TL;DR: Remote and hybrid work have exposed the limits of spreadsheet-driven, quarterly IGA, because access changes faster than manual certification cycles can track, according to SecurEnds. Continuous governance now matters more than periodic clean-up, and the real challenge is keeping entitlements, offboarding, and audit evidence aligned with how people actually work.
At a glance
What this is: This is a commentary on how remote-work identity governance has shifted from periodic access reviews to continuous control as manual IGA models struggle with faster-changing entitlements.
Why it matters: It matters because IAM, IGA, and PAM teams now have to govern access changes, offboarding, and audit evidence in near real time across cloud and remote work environments.
Context
Remote and hybrid work have turned identity governance into a moving target. People connect from unmanaged locations, use more apps, and change access more often, which means the control problem is no longer periodic review but continuous entitlement drift.
Traditional IGA models assumed stable users, stable networks, and review cycles that could catch up later. That assumption no longer holds when cloud apps, shadow IT, and fast-moving job changes create access sprawl and delayed offboarding across the identity lifecycle.
Key questions
Q: What breaks when quarterly access reviews are used for remote work?
A: Quarterly reviews miss the pace of remote-work entitlement change. Access can be granted, expanded, or left behind long before the next certification cycle closes, so the review record no longer matches the live permission state. That creates stale approvals, orphan accounts, and weak evidence for least-privilege compliance.
Q: Why do hybrid environments make identity governance harder?
A: Hybrid environments mix cloud controls, on-premises directories, legacy systems, and inconsistent security defaults. That combination makes identity relationships harder to map and access harder to review. NHI governance becomes more difficult because machine credentials and service accounts often follow the same fragmented paths as human access, but with less oversight.
Q: How can teams tell whether access governance is actually working?
A: Look for short revocation times, low rates of stale entitlements, and repeatable access review outcomes across systems. If accounts remain active after role changes or offboarding, governance is not effective. Good measurement focuses on whether access is removed when it stops being justified.
Q: When should organisations prioritise automation over manual certificate handling?
A: Automation should be the default once an organisation manages more than a small number of certificates, because scale makes manual renewal unreliable. The turning point is not a specific count, but the moment certificates span teams, tools, and infrastructure layers that no single person can track safely.
Technical breakdown
Why quarterly certification misses remote-work entitlement drift
Quarterly access reviews were designed for slower change, where users, apps, and org charts stayed relatively stable between campaigns. In remote work, entitlements shift continuously as people change projects, connect from different devices, and adopt new SaaS tools outside the original access model. Manual certification sees only a snapshot, while the actual entitlement state keeps changing underneath it. That gap creates orphan access, stale approvals, and weak audit evidence because the record of review no longer matches the live permission state.
Practical implication: replace snapshot-based review cycles with governance that can observe and act on entitlement change as it happens.
How cloud-native automation changes access governance
Cloud-native IGA uses API-driven connections to source systems such as directory services, HR platforms, and SaaS applications so provisioning and deprovisioning can follow actual employment changes. This reduces connector lag and removes the need to manually reconcile cloud and on-prem records. Automation also allows policy checks to run at the point of change rather than after a review window closes. The key technical shift is not just speed. It is moving entitlement control closer to the event that creates or removes the access, which improves consistency across distributed work patterns.
Practical implication: integrate authoritative HR and identity sources so access changes are triggered from the same record that drives the workforce lifecycle.
What real-time policy enforcement means for audit readiness
Continuous compliance depends on recording who approved access, when the entitlement changed, and whether policy conditions were met at the moment of grant. In a remote-work model, that evidence must be available without reconstructing it from spreadsheets or ticket trails after the fact. Real-time policy enforcement makes violations visible immediately, which shortens the time between misconfiguration and correction. It also improves the quality of audit evidence because the control state is captured while the decision is still fresh, not weeks later when reviewers are trying to infer what happened.
Practical implication: treat audit evidence as a live control output, not a retrospective reporting exercise.
Threat narrative
Attacker objective: The objective is to exploit the gap between static governance and live access conditions so excessive or forgotten permissions persist unnoticed.
- Entry occurs when remote users log in from dispersed locations and unmanaged applications expand the access surface beyond the original office-centric model.
- Credentialed access then accumulates through shadow IT, shared permissions, and delayed revocation, creating stale entitlements and orphaned accounts.
- Impact follows when audit evidence, least privilege, and offboarding controls no longer reflect the live state of access, leaving organisations exposed to compliance and security drift.
Breaches seen in the wild
- Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Quarterly IGA is a scheduling assumption, not a governance strategy: it assumes access changes slowly enough to be certified after the fact. Remote work breaks that premise because entitlements now drift continuously across cloud apps, devices, and locations. The result is that review cadence becomes disconnected from control reality, and practitioners must treat governance as an always-on state rather than a periodic event.
Access sprawl is the operational symptom of remote-work governance failure: the article correctly points to shadow IT, delayed offboarding, and expanding permissions as the visible outcomes. Those are not separate problems. They are the same control gap showing up in different parts of the identity lifecycle, which is why entitlement centralisation and lifecycle discipline matter more than another review campaign.
Continuous control is now the governance baseline for distributed work: once users, applications, and approvals move faster than quarterly certification, the programme has to shift from clean-up to prevention. That means tying access decisions to live source systems and policy enforcement, not relying on retrospective manager attestations. The practitioner takeaway is that audit readiness now depends on control timing, not just control ownership.
Remote-work IGA is really lifecycle governance under higher entropy: joiners, movers, and leavers still define the same governance problem, but the environment now changes too quickly for manual reconciliation to hold. The article shows why modern identity programmes need policy execution close to the point of change. Teams that keep treating remote work as an exception will keep inheriting the same entitlement drift in a new form.
Real-time control is the new evidence model for identity governance: compliance in distributed environments depends on proving that access was correct when it was granted and revoked when it was no longer needed. That shifts the burden from periodic sampling to continuous recordkeeping across provisioning, certification, and offboarding. Practitioners should expect auditors to question stale evidence more aggressively as remote work normalises.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
What this signals
Continuous entitlement control: remote-work governance now depends on closing the gap between live access and the record of access. When provisioning, review, and revocation all happen through disconnected manual steps, the programme is always reacting after the drift has already occurred.
The practical shift is to treat identity governance as part of the operating rhythm of the business, not a quarterly compliance exercise. For IAM and IGA teams, that means prioritising live source integration, event-driven access changes, and evidence that reflects the current control state rather than last month's state.
For practitioners
- Implement continuous certification for high-risk access Move privileged and externally facing accounts out of quarterly campaigns and into continuous review with event-driven exceptions for remote workers and contractors.
- Automate joiner-mover-leaver triggers from authoritative sources Use HR and directory updates to drive access grants, transfers, and removals so entitlement changes follow the workforce lifecycle instead of manual tickets.
- Centralise entitlement visibility across cloud and on-prem systems Maintain a single operational view of certifications, pending approvals, and active permissions so teams can detect access sprawl before it becomes audit drift.
- Treat offboarding as a same-day control objective Require removal of remote-work access when employment or assignment changes occur, and verify that orphan accounts are not left behind in SaaS or legacy systems.
Key takeaways
- Remote work exposes the weakness of quarterly IGA by making entitlement changes faster than manual certification can track.
- The article frames cloud connectivity, automation, and continuous review as the controls that keep governance aligned with how people actually work.
- For practitioners, the real test is whether access state, offboarding, and audit evidence stay synchronised in near real time.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Remote-work offboarding delays can leave orphaned access behind. |
| NHI-05 — Overprivileged NHI | Access sprawl and stale permissions create overprivileged identities in distributed work. | |
| Recommendation — Enforce same-day removal and verify that remote-worker accounts are fully offboarded. Review remote-user entitlements for excess access and trim privileges to current need. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about maintaining current access permissions across remote environments. |
| Recommendation — Align entitlement governance to live access state instead of quarterly snapshots. | ||
| CIS Controls v8 | CIS-5 — Account Management | Automated provisioning, deprovisioning, and review are account management concerns. |
| Recommendation — Centralise account lifecycle controls so distributed access changes are captured consistently. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Remote-work identity governance depends on controlling credential lifecycle and revocation timing. |
| Recommendation — Tie credential lifecycle checks to workforce changes so stale authenticators do not persist. | ||
Key terms
- Continuous Identity Governance: An operating model where access decisions, lifecycle changes, and risk signals are handled as an ongoing process rather than a periodic campaign. It uses authoritative events, telemetry, and policy automation to keep access aligned with current business and security conditions.
- Access Sprawl: The gradual accumulation of permissions across users, services, and integrations until no one can easily explain why access still exists. In NHI environments, it often appears when machine identities keep inherited rights long after their original business purpose has changed.
- Entitlement Drift: Entitlement drift is the slow accumulation of permissions that no longer match the original purpose, role, or workload. In cloud-native and NHI-heavy environments, it usually happens because access changes faster than review cycles, leaving organizations with more privilege than they intended.
- Continuous Compliance: Continuous compliance is the practice of keeping controls and evidence current as the environment changes, rather than proving compliance after a review cycle. For identity and NHI programmes, it means access, logging, and revocation must operate together in real time.
Deepen your knowledge
NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org