Topic starter
25/06/2026 12:05 am
TL;DR: Access certification is losing control value when entitlement sprawl grows faster than review and removal can keep up, according to SecurEnds. Identity governance needs closed-loop revocation and cleaner evidence trails to keep attestations tied to real access decisions.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “Access Certification: A Complete Guide to Compliance and Risk Reduction”.
Key questions
Q: What should IAM teams prioritise first in access certification design?
A: Start by identifying which access is birthright, which is routine, and which is genuinely sensitive.
Q: How do organisations know if access certification is actually working?
A: Look for shrinking numbers of standing privileges, faster revocation after review decisions, and fewer orphaned or overprivileged accounts over time.
A: Without certification and lifecycle controls, access becomes harder to validate, revoke, and audit as users move between roles and systems.
Practitioner guidance
- Define a governed entitlement inventory Map identities, roles, applications, and owners into one reviewable catalogue before starting certification cycles.
- Shorten certification cycles for high-risk access Review privileged and sensitive access more frequently than standard user access so stale permissions do not linger between campaigns.
- Connect attestations to automatic revocation Ensure noncompliant access is removed through workflow rather than left pending after a reviewer rejects it.
Bottom line: Access certification is failing where entitlement sprawl outruns the organisation's ability to review and remove access.
Glossary terms: Access Certification, Access Sprawl, Access Recertification, Entitlement normalisation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 8:55 am
Access certification has become the control gap, not the compliance checkbox. Modern enterprises accumulate entitlements across cloud and hybrid estates faster than managers can rationally review them. That turns certification into a lagging control unless entitlement data, ownership, and revocation are unified. The practitioner conclusion is simple: if the review system cannot change access state quickly, it is not governing access sprawl.
A few things that frame the scale:
- 92% of cloud identities are over-permissioned and 62% are dormant.
A question worth separating out:
Q: What is the difference between manual access certification and automated user access reviews?
A: Manual access certification depends on people collecting reports, checking permissions, and chasing approvals by hand, which makes the process slower and more error prone. Automated user access reviews pull access data into one workflow, compare it to roles, flag exceptions, and produce audit evidence consistently. The difference is not just speed. Automation improves repeatability, traceability, and control quality.
👉 Read our full editorial: Access certification is the control gap behind access sprawl