Should organisations prioritise continuous discovery or periodic recertification for identities?

Why Discovery Needs to Come Before Certification

continuous discovery and periodic recertification solve different problems. Discovery tells you what identities actually exist, where they live, and who owns them. Recertification tells you whether access should still stand. If discovery is weak, certification becomes a review of an incomplete register, which is why the sequence matters more than the calendar.

In fast-changing environments, identities can be created by automation, spun up for a task, or disappear when workloads retire. That makes lifecycle management the foundation for any governance programme, because review cannot correct what inventory never saw.

This is not an argument against recertification. It is a recognition that certification depends on a current object list, current ownership, and current context. Without those inputs, periodic review tends to confirm yesterday’s state rather than today’s risk.

What Continuous Discovery Changes Operationally

Continuous discovery changes governance from a point-in-time exercise into an always-on control. It exposes new identities, stale identities, orphaned identities, and changes in ownership or entitlements before the next review cycle. That matters most where cloud resources, service accounts, and automation can appear and disappear faster than formal campaigns can keep up.

Practitioners should treat discovery as the control that feeds every downstream decision. The more dynamic the environment, the more a certification campaign should rely on fresh discovery data rather than a static export. NHIMG’s Identity Visibility and Intelligence Platforms (IVIP) Guide is useful for understanding how continuous visibility supports this operating model.

Discovery also changes ownership decisions. If the team cannot reliably identify who owns an identity, the review process usually degrades into rubber-stamping or exception handling. A current inventory lets you route review to the right owner and separate known, active identities from records that should be removed or remediated first.

Where Recertification Still Earns Its Keep

Recertification remains valuable for privilege concentration, access creep, and segregation issues that discovery alone will not resolve. It is the mechanism that forces a human or business owner to affirm whether access is still justified. In mature programmes, it becomes the validation step after discovery has established scope and ownership.

For stable environments, or for access that changes slowly, periodic certification can still be efficient and defensible. The key is to avoid making it the only governance motion. NHIMG’s Access Reviews and Certification Guide shows why review design has to focus on context, removal, and closure rather than volume alone.

Where organisations already have strong lifecycle controls, recertification becomes more targeted. It can focus on high-risk access, privileged roles, dormant accounts, and identities with unclear ownership. That is a better use of reviewer attention than asking people to certify a population that may already be outdated.

Risk and Threat Considerations

When discovery lags, the main risk is blind governance. Identities that no longer exist can stay authorised on paper, while newly created identities can operate for long periods without review. That creates exposure through orphaned access, privilege creep, and weak accountability, especially when service accounts or automation are created outside the normal joiner-mover-leaver path.

Failure mechanism: The control fails when certification is run against stale inventory or incomplete ownership data, so reviewers approve access they cannot actually see or assign correctly.

Impact: Unseen identities and unreviewed privileges can expand the blast radius of compromise, delay revocation, and make audit evidence look stronger than the real control environment.

Practitioner Guidance

What to prioritise: Build continuous discovery first for any estate with ephemeral, automated, or cloud-native identities, then use recertification to validate the high-risk subset that discovery surfaces. If the inventory is not fresh, a certification campaign is mostly administrative noise.

What to verify: Confirm that every discovered identity has an owner, a source of truth, and a review path before you trust a periodic campaign. If you cannot trace those three points, treat the identity as a remediation item, not just a certification item.

What good looks like: Discovery detects change quickly enough that certification reviews a current population, not an archived one. The sign of maturity is when review cycles become shorter, sharper, and more exception-driven because the underlying inventory is already under control.

Practitioner takeaway: Use continuous discovery to establish what exists and who owns it, then use recertification to test whether the access still deserves to remain.

Related resources from NHI Mgmt Group

• How can organisations reduce the blast radius of compromised agent identities?
• Should organisations prioritise external exposure or internal credential governance first?
• When should organisations prioritise continuous testing over periodic assessments?
• Should organisations prioritise continuous monitoring over periodic certification?