Notifications
Clear all
Topic starter
01/08/2026 8:58 pm
TL;DR: Traditional IdP workflows can only govern applications after discovery and integration, leaving a large share of shadow SaaS and unmanaged app authentication outside the control plane, according to Unixi. The central problem is not user noncompliance but an identity visibility gap that lets access happen before governance does.
NHIMG editorial — based on content published by Unixi: The Mirage of the Green Dashboard and the Identity Arsenal Gap
By the numbers:
- Most traditional identity controls leave out the 50%–85% of applications that don’t natively support these frameworks.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should security teams govern shadow IT in SaaS environments?
A: Security teams should govern shadow IT by treating it as unmanaged access, not just unsanctioned software.
Q: Why do traditional IAM controls fail to capture the real application footprint?
A: Because most IAM programmes are built to govern apps after discovery and integration, while users can authenticate to new services immediately.
Q: What is the difference between application discovery and runtime visibility?
A: Application discovery tells you what exists in the environment, usually after the fact.
Practitioner guidance
- Map unmanaged authentication paths Inventory browser-authenticated SaaS and productivity apps that bypass SAML, SCIM, or formal onboarding.
- Separate visibility from onboarding Create a runtime visibility layer for sessions that occur outside the normal IdP workflow so governance can start at first use rather than after integration.
- Classify shadow apps by identity risk Rank unmanaged apps by the credential type used, the data stored, and whether the app can be accessed with reusable tokens or passwords that extend exposure beyond a single session.
What's in the full article
Unixi's full article covers the operational detail this post intentionally leaves for the source:
- Browser-level discovery mechanics and how Key Derived Authentication is applied in practice
- How universal single sign-on is handled for unmanaged and shadow applications without backend configuration
- The specific implementation logic behind continuous discovery across decentralized work environments
- Why the approach avoids the traditional SSO tax and what that means for operational deployment
👉 Read Unixi's analysis of the identity arsenal gap and Shadow SaaS governance →
Shadow SaaS and the identity arsenal gap: are your controls keeping up?
Explore further
01/08/2026 9:05 pm
Identity governance fails when discovery is treated as a prerequisite for control. Traditional IAM programmes were built around known applications, known connectors, and known provisioning paths. That assumption breaks in browser-mediated work because authentication can occur before discovery ever happens. The implication is that visibility lag is now a governance defect, not a reporting inconvenience.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how often identity governance is operating with incomplete inventory.
A question worth separating out:
Q: How can IAM teams reduce the impact of browser or device compromise on credentials?
A: Move secrets into a dedicated vault, enforce unique passwords, and verify that offboarding removes access cleanly across all synced devices. Then test what remains exposed if a browser session or endpoint is taken over. The goal is to keep one compromise from becoming a full credential event.
👉 Read our full editorial: Identity arsenal gap shows why IdP dashboards miss shadow SaaS
