Topic starter
09/07/2026 3:25 pm
TL;DR: Traditional access certification processes were built for smaller, mostly human identity estates, but modern programmes now span SaaS, cloud, contractors, service accounts, NHIs, and AI agents, making manual review cycles too slow and context-poor according to Linx Security. Continuous identity governance and automation shift access reviews from periodic compliance to ongoing risk reduction, especially as privilege accumulates between campaigns.
Editorial analysis by NHI Mgmt Group, based on content published by Linx Security: “Automate User Access Reviews: Your Guide to Modern Access Certifications and Continuous Identity Governance”.
Key questions
Q: What breaks when access certifications are still run with spreadsheets and manual exports?
A: Spreadsheet-driven certifications break when identity data is fragmented across SaaS, cloud, Active Directory, and contractor systems.
Q: Why do modern access reviews create less value when they are only run quarterly?
A: Quarterly reviews create less value because identity environments change continuously between campaigns.
Q: How should security teams improve access certification without creating reviewer fatigue?
A: Security teams should reduce the number of low-value decisions each reviewer sees by grouping stable access, prioritising unusual or privileged entitlements, and pre-classifying items that rarely change.
Practitioner guidance
- Build a unified entitlement inventory Connect SaaS, cloud, Active Directory, HR, and contractor sources into one identity view before starting a certification cycle.
- Enrich reviews with usage and risk context Surface last use, peer comparisons, role justification, and privilege signals next to each access decision so reviewers are not guessing.
- Automate remediation from review outcomes Trigger deprovisioning directly from the certification decision rather than relying on manual tickets to remove access later.
Bottom line: Access certification breaks down when identity data is fragmented across too many systems for reviewers to assess consistently.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:44 pm
Identity sprawl has turned access certification from a review problem into a data problem. When access lives across SaaS, cloud, contractor workflows, service accounts, NHIs, and AI agents, the control fails first on visibility, not judgment. Review quality collapses when teams cannot reliably assemble the entitlement picture before certification begins, so the programme becomes reactive rather than governed.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.
👉 Read our full editorial: Modern access certifications are failing under identity sprawl