Enterprises have spent years investing in identity providers, identity governance platforms, and privileged access management tools. Yet orphaned accounts, excessive permissions, and inconsistent access controls remain persistent security risks. For Yossi Barishev, CEO and co-founder of Way Security, the problem is not necessarily the technology organizations buy. It is whether they can enforce it across their entire application environment.
Barishev arrived at that conclusion through years of incident response and threat hunting. Investigating breaches exposed him to different enterprise environments and security stacks, but the same identity weaknesses continued to surface. “At the core of every breach, identity compromise is always a necessary step for attackers en route to their goals,” he said.
The shift toward cloud infrastructure and software-as-a-service applications has made the problem more difficult. As enterprise systems become increasingly distributed, traditional network boundaries offer less control over who can access what. Identity, Barishev argued, has become the common denominator connecting these environments.
Why Security Investments Fail to Deliver
The recurring weaknesses Barishev encountered were often basic rather than sophisticated: forgotten administrator accounts, service accounts nobody remembered creating, identities without multifactor authentication, and accounts that remained active after employees left. Some applications also maintained authentication paths that bypassed the organization’s identity provider entirely.
Years later, while running security teams himself, he encountered the same problems from the other side. Even with leading security products in place, many applications and identities remained outside their enforcement.
“Because owning a tool and enforcing it are two very different things. IAM is perhaps the only space in cybersecurity where spending millions and missing the outcome is considered normal,” Barishev said.
An identity provider can centralize authentication, an identity governance and administration (IGA) platform can determine appropriate permissions, and privileged access management (PAM) can govern sensitive accounts. But these systems cannot deliver their intended results if applications never become properly integrated.
The Integration Problem Behind IAM
Bringing an enterprise’s application estate under centralized identity management is often more complicated than deploying the tools themselves. Protocols such as SCIM support standardized provisioning, but many applications have not adopted them. Legacy and custom-built systems may use their own user databases, while SaaS vendors sometimes charge extra for single sign-on.
Even when a vendor offers a ready-made connector, it may support authentication without provisioning or fail to account for application-specific roles and entitlements.
Barishev said integrating an application can become a project lasting weeks or months. Connectors can also break silently when an application changes, leaving organizations with a particularly difficult problem: an integration that appears operational but no longer removes access correctly.
“That’s why at Way we built self-healing agentic connectors that reverse-engineer any application’s interface automatically - turning app onboarding from a long, expensive project into a fast & comprehensive one,” he said.
The challenge is also organizational. Application owners may not prioritize security integrations, and IAM vendors do not always interoperate cleanly. According to Barishev, an IGA or PAM program can run for one to three years and deliver only a third to half of what was originally planned.
The result is an uneven security environment in which some applications receive comprehensive controls while others remain dependent on local accounts and manually maintained permissions.
Why Identity Data Cannot Be Fixed Once
Fragmented application environments also make it difficult to establish a reliable source of truth. Human resources systems, identity providers, and individual applications may maintain conflicting records about the same person. When employees change roles or leave, those discrepancies can leave outdated access in place.
Barishev advocates assigning authority according to the type of information involved: HR determines employment status, the identity provider manages authentication, and IGA determines appropriate permissions. Applications should receive those decisions through provisioning rather than maintain independent access records.
But reconciliation alone cannot solve the problem. “A one-time reconciliation starts decaying the very next morning, and a source of truth that isn’t enforced on every app is just one more opinion,” he said.
That distinction also affects access reviews. Quarterly certifications capture a snapshot of permissions that may already be outdated by the time someone reviews them. Barishev instead advocates continuous reviews triggered by events such as role changes, new administrator privileges, unused entitlements, and accounts that exist outside the identity provider.
Measuring IAM by What It Actually Enforces
For Barishev, improving identity security requires shifting attention from the number of tools deployed to the applications and identities those tools actually protect. His proposed approach begins with discovering every application, identity, and existing control; connecting applications to centralized identity infrastructure; and enforcing policies with reliable, auditable integrations.
Way Security was founded by Barishev and co-founder Yonatan to address this enforcement gap, including in applications that lack modern integration capabilities.
The longer-term goal is an enterprise where every application and human or non-human identity falls under the appropriate controls. Barishev said a mature IAM environment should be able to onboard new applications in hours rather than months, while eliminating the list of systems that remain outside the identity stack.
That progress can be measured through practical outcomes: how quickly access is removed after an employee leaves, whether local logins bypass centralized authentication, and whether orphaned accounts continue to reappear.
“When the answer to “which apps & identities sit outside our security controls?” is “none”, the problem is solved,” Barishev said.