What breaks when identity security assessments rely on PDFs and spreadsheets?

Why This Matters for Security Teams

PDFs and spreadsheets are useful for snapshot reporting, but identity security is fundamentally a change problem. A point-in-time export can show current privileges, yet it cannot reliably answer who gained access yesterday, which service account has never authenticated, or whether a credential was rotated after a risk event. That gap breaks attribution, deprovisioning, and vaulting decisions.

This is especially damaging for non-human identities because service accounts, API keys, and OAuth grants change faster than most manual review cycles. NHIMG’s Ultimate Guide to NHIs notes that only 5.7% of organisations have full visibility into their service accounts, which explains why static assessment files so often miss the identities that matter most. Security teams also lose the ability to connect findings to control outcomes in NIST Cybersecurity Framework 2.0, especially asset visibility, access control, and continuous monitoring.

In practice, many security teams discover the problem only after an incident review forces them to reconstruct identity history from logs, tickets, and vault records that were never meant to be a system of record.

How It Works in Practice

Identity assessments need a living data source, not a document archive. For human and non-human identities alike, the useful questions are change-based: what was created, modified, approved, rotated, removed, or left untouched during the review period. That requires pulling data from identity providers, cloud IAM, PAM, secret managers, CI/CD systems, and SaaS audit logs into a queryable workflow. Static files flatten all of that into one current state and erase the sequence of events that explains risk.

For NHI governance, the practical model is to treat every key, token, certificate, and service account as an object with metadata: owner, purpose, privilege scope, last authentication, last rotation, and expiration. Current guidance suggests tying those records to evidence that can be refreshed automatically, rather than relying on a reviewer to retype findings into a spreadsheet. That is the difference between a one-time audit artifact and a control that can support deprovisioning, vaulting, and exception management.

Where teams need stronger assurance, they should align assessments with current-state plus drift detection. NHIMG’s Top 10 NHI Issues and 52 NHI Breaches Analysis both show the operational cost of missed rotation, weak ownership, and poor visibility. That is why event-driven evidence pipelines matter more than annual spreadsheet reviews. A simple implementation pattern is:

• ingest identity events from authoritative systems of record
• normalize ownership, privilege, and lifecycle fields
• flag unmanaged or unauthenticated identities for follow-up
• retain history so reviewers can see change over time
• trigger remediation tickets when access exceeds policy

These controls tend to break down in fragmented environments where identity data is split across multiple clouds, legacy directories, and unmanaged SaaS tools because no single export captures the full lifecycle.

Common Variations and Edge Cases

Tighter evidence collection often increases operational overhead, requiring organisations to balance audit convenience against source-system integration work. That tradeoff is real, especially when teams are trying to support both compliance evidence and day-to-day remediation.

There is no universal standard for this yet, but current guidance suggests treating spreadsheets as supporting material rather than the assessment record itself. In mature environments, the assessment should point back to authoritative records and timestamps. In less mature ones, even a lightweight case management workflow is better than a static file because it preserves who changed what and when.

Edge cases matter. Air-gapped or heavily regulated environments may still rely on exported evidence for formal sign-off, but the underlying data should still come from a controlled source, not hand-maintained columns. OAuth apps, CI/CD secrets, and shared service accounts are common failure points because ownership is ambiguous and the “current” state is often already stale by the time the review starts. For a broader governance view, the Ultimate Guide to NHIs — What are Non-Human Identities section is useful when mapping identity types to lifecycle controls.

What breaks most often is not the spreadsheet format itself, but the false assumption that a snapshot can answer questions about identity change, ownership, and remediation without underlying event history.

Related resources from NHI Mgmt Group

• What breaks when identity teams rely on logs instead of rollback for tenant recovery?
• What breaks when gambling operators rely only on basic identity checks?
• What breaks when organisations rely on spreadsheets for machine identity management?
• What breaks when security awareness programmes rely on point-in-time assessments?