Topic starter
28/05/2026 11:39 am
TL;DR: Manual user access reviews can consume hundreds of hours per cycle and still leave access creep, terminated accounts, and machine identities unchallenged, according to Delinea's analysis. Automation turns access certification from a spreadsheet exercise into a control that can keep pace with hybrid environments and NHI sprawl.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Save time and reduce risk by automating User Access Reviews”.
By the numbers:
- For example, Norwegian Cruise Line Holdings had 450 unique reviewers, 14,000 users, and approximately 300,000 lines of access across its in-scope SOX applications.
- Across customer interviews, Fastpath reduced time spent on access reviews by up to 80%, with some customers reporting savings of 120 hours per quarter.
Key questions
Q: What breaks when user access reviews are still manual in hybrid environments?
A: Manual reviews break when reviewers cannot reliably see all active entitlements across cloud, on-prem, and third-party systems.
Q: Why do automated user access reviews matter for least privilege?
A: Least privilege decays over time as roles change and temporary access is never fully cleaned up.
Q: What are the signs that an access certification campaign is failing in practice?
A: A campaign is failing when reviewers are working from stale data, the review window is too vague, or the process becomes so frequent that people stop giving it proper attention.
Practitioner guidance
- Inventory in-scope business applications Document ERP, SaaS, finance, HR, procurement, and any other systems that hold sensitive data or support critical processes.
- Set risk-based review cadence Rank applications by sensitivity, business criticality, regulatory pressure, fraud exposure, and operational impact, then review the highest-risk systems more frequently than low-risk systems.
- Automate reviewer assignment and reminders Use attribute-based ownership mapping such as department, manager, location, job title, or role ownership so review tasks route to the right owner and overdue items are visible in one dashboard.
Bottom line: Manual access reviews no longer scale cleanly across hybrid estates because the review, routing, and remediation workload has outgrown the spreadsheet model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/05/2026 11:44 am
Access certification is now a lifecycle control, not an audit ritual: The article shows that periodic review still matters, but the old manual model no longer fits the volume and variety of enterprise identities. When human users, machine identities, APIs, and AI agents all sit inside the same access estate, the control has to govern continuity, not just compliance evidence. The practitioner conclusion is that review programmes must be designed as ongoing entitlement governance.
A few things that frame the scale:
- Over 70% of organisations lack automated access risk analysis, user access reviews and provisioning and deprovisioning, according to Pathlock's 2025 Digital Transformation and Access Risk Report.
A question worth separating out:
Q: How should organisations implement ISO 27001 access reviews across human and machine identities?
A: Treat the review as a control check over current entitlements, not a workflow approval. Pull together human users, service accounts, tokens, and application access into one evidence set, then require an owner to confirm business need, privilege scope, and removal date for each entry.
👉 Read our full editorial: Automating user access reviews for least-privilege at enterprise scale