Notifications
Clear all
Topic starter
01/08/2026 10:42 pm
TL;DR: Weak identity controls and loopholes factor into nearly 90% of major cyber incident investigations, according to Palo Alto Networks Unit 42, and unmanaged applications still let attackers bypass SSO, harvest reused credentials, and move laterally around central identity controls. The real issue is not login convenience but whether identity governance reaches every application and every access path.
NHIMG editorial — based on content published by Unixi: identity control breaks when shadow apps bypass SSO and lifecycle
Questions worth separating out
Q: How should security teams govern SSO across multiple enterprise applications?
A: Treat SSO as a lifecycle and trust problem, not only a login convenience.
Q: Why do shadow applications increase breach risk even when SSO is in place?
A: Because SSO only covers the systems it reaches.
Q: What breaks when lifecycle management stops at the main directory?
A: Orphan accounts and tokens can remain active in application-local stores after offboarding.
Practitioner guidance
- Map all authentication paths outside the IdP Identify every application that accepts local credentials, separate recovery flows, or non-federated login.
- Reconcile offboarding against application-level access Validate that leaver events remove access in the directory, in shadow applications, and in any local account store.
- Measure credential reuse across the app estate Look for repeated passwords, shared accounts, and identical recovery credentials across uncontrolled systems.
What's in the full article
Unixi's full article covers the operational detail this post intentionally leaves for the source:
- A red-team style walkthrough of how attackers look for the least governed application instead of the hardest perimeter.
- Examples of the identity blind spots that let shadow apps bypass central SSO and lifecycle enforcement.
- The author's practical framing for treating SSO and lifecycle management as control mechanisms rather than end goals.
👉 Read Unixi's analysis of shadow apps, SSO bypasses, and identity control gaps →
Shadow apps and SSO bypasses: what IAM teams are missing?
Explore further
01/08/2026 10:52 pm
Identity control is only as strong as the apps it can actually govern. SSO and lifecycle management are enforcement mechanisms, not outcomes. When an enterprise has shadow applications or local authentication paths outside the IdP, governance becomes partial by definition, and attackers will take the shortest route around the controls. The practical conclusion is simple: coverage matters more than the elegance of the control stack.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how often identity governance stops short of complete coverage.
A question worth separating out:
Q: Who is accountable for access left behind in unmanaged apps?
A: The business owner of the application and the identity team share accountability, but the application owner must prove that access was removed. Governance fails when nobody can evidence revocation outside the IdP. Frameworks such as NIST CSF and NIST SP 800-53 both expect controlled access and verified revocation.
👉 Read our full editorial: Identity control breaks when shadow apps bypass SSO and lifecycle
