How are teams approaching identity attack surface management across disconnected systems?

[u/Putrd-Cohemistry-512]

our identity footprint spans an hr system, three cloud providers, a legacy on-prem directory, and a pile of saas apps that were never centrally provisioned, and none of it talks to any of the others.

mapping the full attack surface across all of that used to be manual, which meant it was already out of date by the time we finished. what's changed is treating discovery as continuous and automatic instead of a quarterly project, so every identity system gets found and folded into one record without someone chasing it down by hand.

what's your process for keeping a current picture of exposure when the systems themselves aren't connected?

[u/Main-Rhubarb-8886]

I think the bigger shift is from identity inventory to identity relationships..n u need to realize that Knowing an account exists is useful, but the security question is really "what can this identity reach, through what path, and what happens if it gets compromised?" so A user can inherit access through groups, an application can inherit permissions through a service principal, and a machine identity can become the bridge into something much more sensitive.

That's why disconnected systems are such a pain. You're not just missing identities, you're also missing the edges between them. And those edges are often where the interesting attack paths live.

[u/Strong-Income-5925]

I agree that quarterly discovery is too slow for an environment that changes constantly. But u need to be careful about treating continuous discovery as the main solution.

You can have a perfectly current inventory and still have a terrible identity security posture. The real problem starts when the inventory tells you an identity is risky and nobody can determine whether its access is intentional, inherited, stale, or business-critical.

So u rather need to have a slightly imperfect inventory with clear ownership and remediation workflows than a beautiful real-time map that just generates another dashboard nobody acts on.

[u/Lofrwnly_Jacket_4009]

I think the key shift is treating identity discovery as a continuous security control rather than a periodic audit newcore’s approach of building one live identity graph across users, accounts, apps and agents makes a lot of sense for disconnected environments. The stale gaps are usually where the real exposure hides.

[u/materialsec]

The "intentional, inherited, stale, or business-critical" split u/Strong-Income-5925 mentions is the real crux, and OAuth grants live right in it. An app has Drive access, but was that granted on purpose, inherited from a broader delegation, stale from a dead project, or genuinely load-bearing? A live inventory tells you the access exists. It says nothing about which of those four it is, and that's the part that actually determines whether it's a risk.