Topic starter
08/02/2026 8:37 pm
TL;DR: Identity-related vulnerabilities are linked to over 77% of breaches, while 25% of SaaS services remain underutilized and therefore harder to monitor, according to Okta. That combination points to a governance problem, not just an access problem: central visibility, least privilege, and lifecycle controls now determine whether identity sprawl becomes exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Okta: “Top 5 ways Identity Governance Strengthens your Security”.
By the numbers:
- Identity-related vulnerabilities continue to be linked to over 77% of breaches, according to Okta.
- 25% of SaaS services remain underutilized and therefore harder to monitor, according to Okta.
Key questions
Q: What breaks when SaaS access is not tied to lifecycle controls?
A: Access persists after the business need has ended, which means former employees, stale integrations, and unused permissions can still reach data.
Q: Why do underutilized SaaS services increase identity risk?
A: Underutilized services often receive less scrutiny, so dormant accounts, unused roles, and forgotten integrations remain active.
Q: How do IAM teams know whether cloud least privilege is actually working?
A: They should look for declining counts of dormant privileges, fewer overprivileged machine identities, and a measurable shift from standing access to task-scoped access.
Practitioner guidance
- Eliminate orphan and inactive SaaS accounts Build a recurring process that finds unused accounts, confirms ownership, and removes access when the business purpose no longer exists.
- Enforce least privilege across SaaS entitlements Review roles, group memberships, and delegated permissions against current job needs, then shrink access that is broader than required.
- Automate access requests and approvals Use policy-based workflows so every request has an owner, approval record, and traceable justification before access is granted.
Bottom line: SaaS sprawl creates unmanaged identity surfaces when ownership, approval, and revocation do not keep pace with application growth.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
10/10/2026 6:47 pm
Identity governance is becoming the control plane for SaaS sprawl. When applications proliferate faster than access ownership and review, the programme stops being an entitlement process and becomes a containment problem. That shift matters across human and non-human estates because the same lifecycle weaknesses preserve risk in both. Practitioners should treat SaaS inventory and access governance as one operating model, not separate tasks.
A few things that frame the scale:
- Organisations that rely heavily on static credentials reported a 20-percentage-point increase in security incidents compared with those with low reliance, according to the 2026 Infrastructure Identity Survey.
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: How should security teams govern access across SaaS sprawl?
A: Security teams should govern SaaS sprawl with one inventory, one policy model, and one review process that covers both human and non-human access. The practical goal is to connect application approval, entitlement review, and revocation to business ownership. Without that linkage, access governance becomes a manual cleanup exercise instead of a control system.
👉 Read our full editorial: Identity governance gaps are widening as SaaS access sprawl grows