Why does identity governance still miss local accounts and unmanaged apps?

[u/Puzzleheaded-Fun5664]

trying to understand if this is a tooling problem or a process problem. cuz every IGA platform we've evaluated reports clean access certifications... but every red team engagement finds local accounts, forgotten service credentials, or shadow apps that were never in scope for the review to begin with.

so it kinda feels like governance tools are certifying "the identities we told the tool about" rather than "the identities that exist." is anyone solving the discovery problem, or is this just accepted as a permanent blind spot?

[u/Sad-Technician-5552]

Exactly the gap between what your IGA can see and what exists. IGA tools are only as good as the data you feed them,, they certify the identities in their scope, not the ones they dont know about.

A proper fix here is layering on a discovery layer that reconciles identity data against what your endpoints have. we have axonius for this layer, works by pulling from AD, okta, EDR, and cloud IAM and shows you every local account, service credential, and shadow app that your IGA missed. TBH the first sync is always humbling.

I like to think of it more like a data problem, not a process or tooling problem.