What the question actually asks
Track 1: Who Can Do What
“Addition is not discovery.”
The question the consoles don't answer. CyberArk, SailPoint and Entra are already running, and each one answers something smaller: a sign-in it can see, a record that was approved, a secret that was chosen for storage. Three of those answers on a page are a catalogue.
Lyrics
Who can do what.
That is the question.
It arrives after the tools are already in.
CyberArk is running. SailPoint is running.
Entra is running because the tenant exists.
A name, a budget, a quarterly review.
No answer that would survive being read aloud.
Every console answers a question.
It is not the one you were asked.
A sign-in it can see. A record that was approved.
A secret you chose to store.
Three answers on a page are a catalogue.
The catalogue is not the estate.
Keep the three words apart.
Who is an owner you could call.
Can means it would succeed this morning.
Standing. A live request. Break-glass.
What is the resource, and the verb.
Not the group the verb was buried in.
Miss the three cells and you reviewed the record.
The missing identities are still identities.
They authenticate. They authorise. They hold privilege.
They are not in the system you report from.
Orchid's baseline. Not your tenant.
Fifty-seven percent of applications
not directly integrated with a secure identity provider.
Sixty-seven percent of non-human accounts
authenticated and authorised locally.
Forty percent of accounts orphaned.
Sixty percent, in some applications.
Thirty-six percent, cleartext credentials in configuration.
Seventy percent over-privileged.
Forty to eighty times, machine against human:
the analysts' estimate, not Orchid's measurement.
Add the three consoles. You have what was onboarded.
Addition is not discovery.
The visible estate is not the estate that can act.
Who can do what.
Outside the console, or it is only a catalogue.
The book and the whole album so far · Written by Nicholas Martin. Music made with Suno.