Teams often assume that if each permission looks valid during a review, the overall access posture is safe. Annual reviews miss the way toxic combinations emerge slowly across multiple applications and can remain hidden until they are already exploitable. They also tend to inspect permissions one by one, which overlooks cross-system conflicts, accumulated privilege, and the real attack surface created by identity sprawl.
Why Annual Reviews Miss Identity Risk
Annual access reviews are useful for confirming ownership and spotting obviously stale access, but they are a poor tool for detecting risk that emerges over time. The main failure is temporal: access may look reasonable in isolation while the combined effect across systems creates toxic privilege, excessive reach, or separation-of-duties conflicts. For teams managing human and non-human identities, that gap matters because identity posture changes continuously, not once a year.
This is why many organisations pair reviews with continuous monitoring of privileged changes, entitlement drift, and exception handling. Static review cycles also struggle when approvals are recorded at the account level instead of the action level, because the real question is not whether a user can still log in, but whether that identity can still perform a harmful sequence of actions. The OWASP Non-Human Identity Top 10 is a useful reference when the same review weakness affects service accounts, tokens, and other machine identities. In practice, many teams discover the gap only after access has already accreted across applications and the review process has merely confirmed the problem.
How the Failure Shows Up in Practice
Annual reviews usually break down in one of three ways. First, reviewers validate permissions against the role on paper, but not against the actual business process, so risky combinations survive because each individual grant appears defensible. Second, reviews are organised by application owner, which prevents anyone from seeing cross-system exposure such as one account that can request data in one system and approve changes in another. Third, the process becomes a checkbox exercise, so exceptions are renewed by default and nobody challenges whether the access is still necessary.
That is why access review should be treated as a control for attestations, not as the primary detector of identity risk. Continuous signals matter more for finding drift, including group membership changes, privilege escalation, dormant accounts reactivated for a project, and the accumulation of standing access that was meant to be temporary. For organisations with significant non-human identity usage, the Ultimate Guide to NHIs is a practical reference for why lifecycle visibility and rotation discipline are more effective than periodic validation alone. NIST’s Cybersecurity Framework 2.0 also reinforces the need to manage identity risk as an ongoing governance and detection problem, not a yearly admin task.
- Access should be reviewed against effective privilege, not just titled role names.
- Cross-application dependencies need to be assessed together, especially where approve, deploy, and read paths intersect.
- Temporary exceptions should expire automatically, because “review later” often becomes permanent access.
- Privilege changes during the year need a detection path, since annual review alone cannot show when access first became risky.
These controls tend to break down in large federated environments where ownership is fragmented and no single reviewer can see the full access chain.
Common Review Mistakes That Keep Risk Hidden
Tighter review cadence often increases administrative overhead, so teams have to balance assurance against reviewer fatigue and false confidence. The most common mistake is assuming that a clean review means a clean estate. It does not. A review can only confirm what the reviewer can see at that moment, and it cannot reliably uncover privilege combinations that emerge through workflow, delegation, inheritance, or machine-to-machine trust.
Another common error is using the review to prove compliance rather than to reduce risk. When the objective becomes evidence collection, reviewers tend to approve familiar access, defer hard decisions, and avoid challenging edge cases. That is especially dangerous for identities that are broadly reused, long-lived, or shared across teams, because those patterns can conceal abuse paths even when no single permission looks unusual. The risk is not just overprovisioning; it is the false sense of control created by a process that is too slow to reflect real change.
Current guidance suggests using annual reviews as one input into a broader identity governance model that includes continuous monitoring, just-in-time privilege, and periodic recertification for high-risk access. Where access is business-critical, the right question is whether the team can see and revoke risky combinations quickly, not whether those combinations were once approved.
Risk and Threat Considerations
Annual reviews create a material governance and exposure risk when they become the main control for identity assurance. The failure is not only stale access; it is the blind spot between review cycles, where privilege creep, role drift, delegated access, and unused-but-valid credentials can accumulate without detection.
Failure mechanism: Attackers and insiders benefit when review processes validate accounts individually but do not analyse cross-system privilege chains, temporary exceptions, inherited access, or standing privileges that can be combined into a harmful action path.
Impact: The result can be excessive access, separation-of-duties failure, unauthorised changes, data exposure, or persistence that survives long after the access was originally granted.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Identity review gaps are a governance and ongoing risk-management issue. |
| Recommendation — Embed identity risk into continuous governance, not annual attestations. | ||
| CIS Controls v8 | 6.3 — Access Control Management | The question concerns stale and excessive access that reviews fail to catch. |
| Recommendation — Continuously remove unnecessary access instead of relying on yearly recertification. | ||
| NIST SP 800-63 | 5.1.3 — Authenticator Lifecycle Management | Long-lived access often persists because lifecycle controls are weak. |
| Recommendation — Shorten credential and authenticator lifetimes to reduce identity drift. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Abuse of still-valid accounts is a common outcome when review cadence is too slow. |
| Recommendation — Monitor for misuse of valid accounts and revoke unneeded access quickly. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | The same review weakness applies when machine identities keep stale access. |
| Recommendation — Track non-human credentials continuously and rotate or revoke them on change. | ||
Practitioner Guidance
What to prioritise: Treat the annual review as a backstop, not a detector. Prioritise identities and entitlements that can create cross-system impact, especially accounts that can both request and approve, deploy and modify, or read and exfiltrate.
What to verify: Verify whether the reviewer can actually see effective privilege. If entitlements are inherited through groups, roles, vaults, or automation, confirm the review includes those downstream permissions and not just the top-level assignment.
Decision rule: If an identity can still reach sensitive systems after business context has changed, move it into a tighter recertification and monitoring cycle rather than waiting for the next annual round. If the access is temporary, expiry should be enforced technically.
What practitioners underestimate: The hardest risk is often not the obvious overgrant, but the combination of several individually “reasonable” permissions that becomes dangerous only when assembled across systems.
Practitioner takeaway: Annual reviews are good at documenting yesterday’s approvals, but identity risk is governed by today’s effective privilege and tomorrow’s combined abuse path.
