Topic starter
04/06/2026 6:50 pm
TL;DR: SaaS environments are breaking traditional user access review models because access now spans distributed applications, service accounts, APIs, and rapidly changing permissions, according to SecurEnds. Access review programmes that assume stable roles and static systems can no longer keep pace with privilege sprawl, shadow IT, and orphaned access.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “User Access Reviews for Cloud Applications: What Changes in SaaS?”.
Key questions
Q: How should teams handle access reviews in fast-changing SaaS environments?
A: Teams should move from periodic, app-by-app certification to centralized review of the full entitlement graph.
Q: Why do cloud access reviews miss risky permissions so often?
A: They miss risk because permissions are distributed across integrations, inherited roles, delegated admin rights and non-human identities.
Q: What are the signs that SaaS app permission governance is failing?
A: Common warning signs include users approving apps outside policy, security teams lacking visibility into permission changes, and integrations with broad access that no one can explain.
Practitioner guidance
- Centralize entitlement visibility Aggregate access data from SaaS applications, cloud infrastructure, identity providers and HR sources so reviewers can see effective access across the full ecosystem.
- Classify non-human access paths Add service accounts, API access, connected apps and automation identities to the certification scope so machine access is reviewed with the same governance rigor as user accounts.
- Prioritize privileged and high-risk systems Sequence reviews for administrator roles, financial systems, production infrastructure and customer data platforms before lower-risk collaboration tools.
Bottom line: SaaS access reviews fail when they are built around stable roles and static systems, because modern cloud estates distribute entitlement decisions across many platforms and identities.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 7:03 pm
Cloud access certification has become an entitlement graph problem, not a review workflow problem. SaaS estates do not fail because reviewers are careless, but because the access object is now distributed across applications, integrations and inherited permissions. Traditional certification assumes a fixed list of users and roles. In practice, the effective entitlement is assembled from many systems, so the programme has to govern relationships, not just records. The practitioner implication is that access review design should start with entitlement aggregation and ownership mapping.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
A: Yes. Service accounts and connected applications should be certified as non-human identities with explicit ownership, business purpose and renewal criteria. If the programme reviews only employees, the highest-risk access paths can remain invisible. Governance should require that machine access is owned, justified and removed when no longer needed.
👉 Read our full editorial: Cloud user access reviews are failing in SaaS ecosystems