Identity is under pressure. Identity programs have matured, yet hundreds of applications remain disconnected from centralized identity systems, operating outside governance and driving measurable security and compliance risk. New 2026 Ponemon Institute research, commissioned by Cerby, puts hard numbers on that gap.
What did the 2026 Ponemon research find about disconnected apps?
77% of organizations had at least one cybersecurity incident in the past two years caused specifically by their inability to secure apps that aren't connected to their identity stack. The study surveyed 614 IT and security leaders across retail, financial services, manufacturing, technology, healthcare, and energy, and is the first to put hard numbers on the disconnected-app problem.
How bad is credential risk on disconnected apps?
The research shows credentials for disconnected apps are largely unmanaged:
- 55% of disconnected apps rely on password-only authentication
- 47% of the time, IT doesn't manage the credentials, the end user does
- 39% of those credentials are shared
How do disconnected apps affect audits?
- 63% of organizations have already failed an audit because of disconnected apps, and 36% have failed more than once
- 46% needed a major manual effort to produce audit evidence and it was still incomplete
- 16% said they cannot produce audit evidence at all
Why do mature identity programs still have this gap?
Because identity automation reaches only the apps that support SSO and SCIM. Even well-run programs leave hundreds of apps outside centralized governance, which is where the audit friction, manual work, and credential risk concentrate.
How is AI expanding the risk?
AI is enlarging the disconnected surface area. As copilots and autonomous agents access the same disconnected applications, they amplify the credential risks organizations already struggle to control, which makes closing the gap more urgent.
What can leaders do to catch up?
The practical path is to extend existing identity controls to the disconnected apps they can't reach today, automating access and credential management for apps without SSO, SCIM, or APIs. Cerby completes the identity stack rather than replacing it, so the policies you already run apply to every app.
What you'll learn in this session
- Exclusive 2026 benchmark data from 614 IT and security leaders
- The true scale and impact of disconnected applications
- Why mature identity programs still face audit friction and stalled initiatives
- The risks of manual password and credential management
- How AI agents are expanding identity risk
- Practical steps leading organizations are taking to regain control
Presenters
Mike Fitzpatrick, Distinguished Fellow, Ponemon Institute
Matt Chiodi, Chief Strategy Officer, Cerby
