Periodic campaigns break down because they capture a snapshot, not ongoing risk. Access can become stale between review cycles, and reviewers may not notice that a privilege is no longer needed or is being misused. Without continuous signals and prioritisation, organisations spend effort on low-risk access while genuine outliers slip through.
Why Periodic Reviews Miss the Real Risk
Periodic access campaigns were designed for static user populations and predictable privilege sets, not for environments where credentials, service accounts, APIs, and agentic workloads change quickly. A review can certify an entitlement that looked reasonable on the review date while missing the fact that the same access was abused the next day. That gap matters most for NHIs because compromise often occurs faster than the next campaign, as shown in NHIMG’s LLMjacking research, where exposed credentials were often targeted within minutes. Current guidance from the OWASP Non-Human Identity Top 10 and NIST SP 800-53 Rev 5 Security and Privacy Controls both point toward continuous oversight, not checkbox certification.
For security teams, the hidden failure is not just stale access. It is that campaign design encourages shallow decisions, incomplete ownership, and a false sense of closure. Reviewers often approve broad entitlements because they cannot see usage context, business exceptions, or cross-system chaining. In practice, many security teams encounter privilege misuse only after an incident has already revealed that the campaign never reflected operational reality.
How Campaign-Based Reviews Break Down in Practice
Periodic reviews fail when access is evaluated without runtime context. A reviewer can see that a service account exists, but not whether it is still tied to an active workload, whether its token is being reused outside its intended scope, or whether the credential should have been replaced by lifecycle-managed JIT issuance. That is why access reviews for NHIs need to be paired with identity telemetry, short-lived secrets, and policy evaluation at request time.
Effective programs usually combine three layers:
- Asset and identity inventory so reviewers know what exists, who owns it, and whether it is still active.
- Usage evidence, such as last-seen timestamps, API call history, and anomaly signals, so decisions reflect behaviour rather than labels.
- Privilege reduction actions, including revocation, rotation, and scope tightening, so reviews change risk instead of documenting it.
This is especially important for autonomous systems. An AI agent can chain tools, request fresh credentials, and pivot across services in ways a human reviewer cannot infer from a periodic snapshot. NIST’s control model and the Ultimate Guide to NHIs both reinforce that identity decisions must reflect actual use, not just assigned entitlement. These controls tend to break down in high-churn CI/CD, multi-cloud, and agentic environments because access changes faster than review cycles can safely track.
Where the Standard Approach Needs Extra Guardrails
Tighter review cadence often increases operational overhead, so organisations must balance assurance against reviewer fatigue and false positives. That tradeoff is real, and current guidance suggests prioritising by risk rather than treating every entitlement equally. High-value secrets, cross-domain admin access, internet-facing automation, and agent-triggered tool access should be reviewed first because they create the fastest paths to escalation.
There is no universal standard for this yet, but practitioners increasingly treat campaign reviews as one input among several, not the control itself. Mature programs use continuous signals from secret scanners, workload identity systems, and runtime policy engines to decide when a review is still valid. NHIMG’s breach analyses, including the 52 NHI Breaches Analysis, show the same pattern repeatedly: access that looked acceptable on paper became dangerous because nobody re-evaluated it when the environment changed.
The practical lesson is straightforward. Campaigns are useful for attestations, audit evidence, and ownership cleanup, but they are weak at detecting urgency, misuse, and drift. Security teams that rely on them alone end up certifying yesterday’s risk while missing today’s exposure.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 | Periodic reviews miss stale NHI access and weak credential hygiene. |
| NIST CSF 2.0 | PR.AC-4 | Access permissions need ongoing management, not periodic checkbox approval. |
| NIST AI RMF | GOVERN | Agentic and automated access demands accountability and monitoring beyond review cycles. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero trust reduces reliance on periodic attestation by verifying each access request. |
| CSA MAESTRO | IAM-2 | Agentic systems need identity and authorization controls that adapt to runtime context. |
Shift from campaign approval to request-time verification with least-privilege enforcement.
