The IGA maturity curve: from reviews to continuous assurance

At a glance

What this is: NHI Mgmt Group's analysis, drawing on C1.ai's blog post: Traditional user access reviews are too slow for modern SaaS-heavy environments, and continuous identity assurance is replacing periodic certification as the governing model.

Why it matters: It matters because IAM and IGA teams need controls that match real-time access change, not retroactive evidence, especially as identity scope expands across human and non-human access patterns.

👉 Read C1.ai's analysis of the IGA maturity curve and continuous assurance

Context

Manual user access reviews are a governance control, not a detection control. They were designed to certify access at intervals, but that model breaks down when access changes daily and business systems are constantly reconfigured.

The article frames identity governance as an operating model problem: teams need visibility, automation, and better data across SaaS applications so governance can move from retrospective sampling to continuous assurance. That is relevant to IGA, NHI governance, and broader IAM lifecycle management.

The article also points to the next pressure point for identity programmes: once humans are better covered by automation, ownership, purpose, and access scope across machine identities and AI-driven workflows become the harder governance questions.

Key questions

Q: What breaks when access reviews are treated as a quarterly checkbox?

A: Quarterly reviews assume access remains stable long enough to be meaningfully assessed later. That assumption fails when users, service accounts, or agents only need access for a short task window. The result is stale entitlement approval, weak evidence quality, and a false sense of governance because the review happens after the risk has already moved on.

Q: Why does continuous assurance reduce IGA risk more effectively than manual review?

A: Continuous assurance reduces risk because it evaluates access when changes happen, not after the fact. That timing matters in dynamic SaaS environments where entitlement drift can create exposure long before the next review window. It turns governance into a live control rather than a retrospective audit artifact.

Q: What are the signs that an access review process is failing in practice?

A: A failing access review process usually shows up as long approval cycles, overloaded reviewers, repeated manual preparation, and heavy engineering effort just to launch each campaign. If reviewers need multiple sources to understand a user’s access, or facilitators spend weeks coordinating certifications, the process is not scaling. Those are clear signs the workflow needs better automation and better access context.

Q: How should teams govern non-human identities as assurance becomes continuous?

A: Teams should apply the same visibility, ownership, and purpose checks to non-human identities that they use for human access, but at machine speed. Service accounts, tokens, and automation identities often outlive the business purpose that created them, so continuous governance should track when they are created, used, and retired.

Technical breakdown

Why manual user access reviews go stale

User access reviews, often called UARs, work by asking reviewers to certify whether access remains appropriate at a point in time. The problem is that this model assumes access changes slowly enough for a snapshot to remain meaningful. In SaaS-heavy environments, joiner, mover, and leaver events, privilege creep, and application sprawl make the snapshot obsolete almost immediately. The result is a governance process that can prove a review occurred without proving the entitlement was actually safe when it mattered.

Practical implication: move review scope toward continuously evaluated entitlements instead of relying on fixed certification cycles.

How event-driven continuous assurance changes IGA

Continuous assurance shifts governance from retrospective attestation to near-real-time evaluation of access state, entitlement changes, and risk signals. Instead of waiting for quarterly or annual reviews, the control checks access as events occur and uses automation to surface exceptions, drift, and high-risk access paths. That changes IGA from a compliance exercise into a live governance function. It also fits modern operating models where the business expects faster provisioning, faster deprovisioning, and less manual evidence collection.

Practical implication: design IGA workflows around events, not calendars, so governance follows actual access change.

Why identity data visibility is now a governance dependency

The article highlights a practical constraint many teams hit first: you cannot govern what you cannot see. If identity data is fragmented across hundreds of applications, reviewers spend their time gathering reports instead of making decisions. Connector breadth and automated data collection matter because they let governance teams establish a more complete view of who has access, where it came from, and whether it still has a business purpose. That visibility is what turns automation from a convenience into a control enabler.

Practical implication: unify access data before expanding assurance logic, or continuous governance will inherit the same blind spots as manual review.

Threat narrative

Attacker objective: The practical objective is to exploit access that has drifted beyond its approved purpose before governance processes detect and revoke it.

1. Entry occurs through ordinary identity sprawl, where rapidly changing access states outpace periodic certification cycles and create unchecked risk windows.
2. Credential or entitlement abuse follows when privilege creep, stale access, and shadow applications remain outside timely governance review.
3. Impact is governance failure at scale, because teams can no longer prove that access remained appropriate during the period it was used.

Breaches seen in the wild

• Scania insurance portal breach 2025: An attacker used an external user login, likely stolen by infostealer malware, to take insurance claim documents from a Scania portal.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Manual access review is a lagging assurance model, not a control state. Quarterly or annual certification assumes entitlement risk changes slowly enough for a snapshot to remain valid. In SaaS-heavy environments, that assumption fails because access changes continuously and business context changes with it. The implication is that IGA maturity is no longer measured by how many reviews are completed, but by how quickly entitlement risk is reduced.

Continuous assurance is really event-driven governance. The important shift is not automation for its own sake, but moving the decision point to when access changes occur. That redefines governance from evidence collection after the fact to policy enforcement while risk is still active. Practitioners should treat this as a structural change in control timing, not a reporting upgrade.

Connector depth is now an identity governance control. If identity data cannot be collected across the application estate, reviewers cannot validate ownership, purpose, or access scope with confidence. The article shows that broad SaaS connector coverage is what allows teams to replace manual report chasing with actual oversight. Practitioners should view visibility coverage as part of the control surface, not a separate tooling feature.

Shadow applications expose the limits of certification-based governance. If an application or access path is not in the review population, it cannot be certified out of risk. That is why review programmes degrade in environments where the application estate expands faster than governance coverage. The practitioner conclusion is simple: assurance models must account for discovery, not just approval.

Identity governance is absorbing the same lifecycle pressure now visible in NHI and AI-era programmes. Once teams automate the human review burden, the harder questions become ownership, purpose, and scope across non-human access patterns. The next maturity step is to govern who or what owns access, why it exists, and when it should disappear. That is where IAM, IGA, and NHI governance converge.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Continuous assurance changes the timing of identity governance. The practical question is no longer whether a review occurred, but whether governance detected and corrected access drift while the entitlement was still active. For programme owners, that means moving review logic closer to entitlement creation, change, and revocation events.

Access visibility now functions as a control dependency. If the governance team cannot see all relevant applications and identities, continuous assurance collapses back into selective sampling. The priority is to close coverage gaps before expanding automation, because automation cannot validate blind spots it never receives.

The next maturity problem sits at the boundary between human and non-human access. Once human review workflows improve, the same governance expectations will move to service accounts, tokens, and AI-assisted workflows. That is where identity programmes will be judged on ownership clarity and lifecycle discipline, not just certification completion.

For practitioners

• Replace calendar-based certifications Shift high-risk entitlements from quarterly or annual review cycles to event-triggered checks tied to joiner, mover, leaver, and role-change events.
• Map access data coverage Inventory which applications, identities, and entitlement sources are visible to your governance process and close the blind spots first, especially across SaaS applications.
• Reduce manual evidence collection Automate report gathering, entitlement aggregation, and reviewer workflow so governance teams spend time on exceptions and decisions rather than data chasing.
• Define continuous assurance thresholds Set explicit risk signals that trigger reassessment, such as dormant access, privilege creep, orphaned entitlements, or missing ownership metadata.
• Extend governance to non-human access Apply the same visibility and ownership discipline to service accounts, tokens, and AI-assisted workflows before those identities become the next blind spot.

Key takeaways

• Manual access reviews no longer match the speed of modern identity change, so governance programmes that rely on snapshots will keep missing drift and stale privilege.
• The article’s core evidence is operational rather than theoretical: SaaS sprawl, daily joiner-mover-leaver activity, and shadow applications all weaken periodic certification.
• The control shift is toward event-driven assurance, where identity teams evaluate access as it changes and extend the model to non-human identities as well.

Key terms

• User Access Review: A user access review is a periodic check that confirms each account still needs the access it has. In identity programs, the control is used to reduce excess privilege, support compliance, and catch access that has outlived its business need.
• Continuous Assurance: A control model that checks identity and security conditions continuously instead of only during scheduled audits. It improves readiness in dynamic environments, but it requires clear thresholds, exception handling, and human accountability so automation does not outpace governance.
• Privilege Creep: Privilege creep is the gradual accumulation of access rights beyond what an identity actually needs. It usually happens when permissions are added for convenience and never removed. For NHIs, privilege creep expands blast radius and makes old credentials far more dangerous than their original purpose suggests.
• Shadow Application: A shadow application is a business tool or service used outside formal IT visibility, procurement, or federation controls. These systems often hold real access and sensitive data, but they do not appear fully in identity reports. That makes them a common source of blind spots in reviews, offboarding, and audit evidence.

What's in the full article

C1.ai's full blog covers the operational detail this post intentionally leaves for the source:

• The webinar framing and discussion points from Treasure Data's GRC perspective on continuous assurance
• The connector and data-collection approach used to expand visibility across SaaS applications
• The practical shift from manual reporting to automation-backed governance workflows
• The discussion of how AI changes the division of work between humans and identity systems

👉 The full C1.ai post covers the webinar discussion, SaaS connector detail, and the shift from manual reviews to real-time assurance.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.