Topic starter
17/08/2026 4:42 pm
TL;DR: Certification campaigns have driven 5+ million revocations across more than 80,000 reviews, while customers still face 500,000-item campaigns and a 25% annual increase in integrations, according to Saviynt. The governance issue is no longer whether certification exists, but whether review quality can survive scale, missing context, and manual fatigue.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Simplifying Certifications with Intelligence”.
By the numbers:
- Organisations are experiencing an average 25% annual increase in the number of integrations, according to Saviynt.
Key questions
Q: What breaks when access review campaigns become too large for certifiers to judge carefully?
A: Certification breaks when the review queue becomes too large, too ambiguous, or too poorly described for humans to make informed decisions.
Q: Why do missing owners and weak entitlement descriptions increase access review risk?
A: They remove the context a certifier needs to decide whether access is still justified.
Q: How do organisations know if access certification is actually working?
A: Look for shrinking numbers of standing privileges, faster revocation after review decisions, and fewer orphaned or overprivileged accounts over time.
Practitioner guidance
- Tighten certification scope before review starts Break large campaigns into reviewer-sized subsets and remove low-value noise before certifiers see the queue.
- Enrich entitlement metadata first Fix missing owners and poor entitlement descriptions before launching campaigns, because reviewers cannot make reliable decisions about entitlements they cannot understand.
- Prioritise by risk signals Rank certifications using peer access, SoD conflicts, prior certifications, and out-of-band access so reviewers focus first on low-confidence items.
Bottom line: Large certification campaigns only help if reviewers can still make sound decisions, and the article shows that scale is now testing that assumption.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
17/08/2026 4:47 pm
Certification quality, not certification volume, is now the control variable that matters. Once review campaigns reach hundreds of thousands of items, the central question is whether reviewers can still make informed decisions rather than merely complete tasks. That shifts the discipline from counting campaigns to measuring decision quality, because least privilege only holds when the review itself remains trustworthy.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
A: Decision support becomes necessary when review volume, integration sprawl, or missing context makes manual certification unreliable. The right use case is prioritisation and enrichment, not blind automation. Human reviewers should still own the decision, but the system should rank risk, surface evidence, and reduce fatigue.
👉 Read our full editorial: Intelligent certifications change how IGA teams handle access review