Notifications
Clear all
Topic starter
16/09/2026 9:20 am
TL;DR: SaaS discovery can expose the scale of shadow applications, but it does not remove the identity risk created when users still authenticate with typed or copied credentials, according to Unixi. The real control gap is operational: visibility without managed execution leaves the human login loop intact, where AiTM phishing and infostealers still harvest secrets.
NHIMG editorial — based on content published by Unixi: The Discovery Exposure Trap
By the numbers:
- 50% to 85% of your software footprint lives outside SAML or OIDC single sign-on, according to Unixi.
- 65% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to Oasis Security & ESG.
Questions worth separating out
Q: What breaks when SaaS discovery stops at inventory and not access control?
A: What breaks is the assumption that knowing an app exists reduces risk.
Q: Why do unmanaged SaaS applications stay risky even after they are discovered?
A: They stay risky because the authentication method usually does not change when the app is found.
Q: How should security teams deal with SaaS vendors that charge extra for SSO?
A: Security teams should treat SSO as a baseline control requirement and measure vendors against it during procurement.
Practitioner guidance
- Inventory the real authentication path for every discovered app Classify each shadow SaaS application by whether users authenticate with SSO, typed passwords, vault copy-paste, or browser-managed session controls.
- Eliminate human handling of reusable credentials Prioritise controls that prevent users from seeing, typing, or copying secrets during login.
- Attach remediation authority to discovery outputs Require every unmanaged application finding to route to a concrete access decision, such as managed browser execution, vendor offboarding, or formal exception approval.
What's in the full article
Unixi's full analysis covers the operational detail this post intentionally leaves for the source:
- The browser-extension access flow used to bring non-SAML apps under managed enterprise authentication
- How active session monitoring and instant offboarding work across arbitrary web tools
- The operational trade-offs between vendor SSO roadmaps, app bans, and manual credential vaulting
- The specific way managed execution changes the exposure window for AiTM and infostealer attacks
👉 Read Unixi's analysis of SaaS discovery limits and managed execution →
Shadow SaaS discovery: what happens when visibility stops at inventory?
Explore further
16/09/2026 9:21 am
Discovery without authentication control is a measurement exercise, not a security control. A list of shadow applications tells teams where the exposure may exist, but it does not change the mechanism that creates the exposure. If identity governance stops at finding apps, the human login loop stays intact and attackers still have a credential path to abuse. The practical conclusion is that inventory must be paired with enforced authentication change, not treated as an end state.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, according to The 2024 ESG Report: Managing Non-Human Identities.
- Enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, according to the same report.
A question worth separating out:
Q: What should IAM teams prioritise after discovering shadow SaaS?
A: Prioritise the apps whose users still handle reusable credentials directly, because that is where credential theft is most likely. Then decide whether the right response is managed browser control, vendor migration, or formal exception handling. The goal is to remove the human from the secret-handling step.
👉 Read our full editorial: SaaS discovery exposes shadow apps, but not the identity risk
