Modern access certifications are failing under identity sprawl

At a glance

What this is: This is Linx Security’s guide to modern access certifications, arguing that review processes built for simpler identity estates no longer scale as identity sprawl expands across human and non-human accounts.

Why it matters: It matters because IAM and IGA teams need access reviews that keep pace with service accounts, NHIs, and AI agents, or they will keep certifying stale access long after the risk has emerged.

Context

Access certifications are the process of checking whether an identity still needs the access it has been granted. In modern environments, that governance task now spans human users, contractors, service accounts, non-human identities, and AI agents, so the old review model fails when it assumes a small, mostly static identity estate.

The problem is not the idea of review, but the operating model around it. When entitlements are spread across SaaS, cloud, Active Directory, and other systems, security teams spend more time collecting evidence than evaluating risk, which delays remediation and weakens the control’s value.

Linx Security uses the article to argue that access certification needs to move from a periodic compliance task to continuous identity governance. That is the right framing for programmes where privilege can accumulate faster than manual review cycles can clear it.

Key questions

Q: What breaks when access certifications are still run with spreadsheets and manual exports?

A: Spreadsheet-driven certifications break when identity data is fragmented across SaaS, cloud, Active Directory, and contractor systems. Reviewers cannot reconstruct the full access picture quickly enough, so they make decisions with incomplete context and remediation lags behind the risk. The control becomes administrative rather than preventive.

Q: Why do modern access reviews create less value when they are only run quarterly?

A: Quarterly reviews create less value because identity environments change continuously between campaigns. Roles shift, contractors leave, new permissions appear, and excessive access can sit active for months before anyone sees it. The longer the gap, the more the review becomes evidence of compliance rather than reduction of exposure.

Q: How should security teams improve access certification without creating reviewer fatigue?

A: Security teams should reduce the number of low-value decisions each reviewer sees by grouping stable access, prioritising unusual or privileged entitlements, and pre-classifying items that rarely change. The goal is to preserve human attention for access that is hard to justify. Certification works when reviewers can make informed decisions quickly, not when they are forced to process noise.

Q: Why do service accounts and AI agents need different controls from human users?

A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.

Technical breakdown

Why spreadsheet-based access reviews stop working at scale

Traditional access certifications depend on exported reports, manual correlation, and reviewer judgment. That model breaks when identity data lives across SaaS apps, cloud providers, Active Directory, HR systems, and contractor workflows, because no single reviewer can reliably reconstruct the full access picture from disconnected evidence. The result is not just slower reviews, but lower-quality decisions. Reviewers get too little context, managers rubber-stamp permissions, and remediation lands in separate ticket queues. In practice, the review campaign becomes an administrative event instead of a governance control.

Practical implication: build a unified identity inventory before expecting certification campaigns to produce defensible decisions.

How context and AI change the access certification workflow

Modern review programmes add context to each entitlement before a human makes a decision. That context includes last use, peer comparison, business justification, privilege level, and whether an account is orphaned or unusually risky. AI then helps triage by pre-populating low-risk decisions and flagging outliers, which reduces reviewer fatigue without removing accountability. The control objective is not to replace human judgment, but to make judgment usable at enterprise scale. Without context enrichment, reviewers are forced to treat every permission as equally important, which is why certification quality degrades as volume rises.

Practical implication: enrich review records with usage, peer, and risk signals so reviewers can focus on exceptions.

What continuous identity governance changes in remediation

Continuous identity governance extends the review mindset beyond quarterly or annual campaigns. Instead of waiting for the next cycle, it watches for identity events such as role changes, contractor offboarding, and new permission grants, then closes the loop with automated remediation after a revocation decision. This matters because access often becomes risky between campaigns, not during them. The programme objective shifts from proving that a review happened to reducing the time an excessive entitlement remains active. That is a structural change in governance, not just an automation tweak.

Practical implication: wire certification outcomes directly to automated deprovisioning so excess access is removed at the point of decision.

Threat narrative

Attacker objective: The objective is to exploit stale or excessive access before governance catches up, turning unmanaged entitlements into a durable path to misuse or lateral access.

1. Entry begins when identities proliferate faster than governance processes can enumerate them, leaving service accounts and AI-linked access outside routine certification coverage.
2. Credential or permission exposure follows as standing entitlements accumulate across SaaS and cloud systems without timely review or context.
3. Escalation happens when excessive access remains active long enough for misuse, privilege creep, or orphaned-account abuse to become operationally meaningful.
4. Impact is delayed remediation and weak audit evidence, which increases the chance that risky access survives through the next review cycle.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
• Cloudflare Thanksgiving breach 2023: One service token and three service accounts left unrotated after the Okta breach gave a nation-state attacker access to Cloudflare's Atlassian systems.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity sprawl has turned access certification from a review problem into a data problem. When access lives across SaaS, cloud, contractor workflows, service accounts, NHIs, and AI agents, the control fails first on visibility, not judgment. Review quality collapses when teams cannot reliably assemble the entitlement picture before certification begins, so the programme becomes reactive rather than governed.

Access certifications are no longer a point-in-time control for modern estates. The old assumption was that access would persist long enough to be reviewed in a scheduled cycle. That assumption breaks when permissions are created, changed, and retired continuously across both human and non-human identities, so the decisive governance question becomes whether review and remediation can keep up with entitlement churn.

Continuous identity governance is the right programme shape for mixed identity estates. A review process that only proves compliance after the fact cannot keep pace with privilege creep, orphaned accounts, and contractor churn. The practical implication is that certification, lifecycle management, and remediation need to operate as one control loop, not as separate activities.

Privilege accumulation is the real risk signal, not the existence of a review campaign. A team can run quarterly certifications and still leave excessive access active for months between campaigns. That is why the field should treat access review maturity as a measure of how quickly it can reduce standing privilege, not how many campaigns it can complete.

Modern access certification must govern humans and NHIs with the same discipline, but not the same assumptions. Human reviewers need business context, while service accounts and AI-linked identities need ownership, scope, and lifecycle visibility. The governance model should reflect that identity types behave differently, even when they are all subject to the same certification control.

From our research library:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: Access Reviews and Certification Guide

What this signals

Identity sprawl is converting access certification into a continuous governance problem. The practical shift is from reviewing identity snapshots to managing entitlement churn across human users, service accounts, and AI-linked access. Programmes that still rely on annual or quarterly campaigns will keep finding excessive access after it has already had time to matter.

Service account visibility is now a governance boundary, not a reporting nicety. Only 5.7% of organisations have full visibility into their service accounts according to the Ultimate Guide to NHIs, which means many review programmes are certifying what they can see rather than what actually exists.

Access review maturity now depends on control-loop speed. The programme value comes from how quickly it can collect data, apply context, certify decisions, and remove excess access before privilege creep becomes operationally meaningful. That is the governance standard modern identity teams should be measuring.

For practitioners

• Build a unified entitlement inventory Connect SaaS, cloud, Active Directory, HR, and contractor sources into one identity view before starting a certification cycle.
• Enrich reviews with usage and risk context Surface last use, peer comparisons, role justification, and privilege signals next to each access decision so reviewers are not guessing.
• Automate remediation from review outcomes Trigger deprovisioning directly from the certification decision rather than relying on manual tickets to remove access later.
• Extend certification scope to non-human identities Include service accounts, NHIs, and AI agents in the same governance workflow as employees and contractors, with ownership and lifecycle evidence.
• Shift from campaign metrics to exposure metrics Track how long excessive access stays active between reviews, because the real governance question is reduction of standing privilege over time.

Key takeaways

• Access certification breaks down when identity data is fragmented across too many systems for reviewers to assess consistently.
• Modern review programmes need context enrichment and automated remediation to turn certification from a compliance exercise into risk reduction.
• Service accounts, NHIs, and AI agents must sit inside the same governance model as human users because privilege accumulates across all of them.

Key terms

• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
• Continuous Identity Governance: An operating model where access decisions, lifecycle changes, and risk signals are handled as an ongoing process rather than a periodic campaign. It uses authoritative events, telemetry, and policy automation to keep access aligned with current business and security conditions.
• Identity Sprawl: Identity sprawl is the uncontrolled growth of identities, entitlements, and credentials across an environment. For NHIs, it usually appears when automation creates accounts faster than governance teams can inventory, review, and remove them. The result is hidden access, weak accountability, and a wider attack surface.
• Reviewer Fatigue: Reviewer fatigue is the point at which decision-makers are given too many low-context access records and begin approving by default. It is a process design failure, not a character flaw. In practice, it is caused by volume, poor enrichment, and interfaces that make careful judgment slower than rubber-stamping.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.