisioning.
Q: When should organisations prioritise universal SSO over other IAM improvements?
A: When a large share of users still authenticate directly to SaaS apps and the enterprise cannot enforce consistent access policy, visibility, or revocation.
Practitioner guidance
- Map SaaS applications that bypass central SSO Build an inventory of SaaS apps that authenticate outside the enterprise IdP, then classify them by business criticality, data sensitivity, and ability to support central policy enforcement.
- Treat shadow SaaS as an identity lifecycle issue Reconcile discovered SaaS accounts against approved onboarding records, then remove orphaned access and document where local account creation bypassed governance.
- Prioritise high-risk SaaS for centralised access control Focus first on applications holding sensitive data or privileged workflows, especially where local identity stores prevent consistent MFA, logging, and revocation.
What's in the full article
Unixi's full analysis covers the operational detail this post intentionally leaves for the source:
- Browser-extension authentication flow and how it mediates SaaS logins without native IdP integration
- Central SaaS management capabilities for admins who need an application-by-application rollout plan
- Examples of how the approach addresses shadow SaaS and password reuse across the estate
- The vendor's description of universal MFA support and centralized visibility across SaaS apps
👉 Read Unixi's analysis of identity-first security and universal SSO for SaaS →
Identity-first security and SaaS SSO gaps: what are teams missing?
Explore further
27/08/2026 8:35 am
Identity-first security fails when the control plane is fragmented. The model assumes authentication and authorization can be centred on a shared identity layer, but many SaaS environments still route users through local identity stores or partial SSO coverage. That breaks the premise that access can be governed consistently from one place. Practitioners should treat fragmented application identity as a structural governance failure, not a convenience issue.
A few things that frame the scale:
- 1 in 4 organisations are already investing in dedicated NHI security capabilities, with an additional 60% planning to do so within the next twelve months, according to The State of Non-Human Identity Security.
- 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human IAM efforts, according to The 2024 Non-Human Identity Security Report.
A question worth separating out:
Q: What is the difference between central identity governance and local SaaS account management?
A: Central governance gives the organisation one policy and one audit trail across applications, while local SaaS account management leaves each app to enforce its own rules. The first supports consistent lifecycle control, the second creates fragmented enforcement and weaker offboarding.
👉 Read our full editorial: Identity-first security still breaks down where SaaS resists SSO
