Enterprise identity and access management (IAM) is reaching a critical point. As organizations grow, identity becomes scattered across countless applications, independent teams, machine identities, and automated systems.

This leads to Identity Dark Matter: identity actions hidden from centralized IAM and unreachable by security teams.

According to Orchid Security’s research, 46% of enterprise identity actions are invisible to centralized IAM. In other words, almost half of the enterprise’s identity landscape may be hidden. This hidden area includes unmanaged applications, local accounts, unclear authentication processes, and overly permissive non-human identities. This is further complicated by detached tools, ownership silos, and the increasing popularity of Agentic AI.

This results in a growing difference between the security measures organizations think they have and the actual access that exists. This difference is where modern identity risks now exist.

To address these issues, Gartner has proposed the Identity Visibility and Intelligence Platform (IVIP) as a key “System of Systems.” Within the Identity Fabric architecture, IVIPs are located at Layer 5: Visibility and Observability, providing an independent oversight layer above access management and governance.

Specifically, an IVIP solution quickly gathers and combines IAM data, using AI-powered analytics to provide a unified view of identity events, relationships between users and resources, and security status.

A valuable IVIP must be more than just another identity data store. It must actively analyze and understand the enterprise’s whole identity system.

First, it needs to constantly discover both human and non-human identities across all relevant systems, including those not formally managed by IAM. Second, it should function as an identity data platform, combining fragmented data from directories, applications, and infrastructure into a reliable source of truth. Third, it should provide insight, using analytics and AI to transform scattered identity signals into useful security information.

Technically, this requires features like automated remediation, so security gaps can be fixed directly across the IAM system; real-time signal sharing, using standards like CAEP to trigger immediate security actions; and intent-based intelligence, where LLMs help determine the purpose behind identity activity and distinguish normal operations from truly risky actions.

This represents a shift from simply seeing identity to understanding and, ultimately, controlling it.

Orchid Security puts the Identity Visibility and Intelligence Platform (IVIP) concept into practice by turning scattered identity signals into continuous, application-level insights. Instead of solely relying on centralized IAM integrations, Orchid creates visibility directly from the application environment, enabling organizations to find, combine, and analyze identity activities across systems that traditional tools cannot see.

A key IVIP requirement is the continuous discovery of identities and the systems they use. Orchid achieves this through binary analysis and dynamic instrumentation, allowing it to examine the core authentication and authorization processes within applications and infrastructure without needing APIs, code changes, or complex integrations.

This method offers a crucial advantage in discovering the application landscape. Many enterprises cannot manage identities across applications that their central security teams are unaware of. Orchid identifies these systems first, because you cannot manage, secure, or evaluate what you cannot see. By identifying the actual application environment, including custom apps, commercial off-the-shelf (COTS) software, legacy systems, and shadow IT, Orchid reveals the hidden identity elements within them, such as local accounts, undocumented authentication methods, and unmanaged machine identities.

IVIP platforms must integrate scattered identity data into a clear operational view. Orchid achieves this by capturing proprietary audit data from within applications and combining it with logs and signals from centralized IAM systems.

This creates an evidence-based identity data layer that shows how identities actually behave within the environment. Instead of relying on assumed configurations or limited integrations, organizations gain a unified view of:

• Identities across applications and infrastructure
• Authentication and authorization processes
• Privilege relationships and external access paths

This combined evidence enables security teams to fix the mismatch between documented policies and real operational access.

An IVIP must transform identity data into actionable insights. Orchid’s cross-environment identity audits show the power of analyzing identity activity directly at the application level.

Across enterprise environments, Orchid observes that:

• 85% of applications have accounts from old or external domains, with 20% using consumer email domains, creating significant data exfiltration risks.
• 70% of applications have excessive privileges, with 60% granting broad administrative or API access to third parties.
• 40% of all accounts are inactive, rising to 60% in some legacy environments.

These findings are not based on policy assumptions; they are directly observed from identity behavior within applications. This shifts organizations from relying on indirect configuration information to evidence-driven identity intelligence.

Autonomous AI agents are the next form of hidden identity, often operating with independent identities and permissions outside traditional governance models. Orchid extends the IVIP framework to these emerging identities through its Guardian Agent architecture, allowing organizations to apply Zero Trust governance to AI-driven activity.

Secure AI-agent adoption is guided by five principles:

• Human-to-Agent Attribution: Every action by an agent is linked to a responsible human owner.
• Activity Audit: A complete chain of actions is recorded (Agent → Tool/API → Action → Target).
• Context-Aware Guardrails: Access decisions are continuously evaluated based on the sensitivity of the resource and the human owner’s entitlements.
• Least Privilege: Temporary access is granted instead of permanent privileged credentials.
• Automated Remediation: Risky behavior can trigger automated actions like credential resets or session termination.

By combining application environment discovery, identity data, and AI-driven intelligence, Orchid delivers on the core IVIP mission: transforming invisible identity activity into a governed, visible, and manageable security landscape.

Identity decisions are only as good as the underlying data. CISOs must move from focusing on “implemented controls” to tracking Outcome-Driven Metrics (ODMs).

• ODM Example: Instead of just counting IGA licenses, measure the reduction of unused (dormant) entitlements from 70% to 10% within a fiscal quarter.
• Protection-Level Agreements (PLAs): Negotiate target outcomes with the business. A PLA might require the revocation of critical access within 24 hours for someone who has left the company, significantly reducing the attacker’s opportunity.
• Business ROI: By implementing continuous observability, organizations can reduce audit preparation from months to minutes through automated compliance evidence generation.

To reduce the attack surface, we recommend the following prioritized actions:

Final Statement Unified visibility is now a vital control element, not just a secondary feature. Organizations must go beyond basic security measures and implement identity observability to manage the hidden identity elements where modern attackers operate.