Notifications
Clear all
Topic starter
25/06/2026 12:32 am
TL;DR: Manual identity access management leaves former employees with active access, delayed offboarding, and inconsistent reviews that create audit, compliance, and breach exposure across human and non-human identities, according to SafePaaS. The real issue is not speed alone but the governance debt that accumulates when lifecycle control depends on spreadsheets, tickets, and fragmented approvals.
NHIMG editorial — based on content published by SafePaaS: The Cost of Manual Identity Access Management
By the numbers:
- 50% of businesses report that former employees retain access long after departure.
Questions worth separating out
Q: What breaks when identity access management depends on spreadsheets and tickets?
A: Manual identity access management breaks when approvals, removals, and reviews are handled in disconnected tools that do not share lifecycle state.
Q: Why do former employees so often retain access after they leave?
A: Former employees retain access when offboarding depends on manual handoffs across HR, IT, and application teams instead of an enforced deprovisioning flow.
Q: How do teams know if access reviews are actually working?
A: Access reviews are working only if the programme can show that decisions were followed by real entitlement changes in every connected system.
Practitioner guidance
- Map every access removal dependency Document where offboarding, role change, and access review events can fail to reach downstream applications, SaaS platforms, and credential stores, then close each gap with an enforced lifecycle trigger.
- Replace spreadsheet-driven cleanup with authoritative lifecycle state Use a single source of truth for joiner, mover, and leaver events so entitlement changes are enforced consistently instead of being reconciled manually after the fact.
- Prove removal, not just approval Require evidence that access was actually removed from every connected system before the ticket closes, especially for leavers, contractors, and elevated accounts.
What's in the full article
SafePaaS's full analysis covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of policy-based onboarding, transfer, and offboarding workflows across connected systems
- Guidance on how to use PBAC to enforce access decisions with role, department, and context-aware rules
- Operational detail on integrating HRIS, ITSM, SaaS, ERP, and legacy directories into one lifecycle process
- What-if simulation examples for planning restructures, M&A activity, and large-scale role changes
👉 Read SafePaaS's analysis of manual identity access management risk →
Manual identity access management: what governance teams are missing?
Explore further
25/06/2026 9:27 am
Manual identity access management is not a process preference, it is a control failure mode. When access changes rely on human memory, spreadsheet reconciliation, and ticket handoffs, governance becomes probabilistic rather than enforced. The result is policy drift, slow removal, and evidence that cannot be trusted at audit time. Practitioners should treat manual access administration as a measurable exposure, not a harmless operational style.
A few things that frame the scale:
- 91% of former employee tokens remain active after offboarding, leaving organisations vulnerable to potential security breaches, according to The 2025 State of NHIs and Secrets in Cybersecurity.
- 62% of all secrets are duplicated and stored in multiple locations, causing unnecessary redundancy and increasing the risk of accidental exposure.
A question worth separating out:
Q: Who is accountable when orphaned access causes an audit or breach issue?
A: Accountability usually sits with identity governance, application owners, and the business process that failed to synchronise the change. Regulators and auditors do not accept fragmentation as an excuse because control ownership should be clear before the incident occurs. Organisations need explicit lifecycle ownership for joiner, mover, and leaver events across both human and non-human identities.
👉 Read our full editorial: Manual identity access management is creating hidden breach risk
