On-demand access reviews close the recertification security gap

At a glance

What this is: This is an analysis of event-driven access reviews, showing that fixed recertification cycles leave a governance gap that on-demand reviews are designed to close.

Why it matters: It matters because IAM, IGA, and PAM teams need review controls that respond to role change, privilege drift, and NHI lifecycle events before stale access becomes exploitable.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts.
• 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
• 69% of organisations now have more machine identities than human ones.

👉 Read Veza's analysis of on-demand access reviews and lifecycle-triggered certification

Context

On-demand access reviews are a governance control that launches certification when access changes, rather than waiting for a fixed quarterly or semiannual cycle. In an environment where user roles shift, service accounts persist, and non-human identity access accumulates, calendar-based reviews leave too much time for over-privilege to become normal.

For IAM and IGA teams, the core problem is not whether access reviews exist, but whether they happen close enough to the event that created the risk. Event-driven reviews fit joiner-mover-leaver changes, privilege escalation, orphaned accounts, and stale NHI access because they compress the time between drift and decision.

That is the same lifecycle problem covered in the Ultimate Guide to NHIs: ownership, minimal privilege, visibility, rotation, and assured destruction all fail when review cadence lags operational change.

Key questions

Q: How should security teams replace calendar-based access recertification?

A: Security teams should keep periodic certification for baseline governance, but add event-driven reviews for role changes, termination, privilege escalation, MFA changes, and dormant accounts. The goal is to shorten the time between a material identity event and the review decision, so access drift is challenged while it is still relevant.

Q: Why do periodic access reviews leave organisations exposed?

A: Periodic reviews are snapshots, not continuous control. They assume access state remains stable long enough to be certified later, which is often untrue in SaaS-heavy and hybrid environments. By the time a review identifies stale access, the entitlement may already have created risk, lateral movement opportunity, or compliance exposure. The delay is the problem.

Q: What breaks when on-demand reviews use the wrong review scope?

A: If the trigger is high-risk but the review scope is too narrow, the control can certify the wrong entitlements and miss the real exposure. The scope must reflect the risk surface created by the event, not just the object that triggered the alert, otherwise the review becomes noisy without becoming effective.

Q: Who should be accountable when event-driven access reviews fail to close residual access?

A: Accountability should sit with identity governance owners, application owners, and the business managers who approve access decisions, because the failure is usually a process design gap rather than a single bad review. Frameworks such as access certification, lifecycle management, and least privilege all require clear ownership and auditable action.

Technical breakdown

Why calendar-based recertification creates an access review gap

Traditional access recertification is built around fixed campaign windows, usually quarterly or twice a year. That model works for compliance reporting, but it is a poor control for fast-moving identity estates because privilege changes do not respect the calendar. By the time a campaign starts, users may have changed roles, offboarded employees may still retain access, and NHIs may have accumulated stale permissions. The result is a security gap between cycles where least privilege cannot be assured.

Practical implication: Use review triggers tied to identity events, not only scheduled campaigns.

How on-demand reviews use identity and authorization state drift

On-demand review systems watch for state changes such as new roles, disabled MFA, elevated risk scores, dormant users, or API tokens expiring. The important architectural point is that the trigger is not the access itself, but a deviation from an expected baseline. That makes the control continuous in practice, even if the underlying access review workflow still produces a formal certification artifact. For NHI estates, the same logic applies to stale keys and orphaned service accounts, where drift often arrives before human reviewers notice.

Practical implication: Tie review launch conditions to measurable drift signals in identity and authorization state.

Triggering query versus scoping query in event-driven certification

Event-driven access reviews often separate the query that detects the condition from the query that defines what gets reviewed. For example, a high-risk user record can trigger a review of privileged entitlements, even if the triggering and scoping logic are different. This separation matters because it lets teams detect one signal and then review a different entitlement surface that is logically related to the risk event. It also supports more precise review scoping for managers, owners, or application custodians.

Practical implication: Design trigger logic and review scope separately so each review matches the real risk surface.

NHI Mgmt Group analysis

Calendar-based recertification is a control timing problem, not a control absence problem. The article is right to focus on the security gap between review cycles, because the risk is not that organizations never review access. The risk is that review timing is too slow for modern identity churn across users and NHIs. Least privilege degrades in the interval between events and the next campaign, so practitioners need to treat timing as part of the control design.

Event-driven review is the right governance pattern for both human and non-human identities. JML events, privilege escalation, dormant accounts, and orphaned service accounts are different signals, but they all point to the same governance requirement: review must follow material state change. This is where identity lifecycle management and access certification converge, because the actor changes but the governance question does not. The practical implication is that IGA teams should stop treating review cadence as a fixed calendar exercise and start treating it as an identity-state response.

Review quality improves when launch conditions and review scope are decoupled. A high-risk event does not always tell you exactly what should be reviewed, which is why trigger logic and scoping logic should be separate. That separation reduces both noise and blind spots, especially when a user or NHI has accumulated access across multiple systems. Practitioners should see this as a way to preserve precision without slowing response.

Assured destruction is the missing lifecycle assumption behind stale NHI access. The assumption that access can simply be certified at the next cycle was designed for access that persists long enough to be reviewed. That assumption fails when service accounts, tokens, and keys outlive their intended purpose between cycles. The implication is that lifecycle governance for NHIs must be event-aware, because expiration and offboarding cannot be left to periodic cleanup alone.

From our research:

• Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
• 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
• The 52 NHI Breaches Analysis shows how long-lived access and weak lifecycle control repeatedly turn identity drift into breach material.

What this signals

Event-driven review will become a baseline expectation for mature IAM and IGA programmes, because review cadence that ignores mobility and privilege drift is already behind the operational tempo of modern identity estates. With only 5.7% of organisations having full visibility into their service accounts, blind spots will keep growing unless certification is tied to events that change risk.

Review timing debt: this is the gap between when access changes and when governance catches up. Teams that treat access recertification as a calendar task will continue to certify yesterday's state, while their real exposure accumulates in the gap.

For identity programmes that span humans, NHIs, and emerging agentic systems, the next step is to make review triggers part of the lifecycle fabric rather than a separate compliance event. That means tying review launch to HRIS, IdP, PAM, and machine-identity signals, with direct alignment to the OWASP Non-Human Identity Top 10 and the SPIFFE workload identity specification where workload identity is in scope.

For practitioners

• Tie reviews to identity events Launch access certification when role changes, privilege escalation, MFA changes, or termination events occur instead of waiting for quarterly cadence.
• Separate trigger logic from review scope Use one saved query or alert to detect risk and a different scoping query to define which entitlements or accounts must be reviewed.
• Prioritise leaver and mover workflows Make offboarding and role-change events automatic review triggers so residual access is challenged before the next campaign window.
• Include orphaned NHI assets in the same workflow Extend event-driven review logic to stale service accounts, expired tokens, and inactive keys so machine access is not left outside the governance loop.
• Use review intelligence selectively Apply approval recommendations only where the evidence model matches the event type, and require human validation when the trigger is a high-risk mobility or security change.

Key takeaways

• Calendar-based recertification leaves an exploitable gap between identity change and access review, which is why event-driven certification matters.
• The strongest use case is lifecycle-triggered review for movers, leavers, privilege changes, and stale NHI access, where delay is the real control failure.
• Practitioners should separate trigger logic from review scope so the review reflects the actual risk surface, not just the event source.

Key terms

• On-Demand Access Review: An on-demand access review is a certification launched in response to a specific event, such as a role change, privilege escalation, or termination. It replaces purely calendar-based recertification with a decision made close to the time risk changes, which makes the governance signal more accurate and operationally useful.
• Review Scoping Query: A review scoping query defines which accounts, roles, or entitlements are included once a trigger fires. It can differ from the detection query that launched the review, which lets teams separate risk detection from certification scope and avoid reviewing the wrong identity surface.
• Identity Drift: Identity drift is the gap between the access path originally approved and the behavior that exists later. For browser extensions, drift can appear through updates, remote configuration, publisher changes, or permission expansion, turning a trusted integration into a materially different risk.
• Change-Triggered Governance: A control approach that initiates review or action when a material event occurs, such as a breach, acquisition, outage, or new dependency. It is better suited to dynamic ecosystems than fixed calendar-based review cycles.

What's in the full article

Veza's full article covers the operational detail this post intentionally leaves for the source:

• How Access Intelligence rules translate identity drift into on-demand review launches across specific alert conditions.
• How Lifecycle Management workflows chain HRIS or IdP events into immediate mover and leaver certifications.
• How consolidated mode and individual mode change review handling for broad versus entity-specific access changes.
• How Review Intelligence and Veza Actions can be layered into downstream remediation workflows after review decisions.

👉 Veza's full article covers the alert logic, lifecycle workflow configuration, and review scoping details.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.