TL;DR: As headcount, devices, SaaS accounts, and access requests grow, spreadsheet-led IT management creates data gaps, orphaned accounts, privilege creep, and audit pain, while JumpCloud cites 83% of former employees retaining access to previous employer accounts and a $4.9 million average breach cost. The core issue is not tooling convenience but the collapse of a single source of truth for identity and device governance.
At a glance
What this is: This is an analysis of why spreadsheet-based IT governance stops working as organisations scale, leading to weak visibility over devices, access, and compliance evidence.
Why it matters: For IAM, IGA, and PAM teams, the issue is that manual tracking cannot sustain joiner-mover-leaver control, access review accuracy, or audit-ready accountability across growing human and non-human estates.
Context
Spreadsheet-led IT governance works only when the environment is small enough for manual tracking to stay current. Once headcount, device counts, SaaS apps, and access requests rise together, the control model depends on humans noticing every change before records drift.
The governance gap is not simply operational inefficiency. In identity programmes, stale records and delayed updates create orphaned access, privilege creep, and incomplete audit evidence, which means the spreadsheet stops being a record of truth and becomes a source of risk.
Key questions
Q: How should teams replace spreadsheet-based IT access tracking?
A: Teams should move entitlement management into a governed identity workflow that enforces provisioning, change, review, and revocation from one authoritative record. The key test is whether the system can keep pace with daily role changes without relying on manual reconciliation across files, email, and shared drives.
Q: Why do spreadsheets create orphaned accounts and privilege creep?
A: Because they record access after the fact rather than controlling its lifecycle. When joiner-mover-leaver events are handled manually, revocation is delayed, role changes are missed, and permissions accumulate beyond need. The result is stale access that survives because no enforcement point closes the loop.
Q: What are the signs that manual application governance is breaking down?
A: Common signs include access reviews that rely on spreadsheets, provisioning requests that pile up in tickets, and remediation steps that wait for a person to log in. When those patterns appear, governance is already lagging behind the environment. Another signal is repeated mismatch between reported access data and what is actually configured in the application.
Q: What should auditors expect when access evidence lives in spreadsheets?
A: They should expect slow evidence gathering, inconsistent approval trails, and difficulty proving who had access at a given time. Spreadsheet records may help with inventory, but they are weak for accountability unless they are backed by systems that preserve timestamps, ownership, and revocation history.
Technical breakdown
Why spreadsheets fail as a source of truth for access
A spreadsheet is a static record, while identity and device governance is a moving system. As users join, change roles, leave, and request access, the spreadsheet must be updated in lockstep with reality, or it becomes stale. That drift matters because entitlement decisions rely on current context: who the user is, what they need, what device they use, and whether access should still exist. Once records are fragmented across files, email threads, and shared drives, there is no reliable authority for provisioning, revocation, or review.
Practical implication: replace spreadsheet records with governed identity inventory and lifecycle workflows before entitlement decisions become detached from current state.
How manual access tracking drives orphaned accounts and privilege creep
When access changes are handled by email, chat, or one-off edits, the lifecycle of a permission is no longer tied to a controlled process. That is how orphaned accounts persist after offboarding and why privileges accumulate beyond role need. In NHI terms, the same pattern appears when service accounts, tokens, or shared credentials outlive their owning process. The underlying problem is not just missed cleanup, but the absence of a single authoritative workflow for granting, reviewing, and removing access.
Practical implication: connect provisioning, deprovisioning, and access approvals to a controlled lifecycle so stale entitlements do not survive role changes or departures.
Why audit evidence collapses when controls live in files and notes
Audit readiness depends on proving who had access, who approved it, and when it changed. Spreadsheets rarely preserve that chain of evidence cleanly, especially when supporting detail sits in notes, emails, and informal messages. As a result, teams spend time reconstructing events instead of demonstrating control. This is a governance failure, not just a documentation problem, because evidence that cannot be trusted at review time cannot support accountability, recertification, or compliance reporting.
Practical implication: centralise approval history and access records in systems that preserve timestamps, ownership, and revocation events automatically.
Threat narrative
Attacker objective: The practical attacker objective is to exploit stale or excessive access that remains available because governance records are incomplete or outdated.
- Entry occurs through operational sprawl, where access and asset changes are recorded manually across spreadsheets, email, and shared drives instead of a governed system.
- Escalation follows when stale entries and missed updates leave users, devices, or accounts with permissions that no longer match their role or employment status.
- Impact appears as orphaned access, privilege creep, delayed onboarding and offboarding, and audit evidence that must be reconstructed by hand.
Breaches seen in the wild
- JumpCloud breach 2023: North Korean hackers breached JumpCloud and abused its device commands framework against a few customers; all admin API keys were reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Spreadsheet governance is a scale-bound control, not a durable identity model: Spreadsheets can document IT state, but they cannot govern it once changes become continuous. The moment access, device, and lifecycle decisions outpace manual updates, the record stops reflecting reality. The practitioner conclusion is simple: if the system cannot enforce change, it cannot remain the source of truth.
Orphaned access is the predictable outcome of manual lifecycle handling: When joiner-mover-leaver activity is tracked through files and messages, revocation becomes a best-effort task instead of a control boundary. That is why former users, dormant accounts, and stale permissions persist. The implication is that lifecycle governance must move from tracking to enforcement if the organisation wants reliable deprovisioning.
Privilege creep is not an access issue alone, but an evidence issue: Excess permission accumulates because no workflow continuously reconciles current role need against granted access. In practice, review cycles built on incomplete records certify drift instead of removing it. The practitioner conclusion is that recertification only works when entitlement data is current enough to trust.
Identity blast radius expands when one control plane is fragmented across spreadsheets: A named concept for this pattern is identity blast radius, the amount of operational and security damage created when access truth is scattered. The larger the business, the faster that blast radius expands across human identity, device governance, and NHI controls. Practitioners should treat fragmentation itself as a risk condition, not just an inconvenience.
Manual governance hides the difference between visibility and control: A team may be able to see an account in a spreadsheet without being able to revoke it, attest it, or trace its approval. That gap is where audit pain and breach exposure overlap. The practical conclusion is that visibility must be paired with enforceable lifecycle control, or it is only administrative documentation.
What this signals
Identity governance fails when the record and the control plane diverge: The deeper issue in spreadsheet-led IT management is not documentation hygiene but enforcement failure. If access decisions can be edited in one file while approvals and revocations live elsewhere, the organisation has no dependable lifecycle control for human identity, NHI, or device access.
Identity blast radius: this is the expanding security and audit impact created when access truth is fragmented across spreadsheets, emails, and shared drives. As companies scale, that fragmentation turns routine lifecycle work into a governance problem that no manual process can keep up with.
For practitioners
- Replace spreadsheet-based entitlement tracking Move user, device, and application records into a governed identity system that can enforce provisioning, deprovisioning, and approvals from the same record.
- Rebuild offboarding around revocation triggers Tie leaver workflows to automatic access removal so former employees do not retain accounts, tokens, or device access after departure.
- Centralise access approvals and audit trails Capture who approved each entitlement, when it changed, and what was removed so reviewers can verify access history without reconstructing it from email.
- Inventory shadow IT and unmanaged devices Map unsanctioned apps and endpoints that never enter the spreadsheet process, then bring them into the same governance workflow as sanctioned assets.
Key takeaways
- Spreadsheet governance breaks down because it cannot keep a current, enforceable view of users, devices, and access as the organisation grows.
- Manual tracking predictably produces orphaned accounts, privilege creep, and audit evidence that is hard to trust or reconstruct.
- The practical fix is a governed lifecycle model with automated provisioning, revocation, and approval history in one authoritative system.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Manual offboarding leaves access behind when spreadsheets are the record of truth. |
| NHI-05 — Overprivileged NHI | The article's privilege creep problem maps to excess access across human and machine identities. | |
| Recommendation — Tie leaver workflows to enforced revocation so accounts and credentials do not outlive employment. Reconcile granted access against current need and remove entitlements that exceed role scope. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about keeping permissions and authorisations current as the environment changes. |
| Recommendation — Centralise entitlements so authorisations are reviewed and revoked from a single governed process. | ||
| CIS Controls v8 | CIS-5 — Account Management | Manual account handling is the core control weakness described in the article. |
| Recommendation — Use formal account management workflows to track creation, changes, and termination of access. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Privilege creep is a direct least-privilege failure when access outgrows role need. |
| Recommendation — Apply least privilege reviews to strip permissions that are no longer required. | ||
Key terms
- Single source of truth: A single source of truth is the authoritative system that holds the current state of identity and access records. In practice, it reduces reconciliation work, improves auditability, and gives security teams one place to enforce policy and detect drift.
- Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
- Orphaned Account: An orphaned account is an identity that remains active without a clear owner or business purpose. These accounts are dangerous because they often escape review, retain unnecessary access, and provide attackers with low-friction entry points into otherwise governed environments.
- Joiner, Mover, Leaver Workflow: A joiner, mover, leaver workflow is the process that grants, updates, and removes access as a user or identity changes state. In modern programs, the same logic should extend beyond employees to service accounts and AI agents so access does not persist after need ends.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org