Notifications
Clear all
Topic starter
14/09/2026 9:44 am
TL;DR: Relying on a primary directory for enterprise-wide security leaves entitlement decisions, non-native applications, and non-human identities under-governed, according to SailPoint. The real risk is not login failure but control drift across human and machine identities, where static reviews and SSO coverage cannot enforce least privilege or separation of duties.
NHIMG editorial — based on content published by SailPoint: Elevating identity governance from ecosystem silos to enterprise control
By the numbers:
- 71% of organizations suffered from at least one identity-related breach in the past year.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities.
Questions worth separating out
Q: What breaks when identity governance stops at the primary directory?
A: Governance becomes partial because authentication is visible while effective permissions remain hidden inside non-native applications.
Q: Why do manual access reviews break down in hybrid identity environments?
A: Manual reviews break down because entitlements, roles, and activity are spread across too many systems for periodic certification to keep pace.
Q: How should organisations govern non-human identities across their environment?
A: Start by inventorying every machine identity, assigning a human owner, and tying each one to a business purpose.
Practitioner guidance
- Separate authentication from entitlement governance Use the directory for sign-in and conditional access, but place entitlement review, role analysis, and toxic access detection in a dedicated governance layer that can inspect non-native applications.
- Inventory non-native application permissions Build an application-by-application map of effective rights, including delegated admin, transactional privileges, and role inheritance, so reviews target what users can actually do.
- Replace static certification with usage-aware review Trigger recertification from live entitlement usage and peer-group signals instead of relying only on quarterly or annual campaigns driven by organisational charts.
What's in the full article
SailPoint's full blog covers the operational detail this post intentionally leaves for the source:
- Specific examples of how entitlement-aware governance replaces account-centric control in non-native applications
- Operational guidance on handling hybrid identity landscapes across legacy systems, cloud platforms, and shadow AI
- How continuous governance can reduce manual certification work and improve separation of duties enforcement
- The article's full positioning on ecosystem-agnostic identity control across human and non-human identities
👉 Read SailPoint's analysis of identity governance beyond ecosystem silos →
Identity governance beyond the directory: what control gaps remain?
Explore further
14/09/2026 9:45 am
Directory-centric security is not enterprise identity governance. A directory proves authentication, but it does not govern the effective authority an identity holds inside non-native systems. That distinction matters because the real control failure often sits below SSO, in entitlement structures that drive transactions, data changes, and approval authority. Practitioners should treat directory coverage as a starting point, not a governance endpoint.
A few things that frame the scale:
- The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, showing that NHI risk is already operational rather than theoretical.
A question worth separating out:
Q: Should teams prioritise entitlement control over broader SSO coverage?
A: Yes, when the business risk sits in what users can do after login rather than whether they can authenticate. SSO helps with access entry, but entitlement control governs real authority, separation of duties, and auditability. Teams should prioritise the layer that reduces the highest residual risk first.
👉 Read our full editorial: Identity governance beyond directory silos is now an enterprise control issue
