Why access reviews miss modern identity risk across apps

At a glance

What this is: Saviynt says traditional access reviews miss modern identity risk because cross-application entitlements, NHIs, and AI agents change faster than periodic certifications can see.

Why it matters: This matters because IAM and IGA teams need governance that understands how access combines across systems, not just whether a single app’s entitlement list looks clean at review time.

Context

Access reviews were built for a world where identity risk was mostly human, mostly slow-moving, and mostly contained inside a single application. That model breaks when access is distributed across SaaS, cloud, hybrid systems, service accounts, and AI-driven workflows that can appear and change between review cycles.

The core governance gap is not the existence of reviews. It is the assumption that a point-in-time certification can explain cross-application exposure, dormant privilege, and standing access across a modern environment. For IAM and IGA teams, the problem is visibility before certification, not the certification event itself.

Key questions

Q: Why do periodic access reviews fail in modern identity environments?

A: Periodic reviews fail because access changes continuously while review cycles do not. By the time a spreadsheet or annual certification runs, stale entitlements, orphaned accounts, and privilege creep may already be embedded in production. Continuous governance is needed so access can be corrected as soon as the business context changes.

Q: Should organisations prioritise continuous monitoring over periodic certification?

A: They should treat certification as necessary but insufficient, then prioritise continuous monitoring for controls that can fail quickly, especially access, identity, and third-party dependencies. Periodic certification still matters for governance, but only live validation shows whether the control is effective when the environment changes after the audit window closes.

Q: What are the signs that an access review process is failing in practice?

A: A failing access review process usually shows up as long approval cycles, overloaded reviewers, repeated manual preparation, and heavy engineering effort just to launch each campaign. If reviewers need multiple sources to understand a user’s access, or facilitators spend weeks coordinating certifications, the process is not scaling. Those are clear signs the workflow needs better automation and better access context.

Q: How should security teams govern AI agents and NHIs differently?

A: Security teams should govern NHIs as predictable machine identities and AI agents as runtime actors that can alter behaviour after authentication. That means static entitlements, inventory, and rotation remain central for NHIs, while agents need behaviour monitoring, delegation tracing, and ownership controls that account for tool choice and execution timing.

Technical breakdown

Why per-application access reviews miss systemic risk

Per-application review models assume entitlement risk is local to one system. In modern environments, access relationships are distributed across business apps, cloud platforms, and SaaS services, so a safe entitlement in one place can become risky only when combined elsewhere. This is why segregation of duties issues, toxic entitlement combinations, and sensitive business actions often stay hidden until someone correlates context across platforms. The technical failure is not the review workflow itself, but the data boundary it uses to define risk. Practical implication: reviewers need cross-application correlation before certification, not after.

Practical implication: Map entitlements across connected systems before review cycles so cross-app conflicts are visible at decision time.

How NHIs and AI agents break periodic certification assumptions

NHIs and AI agents change the identity lifecycle model because they can be deployed, granted access, and retired in hours or days rather than months. That compresses the usefulness window of a quarterly review to almost nothing for fast-moving machine access. It also introduces identity types that do not fit human-centric workflows, so ownership, usage context, and business meaning are often missing when reviewers see the entitlement list. The control failure is that review cadence lags identity velocity. Practical implication: govern machine and agent access with continuous visibility, usage context, and lifecycle ownership.

Practical implication: Track machine and agent access continuously, because periodic human-style certification cannot keep pace with short-lived privilege changes.

Why entitlement lists are not enough to judge business risk

Seeing an entitlement is not the same as understanding what it enables. Traditional reviews often stop at role names and permission labels, which obscures whether an access path can move money, expose customer data, or trigger a sensitive business process. Without usage data and business criticality, reviewers certify objects they do not really understand, and audit findings repeat because the hidden risk never became visible in the first place. The mechanism problem is context loss. Practical implication: enrich entitlements with usage telemetry and business impact so reviewers certify actual exposure, not just names on a list.

Practical implication: Add usage and business-context data to reviews so certifiers can evaluate what access actually enables.

Threat narrative

Attacker objective: Exploit fragmented identity governance to preserve hidden access paths that can be combined into business-impacting privilege.

1. Entry occurs when new access is granted across business applications, SaaS services, or cloud environments without a unified view of related entitlements.
2. Credential or privilege exposure grows as standing access, dormant accounts, and machine identities accumulate faster than periodic reviews can inspect them.
3. Impact follows when toxic combinations, SoD conflicts, or sensitive entitlements remain invisible between review cycles and are treated as accepted risk.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Ledger Connect Kit npm compromise 2023: Attackers phished a former Ledger employee with unrevoked npm access and published a wallet-draining Connect Kit, stealing about $600k on 14 Dec 2023.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Access reviews are now a visibility problem before they are a certification problem. The modern stack spreads identity risk across SaaS, cloud, hybrid systems, and machine actors, so a clean result in one application can coexist with material exposure elsewhere. That means the governance failure sits upstream of review execution: if the programme cannot correlate access across environments, the certification result is structurally incomplete.

Cross-application risk is the governance gap that legacy IGA was never built to see. Single-system entitlements, toxic combinations, and SoD conflicts only become meaningful when correlated across applications and workflows. The implication is that identity governance has shifted from checking discrete permissions to understanding how access composes into business risk.

Continuous identity context is the missing control plane for modern certification. Standing privilege, dormant access, and machine identities all require usage data and business criticality to make review decisions meaningful. Without that context, organisations are not reducing risk, they are merely documenting that a periodic process occurred.

Ephemeral access changes the meaning of accountability across human and non-human identities. Human-centric review cadences assume privilege persists long enough to be inspected, while NHIs and AI-driven identities can be created, used, and retired before the next cycle begins. The practical conclusion is that governance must move from retrospective certification to continuous decision support.

Access review programmes should be treated as evidence-generating controls, not primary risk controls. Their value lies in demonstrating governance discipline, but the actual reduction of cross-app exposure comes from correlated visibility, ownership, and usage context. Practitioners should therefore judge review completeness by how much of the real risk landscape it can actually surface.

From our research library:

• Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
• Read next: Access Reviews and Certification Guide

What this signals

Identity governance has moved from app-level checking to environment-level correlation. The practical shift for IAM and IGA teams is that access decisions now need to reflect how permissions combine across systems, not just whether each application has been certified on schedule. If the programme cannot connect identity, usage, and business context, it will keep producing clean reviews over unresolved exposure.

Access review maturity now depends on continuous context, not review volume. Quarterly cadence still has value for audit evidence, but it is no longer a sufficient security control for environments where NHIs and AI-driven identities change quickly. Teams should expect certification workflows to become downstream evidence of a broader governance model, not the place where risk is actually discovered.

For practitioners

• Build cross-application entitlement correlation Connect identity data across SaaS, cloud, and core business applications so reviewers can see SoD conflicts and toxic combinations before certification.
• Separate machine access from human review workflows Create governance paths for service accounts, API integrations, and AI agents that include ownership, usage context, and lifecycle tracking.
• Enrich access reviews with usage data Require reviewers to see whether access is active, dormant, or tied to sensitive business actions rather than relying on role names alone.
• Shift certification from periodic to risk-based Use event-driven or continuous signals for privileged, cross-system, and fast-changing identities instead of relying on quarterly app-by-app cycles.

Key takeaways

• Traditional access reviews miss modern risk because entitlement visibility is fragmented across applications, clouds, and machine identities.
• The problem shows up as repeated audit findings, standing privilege, dormant access, and toxic combinations that sit outside the review boundary.
• Practitioners need continuous cross-application context, usage data, and lifecycle ownership if certification is going to reflect real risk.

Key terms

• Cross-Application Risk: Risk that emerges only when access and workflow data from multiple systems are evaluated together. A user or service account may appear compliant in one application while still creating a toxic combination or fraud path when combined with privileges in another system.
• Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Access Review Cadence: The schedule at which an organisation rechecks whether access is still justified. In GDPR programmes, cadence is not administrative detail, because access can become non-compliant as soon as business need changes. For NHI and delegated access, cadence must be tight enough to catch drift before it becomes exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.