Notifications
Clear all
Topic starter
25/06/2026 12:27 am
TL;DR: Manual access reviews, email approvals, and spreadsheet-based governance break down as user counts, apps, and compliance demands grow, leading to missed revocations, stale entitlements, and slower audits, according to SecurEnds. Automation shifts IGA from episodic cleanup to continuous control, and the real prize is not convenience but reduced control failure across lifecycle, compliance, and risk management.
NHIMG editorial — based on content published by SecurEnds: manual identity governance versus automated IGA
Questions worth separating out
Q: How should security teams automate identity governance without losing control?
A: Start by automating the highest-friction lifecycle events first: joiners, movers, leavers, and routine recertifications.
Q: Why do manual access reviews fail in growing enterprises?
A: Manual reviews fail because the review process cannot keep up with the rate of entitlement change.
Q: What breaks when identity governance depends on email approvals and tickets?
A: The break point is evidence quality and response speed.
Practitioner guidance
- Replace spreadsheet-led certification with event-driven review logic Tie access review triggers to joiner, mover, and leaver events so governance decisions happen when identity state changes, not only when a quarterly review opens.
- Automate revocation for leavers and inactive accounts Make deprovisioning a closed-loop process that removes entitlements when HR or source-of-truth systems mark a user inactive, and verify the removal path for edge cases.
- Log approvals and exceptions in machine-readable form Store certification outcomes, policy exceptions, and revocation evidence in a way auditors can query directly, rather than reconstructing it from screenshots and email threads.
What's in the full article
SecurEnds' full article covers the operational detail this post intentionally leaves for the source:
- A step-by-step ROI calculation model for automated IGA, including time savings, risk reduction, and payback period assumptions.
- Examples of how automated access reviews, provisioning, and deprovisioning behave across cloud and on-prem environments.
- The article's own product framing for dashboards, AI-based risk scoring, and pre-built integrations in a single governance workflow.
- More implementation context on how the vendor describes cleaner access data, faster audits, and reduced review effort.
👉 Read SecurEnds' analysis of manual versus automated identity governance →
Automated IGA: what manual reviews are missing in practice?
Explore further
25/06/2026 9:22 am
Manual identity governance is now a control latency problem, not a process preference. Spreadsheets and email approvals create a delay between identity change and governance action, and that delay grows as apps, users, and compliance obligations multiply. The longer the delay, the more likely organisations certify the wrong state or leave access open after it should have been removed. Practitioners should treat manual governance as an ageing-control risk, not an acceptable operating mode.
A few things that frame the scale:
- From our research: 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Our research also shows that 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, which is why lifecycle automation matters as much for service accounts as for human access.
A question worth separating out:
Q: Who should own automated IGA outcomes across HR, IT, and security?
A: Ownership should sit with the identity governance programme, not any single operational team. HR provides lifecycle source data, IT integrates systems, and security defines policy and risk thresholds, but the governance model needs one accountable owner who can validate outcomes across all three functions and close exceptions when automation fails.
👉 Read our full editorial: Manual identity governance no longer scales for enterprise IGA
