Notifications
Clear all
Topic starter
05/07/2026 6:43 pm
TL;DR: Access reviews often become unsustainable after a few cycles, with review backlogs, visibility gaps, and remediation delays causing risk to accumulate faster than governance teams can clear it, according to Zluri. The real issue is not running reviews, but turning them into a repeatable control that actually closes violations.
NHIMG editorial — based on content published by Zluri: Security & Compliance How to Carry Out a User Access Review (Advanced Guide)
By the numbers:
- The first review took 3 weeks, involved 23 people, and revealed 87 apps that the team did not know existed.
Questions worth separating out
Q: How should teams make user access reviews sustainable at scale?
A: Teams should combine continuous discovery, risk-based scoping, and automated remediation so access reviews become a lifecycle process rather than a quarterly project.
Q: Why do access reviews often fail to reduce risk even when they are completed on time?
A: They fail when the review finishes but remediation does not.
Q: What breaks when access review scope is based only on the identity provider?
A: The programme certifies a partial inventory and misses apps discovered through finance, browser, endpoint, or API data.
Practitioner guidance
- Replace static review exports with continuous discovery Connect identity, SaaS, finance, and endpoint sources so app scope is refreshed before each certification cycle, not after it has already drifted.
- Enforce remediation SLAs with proof of completion Route denials into automated revocation where possible, require evidence for manual removals, and track overdue items until access is actually gone.
- Scope reviews by risk tier instead of blanket coverage Reserve quarterly certification for high-risk systems, push lower-risk applications to longer cadences, and document the scoping rationale for auditability.
What's in the full article
Zluri's full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step implementation of the seven-phase review model across discovery, scoping, intelligence, and remediation.
- Detailed examples of multi-source reconciliation rules for identity, finance, browser, endpoint, and API data.
- Operational guidance for setting SLAs, escalation paths, and proof capture for manual and automated revocations.
- Scaling patterns for group-based reviews, reviewer routing, and exception handling in larger environments.
👉 Read Zluri's advanced guide to scaling user access reviews →
User access reviews at scale: what breaks when teams scale up?
Explore further
05/07/2026 6:59 pm
Manual access review is not a governance control at scale unless discovery and remediation are continuous. The article shows that quarterly certification can complete on time while scope remains incomplete and violations remain open. That is a control design problem, not an execution problem. Practitioners should treat access review as a lifecycle process that must see, decide, and remove in the same operating model.
A few things that frame the scale:
- The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, according to The 2024 ESG Report: Managing Non-Human Identities.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.
A question worth separating out:
Q: Who should own access decisions when reviews move from users to groups?
A: Group owners should own the decision, because they understand what the group grants and whether membership still matches the role. Security and IAM teams should define the rules, but the owner must validate exceptions, stale membership, and privileged access that falls outside normal group logic.
👉 Read our full editorial: User access reviews at scale expose the governance breakpoints
