Topic starter
02/01/2026 11:30 am
TL;DR: Access sprawl is stretching identity governance across AD, SaaS, and hybrid systems, leaving manual reviews and siloed processes unable to keep stale entitlements in check, according to RSA Security. Governance now has to keep access data, remediation, and audit evidence aligned as the estate expands.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Modern Identity Governance for the Cloud-First Enterprise”.
Key questions
Q: Why do manual access reviews fail in cloud-heavy environments?
A: Manual reviews fail because permissions spread across too many systems and change too quickly for periodic certification to stay accurate.
Q: How do you know if identity governance is keeping pace with identity sprawl?
A: Look for evidence that access reviews, remediation workflows, and integrations still function across the full estate without manual stitching.
Q: How should security teams implement user access controls across cloud and on-prem systems?
A: Start by defining the access decision you want to make, then map that decision to the right policy shape.
Practitioner guidance
- Normalize entitlement data across systems Build a single view of access across AD, cloud directory services, SaaS apps, and core business platforms so review decisions are based on comparable data.
- Automate repetitive certification decisions Use policy-driven approvals and AI-assisted reviewer suggestions for low-risk, repeatable access patterns, and reserve manual review for exceptions and unusual entitlements.
- Track stale access as a remediation KPI Measure how long outdated entitlements remain active after role changes or departures, and use that metric to test whether governance is actually reducing risk.
Bottom line: Cloud-first identity governance is under pressure because access sprawl turns isolated entitlements into an enterprise visibility problem.
Glossary terms: Access Sprawl, Entitlement Drift, Access Certification, Policy-Driven Approval
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/10/2026 3:34 am
Cloud-first governance fails when access data remains siloed by application. The article shows that the real problem is not merely review fatigue, but the inability to compare entitlements across AD, SaaS, and hybrid platforms with different role structures. When governance tools cannot normalize access data, they cannot reliably identify entitlement drift or stale access. Practitioners should treat normalization as the precondition for every downstream governance action.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How can organisations tell whether access review is actually reducing risk?
A: Organisations should look beyond campaign completion and measure downstream removal, reopened exceptions, and the number of high-risk roles still present after review. If rejected access does not disappear from the target system, or if repeated cycles keep certifying the same excess entitlements, the programme is not reducing risk effectively.
👉 Read our full editorial: Cloud-first identity governance must automate access review and remediation
This post was modified 1 day ago by NHI Mgmt Group