Disconnected Apps in Identity: Insights from Oktane 2025

Cerby's benchmark survey of IT and security leaders on how enterprises manage the apps that don't connect to Okta or support standards like SSO, SAML, and SCIM, and where identity coverage is breaking down.

Disconnected apps are the applications that don't integrate with your identity provider through standards like SSO, SAML, or SCIM, which means they can't be governed through central policy. At Oktane 2025, Cerby surveyed IT and security leaders to benchmark how enterprises are managing these apps. The finding: access to them is still mostly manual, and the coverage gap is widening as app adoption outpaces what identity teams can secure.

Key findings from Cerby's Oktane 2025 benchmark survey:

• Only 42% of IT and security leaders say most of their apps support SSO through Okta. For the rest, access still runs on per-app usernames and passwords.

• Only 21% of IT teams will pay the SSO tax, the premium vendors charge to unlock SSO or SCIM. The rest delay, avoid it, or rely on workarounds, leaving those apps unmanaged.

• Only 15.8% say most of their apps are connected to an IAM or IGA tool for lifecycle management, and 50% say less than half of their stack is covered.

• 66% strongly agree that business teams adopt new apps faster than IT can secure them.

• The top blockers to identity coverage are a lack of identity standards (33%), legacy and on-prem apps (20%), and IT resource constraints (16%).

• Asked what would reduce disconnected-app risk most, 1 in 2 chose extending automated lifecycle management to these apps, and 1 in 3 chose securing credentials and extending SSO where possible.

• 80% of IT and security teams say they lack full visibility into the apps used across their organization.

• The risk concentrates in Marketing, Engineering, and Finance, where teams adopt apps fastest and often without IT involvement.

Visibility is where the problem surfaces, but control is where it gets solved. Knowing an app exists only helps if you can then govern access to it, automate its lifecycle, and produce an audit trail, which is what closing the gap actually requires.

Read the full Oktane 2025 benchmark report