They’re still lurking — despite the roadmap, the audit, and that very convincing slide deck.
Let’s be honest: identity security always sounds like a priority… until it’s time to allocate budget, time, or people. Then suddenly, it’s next quarter’s problem. Meanwhile, legacy systems stay exempt from MFA, access reviews get rubber-stamped, and that one service account? Still running with domain admin.
This list isn’t about cutting-edge zero-days or high-concept threats. These are the slow-burning, quietly dangerous identity issues that have a knack for surviving reorganizations, tool migrations, and three rounds of “this is the year we clean it up.”
Let’s take a look.
1. Over-Provisioned Access That No One Owns
“Just give them everything. We’ll sort it out later.”
Spoiler: we never sort it out later.
Overly broad access is still the norm — especially when no one’s clear who should approve what.
Why it lingers: It’s fast, it works, and it doesn’t break things. Until it does.
2. Dormant Accounts With Active Privileges
Former employees, long-gone contractors, test users — still alive and well in your identity store. Some of them even have VPN access. Delightful.
Why it lingers: Offboarding is everyone’s job, which means it’s no one’s job.
3. Service Accounts That Might Be Older Than Your SIEM
These accounts are immortal, unmonitored, and usually secured by a password like svc_prod_2020. They also tend to have domain-level access — just in case.
Why it lingers: No one knows what they do, but everyone’s afraid to touch them.
4. MFA Gaps You Thought Were Exceptions
Your policy says “MFA everywhere,” but that one app doesn’t support it. And your CEO didn’t like the prompt frequency. And VPN? Well, it’s on the roadmap.
Why it lingers: Exceptions start small and quietly multiply. Like rabbits. Or shadow IT.
5. Unmanaged SaaS Apps Holding Sensitive Data
When marketing spins up a tool with customer PII and no SSO, it becomes your problem. But only after a breach or a compliance check.
Why it lingers: It’s easier to apologize than to provision through IT.
6. Identity Systems That Don’t Talk to Each Other
HR says the user left. Active Directory says they’re active. That custom-built tool from 2019? Still happily authenticating them.
Why it lingers: Integration takes time. And duct tape only does so much.
7. Privileged Users Without Guardrails
“Privileged” means different things to different teams. And unless you’ve got session monitoring or just-in-time access in place, those accounts are more powerful — and exposed — than you’d like.
Why it lingers: It works until someone does something very stupid… or very malicious.
8. Identity Workflows That Rely on Trust
Helpdesk resets passwords over the phone. Self-service provisioning relies on a shared email inbox. Social engineering opportunities abound.
Why it lingers: Legacy processes die hard — especially if they’re “good enough.”
9. Federation Configs No One’s Looked at Since Go-Live
SSO is great. Until a misconfigured trust relationship lets in a third-party assertion that no one expected. Or reviewed. Or logged.
Why it lingers: “It’s working. Don’t touch it.”
10. No Real Visibility Into Who’s Doing What
You can’t protect what you can’t see — and many orgs still can’t answer who accessed what, when, and why. Especially across cloud, hybrid, and legacy apps.
Why it lingers: Logging is expensive. Alert fatigue is real. And someone turned off that integration last year “to troubleshoot.”
So, What Now?
Most of these problems aren’t new — and that’s exactly the problem. They’ve been around so long, they’ve become background noise. Easy to ignore. Easier to push to next quarter.
But they’re the ones most likely to be exploited — not because they’re sophisticated, but because they’re familiar… and still unresolved.
If you’re planning 2025 initiatives, start here:
- Audit what access still exists vs. what should.
- Get honest about your identity blind spots — not just in cloud.
- Push for fewer exceptions, not just better tools.
And maybe — just maybe — budget for the boring stuff this time around.
Navigating Identity 
Leave a comment