Notifications
Clear all
Topic starter
27/08/2026 8:35 am
TL;DR: Identity hygiene depends on visibility, governance, and modern SSO coverage, because shadow SaaS adoption and token-based SSO weaknesses can expand attack paths across the enterprise, according to Unixi. The core issue is that IAM programmes often assume they can govern what they cannot see, which fails once users create unsanctioned application accounts.
NHIMG editorial — based on content published by Unixi: Identity Hygiene in a Cloud-First World
By the numbers:
- 80% of employees adopt SaaS applications without IT approval, with 10% reporting data breaches or data loss as a result.
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: What breaks when organisations cannot see shadow SaaS and third-party integrations?
A: Access reviews lose their value because they only cover what is visible.
Q: Why do shadow applications increase breach risk even when SSO is in place?
A: Because SSO only covers the systems it reaches.
Q: What do IAM teams get wrong about SSO coverage?
A: Teams often mistake central login for complete control coverage.
Practitioner guidance
- Inventory unsanctioned SaaS creation paths Identify where employees can create accounts with corporate email, then map those services to data handling, authentication, and lifecycle ownership gaps.
- Measure SSO coverage by application class Separate applications with enforced federation from those still using local credentials so teams can see where identity controls stop.
- Place shadow SaaS into approval workflows Route newly discovered apps through a formal review that checks business need, data access, and identity integration before use is tolerated.
What's in the full article
Unixi's full article covers the operational detail this post intentionally leaves for the source:
- How the session framed identity hygiene as a practical IAM resilience issue in a cloud-first environment.
- The article's examples of shadow SaaS adoption, unmanaged accounts, and data spreading into unknown applications.
- The distinction it draws between SSO convenience and the broader control problem of application governance.
- The concluding rationale for modern SSO coverage and stricter SaaS approval processes.
👉 Read Unixi's analysis of identity hygiene, shadow SaaS, and SSO risk →
Shadow SaaS and SSO gaps: what IAM teams need to fix now?
Explore further
27/08/2026 8:35 am
Identity hygiene fails first at discovery, not at enforcement: If an organisation cannot identify shadow SaaS, every downstream control becomes partial by definition. The article is right to frame visibility as the foundation because IAM governance only works on assets that are known, mapped, and reviewable. Practitioners should treat discovery coverage as the first measure of control integrity.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who should be accountable when an employee buys an unsanctioned SaaS app?
A: Accountability should be shared, but security needs a defined control owner. Procurement should stop unauthorised spend, IAM should track the identities and integrations created, and legal or risk teams should review vendor exposure. Without a named owner, offboarding and recertification usually fail.
👉 Read our full editorial: Identity hygiene gaps are exposing shadow SaaS and SSO risk
