Topic starter
12/02/2026 3:39 pm
TL;DR: Access sprawl is now spreading across SaaS, microservices, and non-human identities, according to Lumos, while Microsoft reports that 90% of identities use less than 5% of the permissions they have been granted. That gap turns unused privilege into a standing attack surface, so least privilege has to be continuous governance, not periodic review.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “3 Proven Strategies to Rein In Access Sprawl (Before It Wreaks Havoc)”.
By the numbers:
- Microsoft reports that 90% of identities use less than 5% of the permissions they have been granted.
Key questions
Q: What breaks when access sprawl is not under control?
A: Access reviews lose meaning when permissions are scattered across SaaS, legacy systems, manual processes, and shadow IT.
Q: Why does excessive access create more risk in identity governance programs?
A: Excessive access expands the identity attack surface because unused permissions often remain active long after the original need has passed.
Q: How do security teams know whether least privilege is actually working?
A: Least privilege is working when identities have narrowly scoped permissions, unused credentials are removed or quarantined, and repeated access reviews consistently shrink entitlements.
Practitioner guidance
- Unify entitlement discovery across systems Inventory SaaS, legacy on-prem, and shadow IT access in one control view so reviews and removals are based on complete entitlement data.
- Prioritise high-risk access first Review admin permissions, separation-of-duties violations, unused access, and peer outliers before lower-impact entitlements.
- Set expiry on non-essential access Give access a natural end date so permissions do not remain available after the task, project, or role context has changed.
Bottom line: Access sprawl is a control failure because it leaves excessive and invisible permissions in place across human and non-human identities.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:42 pm
Access sprawl is an identity governance failure, not just an IT hygiene issue. When permissions become excessive, outdated, and invisible, the programme has lost track of who or what can do what. That is a governance breakdown across human and non-human identities, because the organisation can no longer prove necessity or ownership. The practitioner conclusion is simple: if access cannot be explained, it cannot be safely retained.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams govern non-human identities in AI-heavy environments?
A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use. The key difference is speed. AI-driven workflows can exploit exposed access quickly, so detection and revocation must be automated and tied to lifecycle controls.
👉 Read our full editorial: Access sprawl is colliding with non-human identity governance