TL;DR: Manual user access reviews are still the dominant model in many environments, but disconnected applications, limited APIs, and complex hybrid estates make them slow, error-prone, and hard to evidence, according to Cerby. The real issue is not just review fatigue: access governance breaks when controls cannot be consistently proved across the full application footprint.
At a glance
What this is: This is an analysis of why user access reviews are breaking under disconnected app sprawl, with manual review workflows increasingly unable to scale or produce reliable evidence.
Why it matters: IAM and IGA teams need to know that review quality is now constrained by application reach, not just reviewer discipline, which affects compliance, auditability and lifecycle governance across both human and non-human identities.
Context
User access reviews are a governance control, not just an audit task. They are meant to confirm that access to applications and data is limited to the right identities and can be evidenced when challenged.
In disconnected app estates, that control becomes hard to operate because review data lives in multiple systems, some of which do not expose the standards or APIs that IAM and IGA workflows expect. The result is a control that may exist on paper but cannot be executed consistently across the full application footprint.
Cerby’s article argues that this is now a practical compliance problem for regulated organisations, where manual processes, hybrid estates and changing access relationships make review evidence expensive to assemble and easy to miss.
Key questions
Q: What breaks when user access reviews depend on disconnected applications?
A: Coverage breaks first, then evidence quality. If entitlement data has to be exported manually or copied into spreadsheets, the review no longer has a reliable view of who has access, whether changes were approved, or whether revocations actually happened. That creates control gaps even when the review process is formally followed.
Q: Why does manual access review create risk for financial services organisations?
A: Manual access review increases risk because it is slow, fragmented, and hard to keep current across many systems. When evidence lives in spreadsheets, emails, and tickets, teams can miss access changes between audits and lose context around who should own a review. That weakens control over customer funds, delays remediation, and makes it harder to prove that access was properly governed.
Q: How can security teams tell whether privileged access reviews are actually working?
A: They are working when every privileged entitlement is inventoried, every decision is traceable, and revoked access is removed from all connected systems without delay. If the organisation can only show approvals but not downstream revocation, the review is administrative recordkeeping rather than governance. Proof of removal is the best maturity signal.
Q: What should organisations do when an application cannot support automated access review?
A: Treat the system as a governed exception, assign a named owner, document the manual evidence path and define a remediation plan to reduce the dependency. If the application stays out of automation indefinitely, the organisation should assume audit friction and residual access risk remain.
Technical breakdown
Why disconnected applications break access review coverage
User access reviews depend on complete inventory, reliable entitlement data and a repeatable way to collect evidence from each application. When apps do not support standards such as SAML, SCIM or usable APIs, IGA tools cannot pull consistent access data or automate revocation workflows. That pushes teams into exports, spreadsheets, email approvals and manual reconciliation. The technical problem is not just integration cost. It is that the control surface becomes fragmented, so the organisation can no longer prove that every app in scope was reviewed on the same basis.
Practical implication: map which applications are outside automated review coverage and treat them as explicit control exceptions until they are governable.
Why manual review workflows fail as evidence mechanisms
A user access review is only useful if it leaves an audit trail that shows what was checked, by whom, when and with what outcome. Manual processes can generate that trail, but only after teams stitch together logs, screenshots, spreadsheets and approval records from multiple systems. That creates timing gaps, transcription errors and weak linkage between entitlement data and revocation actions. In practice, the evidence burden grows faster than the control itself, which is why many organisations end up with review activity that is visible but not convincingly evidenced.
Practical implication: standardise evidence capture so every review produces a traceable record of entitlement data, decision, and remediation.
How lifecycle change turns access review into a moving target
Access reviews are often designed as point-in-time checks, but app sprawl and workforce churn mean entitlement states change while the review is still being assembled. Joiners, movers, leavers, contractors and third parties can gain or lose access across several systems before a review concludes. That makes lifecycle management part of the review problem, not a separate one. If entitlement state is changing faster than the review cadence and remediation path, the control cannot reliably attest to current access posture.
Practical implication: connect reviews to lifecycle triggers so entitlement changes and offboarding events update review scope before certification closes.
Threat narrative
Attacker objective: The objective is to preserve unauthorised or unverified access long enough for it to be exploitable or indefensible in audit and incident review.
- Entry begins with distributed application estates where some systems are not covered by normal IAM or IGA integrations, so access data must be gathered manually.
- Escalation occurs when reviewers rely on spreadsheets, exports and ad hoc approvals, creating opportunities for missed entitlements, delayed revocations and weak evidence chains.
- Impact follows when the organisation cannot prove timely review or revocation, which can expose it to compliance failures, audit findings, operational delay and fraud-enabled abuse.
Breaches seen in the wild
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Access review coverage is now constrained by application reach, not reviewer effort. Cerby’s article shows the governance bottleneck clearly: manual review programmes can look active while still leaving disconnected applications outside dependable control. The issue is structural because access governance only works where entitlement data can be collected, compared and acted on consistently. Practitioners should read this as a coverage problem, not a process diligence problem.
Evidence quality has become the real control boundary for user access reviews. A review that cannot produce linked entitlement records, approval history and revocation proof is not operationally equivalent to one that can. That matters because auditors and regulators do not inspect intention, they inspect traceability. The implication is that organisations need to treat evidence production as part of the control, not as a post-review reporting task.
Disconnected apps create an access governance blind spot that conventional IGA maturity models understate. The article’s point is that legacy portals and specialised business apps do not just slow automation, they can place entire classes of access outside the review system. That means risk is concentrated where integration is weakest, not necessarily where privilege is highest. Practitioners should prioritise governance by control reach, not by application familiarity.
Lifecycle governance and access review are converging into the same operational problem. The article makes clear that joiner-mover-leaver activity, entitlements and revocation evidence all depend on the same underlying data flow. When apps are disconnected, the organisation cannot keep lifecycle state and certification state aligned. The consequence is that recertification becomes stale as soon as it starts, which is why lifecycle and review governance must be designed together.
Verifiable review state is the new assurance baseline for regulated identity programmes. Cerby’s analysis reinforces that regulators, insurers and auditors increasingly care whether access control can be demonstrated across the real application estate, not just the integrated subset. That shifts the market away from checkbox review activity toward provable coverage and continuous evidence. The practitioner conclusion is simple: if a system cannot be reviewed and evidenced, it is not under full governance.
From our research library:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
- Read next: Access Reviews and Certification Guide
What this signals
Control reach is the new access-review maturity metric: programmes fail when disconnected applications sit outside the automation boundary, because certification can only be as complete as the data feed behind it. That is why UAR design should be judged by the share of the application estate it can actually evidence, not by the number of reviews completed.
When entitlement state changes faster than manual review cycles, certification becomes a lagging indicator rather than a control. Organisations should expect to align review processes with lifecycle events, or they will keep producing evidence for access that is already stale by the time it is signed off.
For practitioners
- Inventory disconnected applications first Classify which systems cannot currently support automated entitlement collection, review, or revocation, then assign explicit ownership for each gap.
- Separate evidence capture from reviewer effort Define a standard artefact set for each access review, including entitlement snapshot, reviewer decision, remediation action, and timestamped completion evidence.
- Map manual review exceptions to compliance obligations Identify where manual workflows still carry SOX, HIPAA, GxP, or insurer scrutiny, then document compensating controls and residual risk.
- Tie lifecycle events to review scope Feed joiner, mover, leaver, and third-party offboarding events into review scoping so certification reflects current access state rather than stale exports.
Key takeaways
- Disconnected applications are not just an integration nuisance, they are a governance gap that weakens the reliability of user access reviews.
- The article shows that manual exports, spreadsheets and email approvals make evidence harder to assemble and easier to challenge.
- Organisations need review coverage, lifecycle linkage and proof-quality evidence across the full application estate if they want access governance to stand up to audit or insurer scrutiny.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-03 — Vulnerable Third-Party NHI | Disconnected and third-party-connected apps widen the governed identity surface in this article. |
| NHI-05 — Overprivileged NHI | The article centres on proving that access is limited narrowly enough for review and audit. | |
| Recommendation — Map disconnected applications and third-party access paths to NHI-03 and close the review gap they create. Audit access scope against NHI-05 and remove entitlements that cannot be justified in review evidence. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | User access reviews are a direct expression of entitlement governance and authorization control. |
| Recommendation — Use PR.AA-05 to verify that entitlements are reviewed, evidenced and remediated across the full application estate. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article’s core control question is whether access stays narrowly assigned and provable. |
| Recommendation — Apply AC-6 to keep access restricted and remove privileges that cannot be evidenced in reviews. | ||
| CIS Controls v8 | CIS-5 — Account Management | The review challenge is fundamentally about governing account and entitlement state across many apps. |
| Recommendation — Use CIS-5 to keep account inventories accurate and to validate access review completion across systems. | ||
Key terms
- User Access Review: A user access review is a periodic check that confirms each account still needs the access it has. In identity programs, the control is used to reduce excess privilege, support compliance, and catch access that has outlived its business need.
- Disconnected Application: An application that is not integrated with the organisation's central identity and access stack. Access is often managed through shared passwords, manual approval, or local admins, which makes revocation, evidence, and ownership harder to enforce consistently across the application lifecycle.
- Evidence Quality: Evidence quality is the degree to which identity artifacts such as photos, biometrics, and document data are usable and trustworthy. A record can be complete but still fail if the evidence is blurred, mismatched, or otherwise unusable for verification or investigation.
- Lifecycle Management: Lifecycle management is the process of creating, reviewing, rotating, and retiring identities and their secrets in a controlled way. For NHIs, it is essential because stale credentials, orphaned accounts, and incomplete offboarding are common paths to long-lived exposure and unauthorised access.
Deepen your knowledge
NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org