TL;DR: As cloud adoption and SaaS sprawl multiply identities and access paths, legacy spreadsheets and static tools struggle to keep pace, while modern IGA platforms automate provisioning, certification, and compliance workflows across hybrid environments, according to SecurEnds. The real shift is not just automation, but governance that keeps access aligned to policy as the identity estate expands.
At a glance
What this is: This is an analysis of why legacy access reviews break down as identity estates expand across cloud, SaaS, and non-human identities.
Why it matters: It matters because IAM and IGA teams need governance that can certify, provision, and retire access across human and non-human identities without relying on manual review cycles.
Context
As cloud adoption and SaaS sprawl expand the identity estate, access governance becomes harder to prove and easier to drift out of policy. In practice, the problem is not just more accounts, but more places where access can persist without a clean lifecycle owner.
Identity governance and administration is the layer that should keep access aligned to business policy, regulatory demands, and end-of-access timing. When teams still depend on spreadsheets or static review cycles, they lose the ability to keep pace with provisioning, certification, and offboarding across hybrid environments.
Key questions
Q: What breaks when access reviews rely on spreadsheets and other manual tracking methods?
A: Spreadsheets and other manual methods break down when access volume, role churn, and system integrations grow. Teams lose visibility into who has access, miss dormant accounts, and fail to spot excessive permissions in time. Manual reviews also tend to become rubber-stamps, which means the process checks a box without actually reducing security risk or improving compliance confidence.
Q: Why do modern IGA platforms matter more as cloud and SaaS sprawl grows?
A: They matter because the governance problem shifts from simple provisioning to continuous validation of who should have access, for how long, and under what policy. As the number of apps, APIs, and identities increases, manual controls cannot keep pace. Automated lifecycle workflows reduce the window in which excessive or orphaned access can persist.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use. If access reviews are always behind, permissions stay stale, and IT has to chase owners for answers, governance is operating more as paperwork than control.
Q: Should organisations prioritise automation or policy modelling first in IGA?
A: They should start with policy clarity, because automation only accelerates whatever rules already exist. If roles, attributes, and approval logic are poorly defined, the platform will scale bad governance faster. The right sequence is to define the access policy model, then automate provisioning, certification, and reporting against it.
Technical breakdown
Why legacy access reviews miss modern identity sprawl
Legacy access reviews were designed for a slower environment where entitlements changed less often and the scope of review was narrower. In cloud and SaaS-heavy estates, identity sprawl means there are more applications, more roles, and more review objects than manual processes can reliably certify. The result is review fatigue, delayed decisions, and residual access that survives long after it should have been removed. Modern IGA shifts the control point from periodic human checking to policy-driven lifecycle automation.
Practical implication: move certification away from spreadsheet-led sampling and into automated entitlement review tied to lifecycle events.
How automated provisioning and deprovisioning change governance
Provisioning and deprovisioning are not just help desk tasks. They are the mechanism that keeps access duration aligned with policy. In a mature IGA model, onboarding, mover changes, and offboarding all trigger governed changes to rights, so access is not left to linger between review cycles. That matters because stale access is often created by process delay, not malicious intent. The technical gain is less about speed alone and more about keeping authority windows short enough to remain governable.
Practical implication: connect joiner-mover-leaver events directly to identity workflows so access ends when the business relationship changes.
Why RBAC and ABAC need policy intelligence, not just configuration
RBAC and ABAC are only useful when the policy model is actually maintained against business reality. If roles proliferate unchecked or attributes are not curated, the control becomes a naming exercise rather than a governance mechanism. Modern IGA platforms add policy intelligence so approvals, exceptions, and recertification can be evaluated against current business context instead of static entitlements. That is especially important in hybrid environments where the same user may hold different access patterns across multiple systems.
Practical implication: periodically test whether your role and attribute models still reflect real business functions before they become access debt.
Threat narrative
Attacker objective: The practical attacker advantage is to exploit stale, excessive, or orphaned access that governance failed to remove in time.
- Entry occurs through identity sprawl, where a new app, API, or SaaS tenant adds another access path that old review processes do not fully cover.
- Privilege persists when certifications and deprovisioning remain manual, allowing unused or excessive rights to stay active beyond the intended business need.
- Impact appears as orphaned access, audit friction, and a wider attack surface because the organisation cannot confidently prove who should still retain permissions.
Breaches seen in the wild
- Home Depot Year-Long Token Exposure: Home Depot exposes authentication tokens in public repository for over a year before remediation.
- Millions of Misconfigured Git Servers Leaking Secrets: Nearly 5 million misconfigured Git servers expose sensitive secrets and credentials online.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Legacy access review models are now structurally misaligned with identity sprawl. The article makes the core problem plain: once cloud apps, SaaS, and non-human identities multiply faster than review cycles, periodic certification stops being a control and becomes paperwork. That is why governance has to shift from inspection after the fact to lifecycle control at the point access is created or changed.
Identity governance has become a policy execution problem, not a spreadsheet problem. Provisioning, deprovisioning, access certification, and SoD enforcement only work when they are connected to authoritative events and current policy. Manual review can still support oversight, but it cannot be the mechanism that keeps access aligned to business intent across hybrid estates.
Machine identities belong inside IGA scope, not beside it. The article correctly notes service accounts, APIs, and bots as part of the governance conversation, and that matters because access control loses integrity when non-human identities are excluded from lifecycle and certification workflows. The practical conclusion is that IGA programmes must govern the full identity estate, not just employee accounts.
Access governance now has to prove end of access, not just grant of access. Modern identity programmes are judged by whether they can revoke rights cleanly when roles, projects, vendors, or systems change. That changes the centre of gravity for the discipline, because orphaned access and stale entitlements are governance failures even when authentication is strong.
Operational simplicity is becoming a governance requirement. The strongest signal in this article is that automation is valuable because it reduces friction in the governance process itself. If identity teams cannot maintain timely certification, lifecycle updates, and audit trails without heavy manual effort, the platform choice is already shaping risk posture. Practitioners should treat governance throughput as a control objective.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: NHI Lifecycle Management Guide
What this signals
Access governance is becoming a lifecycle discipline across human and non-human identities. The article points to a broader shift: organisations can no longer treat IGA as a periodic review layer sitting on top of static accounts. When service accounts, APIs, and bots are part of the estate, governance has to prove that access was issued for a valid purpose and removed when that purpose ended.
Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs. That number matters here because IGA programmes cannot certify what they cannot inventory, and machine identities are now part of the same governance problem as human access.
Access reviews will keep losing value unless they are anchored to current business policy. The next generation of IGA is less about bigger review queues and more about smaller, better-timed governance actions that are triggered by authoritative changes in role, employment status, or system ownership.
For practitioners
- Inventory every identity type in scope Map employees, contractors, service accounts, APIs, and bots into a single governance model so review coverage matches the actual estate.
- Tie access changes to lifecycle events Automate provisioning and deprovisioning from joiner, mover, and leaver triggers so access ends when the business need ends.
- Rebuild certification around policy outcomes Use access reviews to validate whether current entitlements still match role, policy, and regulatory need rather than recertifying old lists.
- Test role and attribute models for drift Check whether RBAC and ABAC rules still reflect current functions, locations, and system boundaries before they create hidden access debt.
- Measure audit readiness by evidence quality Track whether reports can show who has access, why they have it, and when it should end across hybrid systems.
Key takeaways
- Legacy access reviews do not scale cleanly once cloud, SaaS, and machine identities multiply the number of access paths.
- The article's scale problem is governance throughput, not just tooling choice, because manual certification cannot keep pace with identity sprawl.
- The control that changes the outcome is lifecycle automation tied to policy, so access is granted, reviewed, and removed on a governed timeline.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article stresses offboarding and deprovisioning as core governance gaps in sprawling identity estates. |
| NHI-05 — Overprivileged NHI | Excessive access and stale entitlements are central to the governance problem described here. | |
| NHI-07 — Long-Lived Secrets | The article's concern with lingering access paths maps to credentials and access artifacts that outlive their purpose. | |
| Recommendation — Automate offboarding so rights disappear when the business relationship ends. Review NHI entitlements for privilege creep and remove permissions that exceed current need. Shorten credential lifetimes where access persists beyond the intended governance window. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | This article is fundamentally about governing entitlements across hybrid identity estates. |
| Recommendation — Validate entitlements continuously and remove access that no longer matches policy. | ||
| CIS Controls v8 | CIS-5 — Account Management | Automated lifecycle management and account review are the article's primary operational themes. |
| Recommendation — Standardise account lifecycle controls so onboarding, review, and removal are consistent across systems. | ||
Key terms
- Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
- Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
- Role-Based Access Control: A model that grants permissions by assigning identities to predefined roles. It works well when jobs are stable and access patterns are predictable, but it becomes brittle when exceptions pile up. In practice, role design must stay small enough to audit and broad enough to avoid endless custom variants.
- Attribute-Based Access Control: Attribute-Based Access Control is a policy model that grants or denies access using attributes such as user role, device state, location, and application context. It replaces purely static role assignment with a decision process that can adapt to current conditions, provided the underlying attributes are trustworthy and well-governed.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org