“The Real Cost of Manually Governing Applications” SailPoint + Cerby webinar recap
TLDR: Most identity teams still rely on hand-built scripts to connect the apps their identity platforms can’t reach, and those custom connectors cost an average of 31 hours a week to maintain, according to a Ponemon Institute survey for SailPoint and Cerby. Beyond the maintenance, scheduled scripts leave entitlement data stale, miss mispermissioned access, and let offboarding gaps slip through to audit. In a recent SailPoint and Cerby webinar, Neil McGlennon and Bel Lepe explained why automating disconnected apps closes that gap, including how one 20,000-employee company brought 20 SOX-scoped applications under automated provisioning in four months.
Two identity veterans recently hosted a webinar, and a joke made 20 minutes in ended up being a defining and uniting moment for the whole event.
Neil McGlennon has spent 18 years as a field CTO at SailPoint, advising enterprise identity programs long before anyone was saying the word “agentic,” and Bel Lepe co-founded Cerby in 2020. They came up in different decades at different companies, yet they made the same confession — at some point, they were both script kiddies.
They said this fondly, the way you’d reminisce over a college memory. Each of them had once sat down and hand-built a script to shuttle user data in and out of a system their identity platform couldn’t reach, because when an application refused to cooperate, that was simply what you did.
That detail and shared moment are powerful. When a field CTO with decades of experience in enterprise identity and a startup founder independently write the same kind of duct-tape script, years apart, you’re looking at standard practice. The workaround is so common that nobody bothers to name it until someone says it on a webinar and everyone listening secretly feels seen.
The Math Behind the Joke
The script kiddie confession gets funnier, in a more wince-inducing way, once you look at the numbers. A Ponemon Institute Survey conducted for SailPoint and Cerby found that teams maintaining these custom connectors spend an average of 31 hours a week keeping them alive. In a 40-hour week, that’s more than three-quarters of one person’s job spent patching a workaround.
No one sets out to build a 31-hour-per-week habit. Nobody wants that. The script usually starts as a clever weekend fix for one stubborn application. Then the app updates its login flow, or someone renames a field, or the export format shifts just enough to matter, and the script breaks. Someone fixes it, and next quarter it breaks again. I’m exhausted just typing that. Three years later, someone’s entire role has turned into keeping the duct tape from peeling.
The original build estimate never accounts for this inevitable part of the process. Writing the script might take an afternoon, but keeping it running is the real project, and it never makes it onto a roadmap because it doesn’t feel like a project. It feels like just another Tuesday.
What Duct Tape Solutions Don’t Catch
Everyone can see and understand the maintenance cost. The higher cost (that isn’t visible) is everything that a hand-rolled script was never built to notice.
A script that pulls entitlement data every 90 days is stale the moment it runs, and staler still by the time anyone reads the output. It also can’t catch mispermissioning, which tends to run at a double-digit error rate whenever a human grants access manually across a stack of applications, because the script was designed to move data rather than question it.
And it rarely handles the exit as carefully as the entry. In one real audit, a single application required offboarding in three separate places. When a departed employee’s access wasn’t removed from all three, no one caught it until the auditor asked why someone who’d left months earlier could still log in. 😬
Let’s be honest, the people writing these scripts deserve credit. They’re solving the problem in front of them with the tools they have. The trouble is that the tool has inherited a responsibility it was never designed to carry.
The Script You Wrote vs. the Script You Don’t Have to Think About
| The connector you built | The connector that’s handled | |
|---|---|---|
| Maintenance hours | Around 31 hours a week, on average | Close to zero, because a self-healing engine detects and repairs breaks without a human in the loop |
| When the app’s login or fields change | The script breaks, someone eventually notices, and someone eventually fixes it | Repaired automatically before it becomes an outage or an audit gap |
| Data freshness | Only as fresh as your last scheduled run, often 90 days old | Flows continuously, several times a day |
| Who owns it when it breaks at 11 pm | Whoever wrote it, or whoever inherited it | Not your team’s late-night problem |
When the Duct Tape Finally Gets Noticed
A global ecommerce company with more than 20,000 employees recently learned the hard way that scripts and spreadsheets wouldn’t pass muster forever. They already ran SailPoint for identity governance and had single sign-on covering everything it could reach. Then an audit surfaced 50 applications still provisioned entirely by hand.
Twenty of them sat inside SOX scope, and two were on-premises thick clients nobody had figured out how to automate. Their GRC team had no interest in extending the exception, so the manual compensating controls had to go.
Having a gap wasn’t the remarkable part, since every company in this story has one. What stood out was how quickly things moved once they stopped trying to script their way out.
SailPoint and Cerby mapped the existing manual workflow on day zero, and about two weeks later the hardest app on the list, one of those on-premises thick clients, was live and provisioning automatically from inside SailPoint. Four more apps followed two weeks later, then five more two weeks after that. By month four, all 20 SOX-scoped applications were running without anyone touching a ticket.
That pace came from using something built for the job, rather than whatever the script kiddie on duty that quarter happened to leave behind.
Why This Can’t Stay Someone’s Side Project
Later in the webinar conversation, Neil brought up the Pocket OS breach, where the attacker went from initial access to full compromise in nine seconds. A quarterly script, or even a monthly one, was never meant to keep pace with that. It can’t flag mispermissioned access in real time or catch a departed employee’s lingering login the moment it turns into a liability, because its whole purpose is to move data on a schedule.
Neil kindly explained that manual processes fall short simply because, well, humans are human. Any repetitive, high-stakes task that depends on a person getting it right every single time, across every application, indefinitely, is going to slip eventually, no matter how diligent that person is.
So the real risk of staying in script-kiddie mode has little to do with embarrassment. The script simply can’t move at the speed the risk now moves, and no amount of weekend debugging will close that distance.
FAQ: We Have Hundreds of Disconnected Apps. Where Do We Actually Start?
This came up during the webinar’s live Q&A, and it’s the question every identity team asks once they stop writing scripts long enough to see how big the problem really is. There’s no single right answer, though four lenses tend to help. Blast radius points you toward the apps holding the most sensitive data or the widest exposure. Materiality covers whatever a board mandate or compliance deadline has already made non-negotiable. Ease favors the app you could realistically automate in an afternoon, since early momentum matters more than people expect. Necessity is the gap a CISO or auditor has already named out loud.
Most teams end up layering these together. An app that ranks high on blast radius and also happens to be easy will jump the queue, while something necessary but technically painful gets scheduled with more lead time. Whichever lens you start with usually says more about what your organization is under pressure to solve right now than about any perfect methodology. Pick one, close that loop completely, and the next application gets easier to prioritize because you’re no longer starting from zero.
Retiring the Duct Tape
Think back to Neil and Bel, two people from very different corners of this industry, laughing about how they’d both become script kiddies in their own right. We love the joke and relatable moment because nearly every one of us has been there too. The lesson, though, has less to do with writing better scripts and more to do with no longer needing to write them at all!
The teams that stop treating connector maintenance as a permanent part of someone’s job aren’t doing anything exotic. They’ve just decided they’re done paying the 31-hour tax on a fix that was only ever supposed to hold until something better came along.
Want the full conversation, including the live Q&A? Watch the on-demand webinar.