As enterprise access sprawls across SaaS, cloud workloads, and automation, the real risk is no longer only who is in the directory, but which identities exist beyond it.