Why do certification campaigns lose value when timing and scope are loose?

Certification loses value when the campaign is too broad, starts from stale data, or runs long enough for the access state to change mid-review. Reviewers end up validating an outdated snapshot instead of current entitlement reality. The result is compliance theatre, not actual governance.

Why This Matters for Security Teams

When certification campaigns are too broad or poorly timed, they stop measuring access reality and start measuring paperwork discipline. That matters because the security value of certification is not the form itself but the ability to detect privilege drift, orphaned access, and role creep before they become incident paths. Guidance from the OWASP Non-Human Identity Top 10 aligns with NHI Management Group’s broader warning that stale entitlement reviews create false confidence rather than control. The same problem appears in NHIs and human accounts alike: once a review spans too many systems or lasts too long, the evidence no longer reflects what is actually in use. That is especially dangerous where secrets, API keys, and service accounts can change faster than the campaign cycle. In practice, many security teams encounter over-entitlement only after a misuse event or audit exception has already exposed the gap, rather than through intentional governance.

How It Works in Practice

Effective certification depends on a tight snapshot boundary. The reviewer should be validating a current, bounded set of entitlements, not an organisation-wide inventory that changes beneath the campaign. Best practice is to define scope by system, application, business function, or NHI population, then anchor the review to a specific point in time. For non-human identities, this often means tying certification to workload identity records, secret issuance logs, and ownership metadata rather than to a generic account list. NHI Management Group’s research on the key challenges and risks shows that weak ownership and fragmented control are recurring causes of access sprawl.

Operationally, campaign design should include:

• Fixed start and end dates, with a freeze on scope once evidence collection begins.
• Automation to pre-populate reviewers with current entitlement data and last-used signals.
• Separate treatment for privileged, dormant, and exception-based access so high-risk items do not hide in bulk reviews.
• Escalation rules for stale or unresolved items, including automatic removal when no approver responds.

The State of Secrets in AppSec reinforces why timing matters: leaked secrets can remain exposed for weeks, so a slow campaign can easily miss the window where remediation still prevents abuse. These controls tend to break down in environments with rapidly changing service accounts, multi-tenant SaaS estates, or manual approval chains because the entitlement state drifts faster than the review process can close.

Common Variations and Edge Cases

Tighter certification often increases operational overhead, requiring organisations to balance review accuracy against reviewer fatigue and change-management friction. That tradeoff is real, especially where business owners oversee hundreds of entitlements or where access changes daily. In those environments, current guidance suggests using risk-based segmentation rather than one universal campaign for everything. High-risk roles, privileged NHIs, and externally exposed credentials should be reviewed more frequently and with stronger evidence requirements, while low-risk access can follow a lighter cadence.

There is no universal standard for this yet, but emerging practice favours shorter, event-driven certifications triggered by material changes such as role changes, project completion, secret rotation, or anomalous use. That approach reduces the odds that the campaign validates a stale state. It also helps when paired with continuous signals from PAM, JIT provisioning, and workload identity systems, because the review can confirm whether the access was still justified at the time it existed. NHIMG’s Sisense breach and the DeepSeek breach illustrate how quickly compromised credentials and exposed systems can turn weak governance into operational risk. Certification loses most of its value when teams treat it as a compliance calendar item instead of a control tied to current entitlement state.

Related resources from NHI Mgmt Group

• When do NHI access reviews create more value than a one-time cleanup?
• Why do identity teams miss value in tools they already own?
• Why do access reviews lose value when access rarely changes between cycles?
• Why do non-human identities make access certification harder than human identities?