Topic starter
16/08/2026 5:00 pm
TL;DR: Unosecur shows that identity risk increasingly hides in the gaps between cloud, SaaS, communication, and AI tools, where shadow admins, standing privilege, partial offboarding, and identity drift become invisible in isolation. The security problem is correlation, not tool count: fragmented identity data prevents teams from answering who has access to what and whether that access still belongs there.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Your identity stack lives in 100+ TOOLS. Your security sees them as one.”.
Key questions
Q: What breaks when identity data is split across multiple tools?
A: Split identity data creates conflicting versions of who has access, why it exists, and whether it should still be active.
Q: Why do fragmented identity systems increase breach risk?
A: Fragmentation hides who really has access, so dormant accounts, duplicate identities, and inconsistent permissions can survive long after business need changes.
Q: How do security teams know whether offboarding is actually working?
A: Security teams should measure completion, not process start.
Practitioner guidance
- Map the full privilege path Build an environment-wide view of inherited, delegated, and indirect access across cloud, SaaS, communication, and identity platforms so hidden admin paths become visible.
- Reconcile offboarding across every tool Check that deactivation in the primary directory actually removes live access in peripheral systems, especially collaboration, support, and developer tools.
- Detect toxic access combinations Look for permission pairs that are harmless alone but dangerous together when read across multiple platforms, then prioritise them for review and removal.
Bottom line: Fragmented identity environments create security blind spots because access lives across many disconnected tools, not in one authoritative system.
What's in the full article
Unosecur's full blog post covers the operational detail this post intentionally leaves for the source:
- How its 100+ integrations are grouped across cloud, SaaS, identity, and AI-connected tools
- The specific exposure patterns it uses to illustrate shadow admins, standing privilege, and partial offboarding
- The connector coverage claims behind its correlation approach across fragmented identity systems
- The implementation detail for linking identity sources into one view for investigation and remediation
👉 Read Unosecur's analysis of identity fragmentation across 100+ tools →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
16/08/2026 5:01 pm
Identity fragmentation is now a governance problem, not just a visibility problem. Once identity data is split across dozens of platforms, the control question changes from "who has access" to "who can reconstruct access truth". That distinction matters because IGA, PAM, and NHI programmes all depend on accurate correlation, not just inventory. The practitioner implication is that identity governance now has to be designed for cross-tool evidence, not per-tool administration.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams govern AI-connected tools in a fragmented identity estate?
A: They should place AI-connected tools inside the same identity review and correlation process as human and service identities. If agents or AI platforms can reach cloud, SaaS, or communication systems, their access must be inventoried, scoped, and monitored across the stack. Otherwise, machine identity drift becomes another invisible gap.
👉 Read our full editorial: Identity fragmentation across 100+ tools is the real security gap