Topic starter
25/06/2026 5:21 pm
TL;DR: Annual or quarterly access certifications often arrive too late to spot risky entitlements, encourage rubber-stamping, and leave too many revocations undone, according to SailPoint. A proactive model that combines analytics, context, and automation shifts identity security from retrospective compliance to faster, more informed access decisions.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Rethinking the Identity Security Paradigm: Three Ways to Stay Ahead of Identity-related Threats”.
Key questions
Q: How should security teams reduce risk when access certifications keep missing stale entitlements?
A: They should move from periodic review to proactive access decisioning.
Q: Why do quarterly access reviews miss identity risk?
A: Quarterly reviews miss risk because entitlement abuse can happen and finish long before the next certification cycle.
Q: What do security teams get wrong about manager-led access certifications?
A: They assume managers can make accurate decisions from entitlement lists alone.
Practitioner guidance
- Replace campaign-only certification with continuous review Move from annual or quarterly access campaigns to a model that surfaces risky entitlements as they appear, so managers review current access rather than stale snapshots.
- Enrich review packets with business context Attach role, access history, entitlement, and user attribute context to each decision so approvers can distinguish expected exceptions from true anomalies.
- Automate routine remediation triggers Use workflow rules to notify managers, start mini certifications, or disable access when risk thresholds are crossed, instead of waiting for the next certification cycle.
Bottom line: Periodic certifications often preserve risk because they evaluate access after it has already changed or become stale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:58 pm
Access certification fatigue is a governance failure, not just a process inconvenience. When managers are asked to review too much access with too little context, they default to approval. The result is a control that exists on paper but does not reliably remove risk, which turns review into compliance theatre. The practical conclusion is that identity governance must optimise for decision quality, not campaign volume.
A question worth separating out:
Q: Should organisations automate revocation for privileged access?
A: Yes, especially for machine access and high-risk admin tasks. Manual revocation is too slow for ephemeral credentials and too error-prone for distributed environments. The rule should be simple: if access is issued dynamically, revocation must also be automated and tied to the same identity record.
👉 Read our full editorial: Identity security needs proactive access decisions, not annual reviews