TL;DR: Many identity governance and administration programs are stalling because integration friction, manual workflows, and rapidly expanding identity estates outpace static tools, according to Palo Alto Networks, while Enterprise Strategy Group data shows 77% of organisations call IGA a core cybersecurity best practice and 67% revoke up to 30% of permissions in reviews. The governance problem is now operational, not theoretical, because scale breaks manual control models.
At a glance
What this is: This blog argues that traditional IGA programs are stalling because manual governance cannot keep up with hybrid identity sprawl, fragmented integrations, and continuous access review demands.
Why it matters: IAM teams, IGA leads, and PAM programmes need to treat identity governance as a scaling and automation problem across human and machine estates, not a one-time tool rollout.
By the numbers:
- For over 77% of organisations, IGA is a core cybersecurity best practice.
- 67% of organisations revoke up to 30% of user permissions during access reviews.
Context
Identity governance and administration is supposed to answer a simple question: who has access to what, and should they still have it. In practice, that answer becomes unreliable when application sprawl, hybrid integration gaps, and growing volumes of human and machine identities turn governance into a manual exercise.
Palo Alto Networks frames the issue as operational strain rather than a lack of intent. Static workflows, spreadsheet-based reviews, and on-premises assumptions cannot keep pace with continuous change across modern identity estates, which is why many programs stall after initial rollout.
For IAM, IGA, and PAM teams, the underlying problem is not whether governance matters. It is whether the programme can continuously enforce it across the full estate without turning access decisions into a bottleneck.
Key questions
Q: Why do IGA programs stall when identity estates keep growing?
A: IGA programs stall when connector coverage, review workflows, and governance ownership cannot keep up with the number and variety of identities being added. The issue is not only tooling. It is the mismatch between static governance processes and an estate that changes continuously across cloud apps, legacy systems, and machine identities.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use. If access reviews are always behind, permissions stay stale, and IT has to chase owners for answers, governance is operating more as paperwork than control.
Q: How should teams modernise IGA without turning it into a multi-year project?
A: Start with the applications and identity types that create the greatest governance risk, then automate the repeatable workflows around provisioning, review, and revocation. The goal is not to cover everything at once. It is to move the highest-value controls out of manual handling first.
Q: What is the difference between periodic access reviews and continuous identity governance?
A: Periodic access reviews check entitlements at a point in time, while continuous identity governance tracks access as it changes. The first approach is useful for audit snapshots but weak against fast-moving cloud and automation environments. The second reduces stale access by combining discovery, policy enforcement, anomaly detection, and timely revocation.
Technical breakdown
Why legacy IGA integrations fail in hybrid estates
Traditional IGA tools depend on reliable connectors, complete application inventory, and stable data models. That works poorly when the estate mixes cloud apps, SaaS platforms, legacy on-premises systems, and internal applications without public APIs. The result is not just slower onboarding of applications. It is governance blind spots, broken certification workflows, and inconsistent entitlement data. When the integration layer is weak, the governance layer becomes partial by design, because reviews can only cover what the tool can see and reconcile.
Practical implication: map which in-scope applications are actually governable before you assume review coverage is complete.
How manual access reviews create governance drag
Manual IGA commonly shifts core tasks into spreadsheets, email threads, and IT tickets. That model may appear workable at low volume, but it does not scale when identities and permissions multiply continuously. Every manual handoff adds delay, and every delay increases the gap between access granted and access reviewed. In governance terms, the control no longer runs continuously, it runs episodically. That is enough to make certification a lagging indicator rather than a protective one.
Practical implication: measure review cycle time and backlog size as control health signals, not just completion rates.
What continuous governance changes for identity estates
A modern IGA approach shifts from project-style deployment to continuous operation. Instead of treating governance as a periodic audit event, it uses policy-driven automation to provision, review, and revoke access as part of the ongoing identity lifecycle. That matters because identity estates now include employees, contractors, interns, workloads, and other machine identities, all changing at different speeds. Continuous governance is therefore less about generating more reports and more about reducing the time between access change and access correction.
Practical implication: design governance around lifecycle events and policy enforcement, not around quarterly review cycles.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
IGA is no longer failing as a concept, it is failing as an operating model. The article shows that most organisations still want governance, but their control design depends on manual effort and incomplete integration. That combination does not hold in estates where identities, apps, and permissions change continuously. The practical conclusion is that governance must be treated as a runtime capability, not an annual programme milestone.
Integration friction is the hidden governance debt in modern identity estates. When a tool cannot connect cleanly to cloud, SaaS, legacy, and no-API applications, coverage becomes uneven even if the programme is formally in place. This is not simply an implementation issue. It means the governance boundary is defined by connector success, not by organisational risk. Practitioners should treat incomplete integration as a structural limitation, not a temporary deployment inconvenience.
Manual review cycles are too slow to govern access creep at enterprise scale. The article’s own figures show how much permission revocation still occurs during reviews, which implies that overprovisioning is already embedded in the estate. That is a governance model built to detect drift after the fact. The field needs to reframe access review from a periodic clean-up exercise into a lifecycle control anchored at provisioning and change events.
Hybrid identity estates require governance across human and machine identities, not separate islands of control. The article explicitly notes the growth of machine identities alongside employees and contractors. That matters because the volume problem is no longer just workforce identity. Service accounts, workloads, and application credentials expand the review burden and make visibility a prerequisite for control effectiveness. The implication is a single governance model with different enforcement patterns by actor type, not duplicated process silos.
Modern IGA should be judged by coverage, latency, and revocation discipline, not by deployment effort. A programme that takes months to connect, cannot see key applications, and still relies on ticketing for routine decisions is not modern in operational terms. The decisive question is whether access changes are governed quickly enough to matter. That is the standard practitioners should apply when evaluating their own programmes.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Service Account Security Guide
What this signals
Identity governance now behaves like a coverage problem, not a paperwork problem. When estates keep expanding and integrations remain uneven, the programme only governs what it can actually see. The practical effect is that coverage becomes the first control question, not the last audit question.
Service accounts expose the gap most cleanly. Only 5.7% of organisations have full visibility into their service accounts, which means many governance programmes still cannot see a large part of the non-human estate. That visibility gap turns review discipline into guesswork and makes lifecycle governance far harder to execute consistently.
Modern IGA has to compress the time between entitlement change and entitlement correction. If review and provisioning remain manual, the programme keeps producing lag instead of control. Teams should treat automation, application coverage, and identity-type segmentation as operational prerequisites for governance that scales.
For practitioners
- Define the governable identity surface Inventory which applications, identity types, and entitlement sources are actually in scope for access reviews, provisioning, and recertification. Mark systems that cannot support reliable governance so the programme reflects real coverage instead of assumed coverage.
- Replace spreadsheet-driven review workflows Move high-volume access reviews and approvals into policy-driven workflows that reduce ticket queues, email chasing, and manual reconciliation. Use automation to shorten the gap between entitlement change and certification.
- Track governance latency as a control metric Measure how long it takes to connect an application, complete a review cycle, and revoke excess access after discovery. Treat long cycle time as a security signal because delayed governance preserves unnecessary permissions.
- Separate workforce and machine identity governance demands Map which identities are human users, which are service accounts or workloads, and which require different review and revocation patterns. Do not force all identity types through the same manual process design.
Key takeaways
- Traditional IGA programs stall when manual processes and incomplete integrations cannot keep pace with expanding identity estates.
- The article cites strong demand for governance, but also shows that access reviews still remove significant amounts of excess permission, which points to persistent drift.
- Practitioners should measure IGA by coverage, latency, and revocation discipline, then shift routine governance into automated lifecycle controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about entitlement governance and review coverage. |
| Recommendation — Apply PR.AA-05 to keep entitlement governance continuous across hybrid identity estates. | ||
| CIS Controls v8 | CIS-5 — Account Management | Manual provisioning and review bottlenecks are account management failures at scale. |
| Recommendation — Use CIS-5 to tighten account lifecycle governance and reduce manual access handling. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Access creep and delayed review directly undermine least-privilege enforcement. |
| Recommendation — Enforce AC-6 so excess permissions are removed as soon as they are no longer needed. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | Growing identity estates include machine identities whose lifecycle governance is often incomplete. |
| NHI-05 — Overprivileged NHI | The article's access creep problem maps to overprivilege in non-human estates as well as workforce access. | |
| Recommendation — Apply NHI-01 to ensure non-human identities are governed through full lifecycle offboarding. Use NHI-05 to find and remove excessive permissions from service and workload identities. | ||
Key terms
- Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
- Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
- Identity estate: The full population of identities an organisation must govern, including humans, devices, machines and other credentialed actors. The term matters because security programmes often optimise one identity class while leaving another outside the same policy, lifecycle and assurance model.
- Hybrid Governance: Hybrid governance is the application of consistent identity controls across cloud, SaaS, and on-premises environments. It matters because the same access rules fail if the governance tool cannot see or act on all environments with equal reliability.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on May 25, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org