Independent Ponemon Institute research on the security, compliance, and operational cost of disconnected apps.
Enterprise identity programs look mature, but that maturity usually reflects only the applications connected to your identity systems. A large and growing share of the application estate sits outside that coverage: disconnected apps that don't support standards like SAML, OIDC, or SCIM, so SSO, MFA, provisioning, and governance can't reach them.
The 2026 Ponemon Institute report, based on an independent survey of 614 IT and security leaders, quantifies what that gap costs:
-
30% of enterprise applications are disconnected from identity systems on average, and 40% of those are business-critical.
-
77% of organizations had a security incident tied to disconnected apps in the past two years.
-
63% have failed an audit at least once because of gaps in securing disconnected apps.
-
Among the 52% using automation workarounds, teams spend an average of 31.2 hours per week maintaining them.
The full report includes complete benchmarks across security, compliance, and operations, plus an identity automation maturity framework and a practical action plan.
Read the full research.
