What breaks when organisations delay identity reviews until after the holiday period?

Why This Matters for Security Teams

Holiday delays are not just an administrative backlog problem. They extend the life of permissions that should already have been reviewed, reduced, or removed, which is exactly when attackers benefit from thin staffing and slower approvals. NHI Mgmt Group’s Ultimate Guide to NHIs notes that 97% of NHIs carry excessive privileges, and that risk becomes more dangerous when access reviews slip past the period of highest operational distraction.

The real issue is that delayed reviews preserve dormant access paths. Misassigned roles, stale service accounts, and forgotten API keys remain usable while teams assume normal holiday controls are enough. That assumption fails because compromise detection and access revocation both slow down at the same time. The NIST Cybersecurity Framework 2.0 treats governance, asset awareness, and access control as continuous activities, not seasonal tasks. In practice, many security teams discover the delay only after suspicious access has already blended into holiday noise, rather than through a planned review cycle.

How It Works in Practice

Identity reviews work best when they happen before a low-visibility period, with enough time to verify who still needs access and who does not. That means reviewing human and non-human identities together, because holiday risk often shows up in service accounts, delegated admin roles, and unattended integrations rather than only in employee accounts. A mature review process should confirm business ownership, active use, privilege level, and revocation path for each identity.

For NHI-heavy environments, security teams should also validate whether long-lived secrets can be replaced with shorter-lived credentials or workload identity controls. The Top 10 NHI Issues research highlights how often organisations lack full visibility into service accounts, which makes delay especially dangerous. Where possible, combine access certification with rotation, JIT elevation, and logging that can survive reduced staff coverage. Guidance suggests prioritising identities with broad privilege, external exposure, or automation dependencies first.

• Review dormant accounts before holiday freezes, not after them.
• Validate owner, purpose, and last-use date for every privileged identity.
• Revoke access that no longer has an explicit business need.
• Shorten credential lifetime where static secrets are still required.
• Escalate anything unclear before staff availability drops.

The 52 NHI Breaches Analysis reinforces a consistent pattern: attackers do not need perfect access, only enough time for stale permissions to remain untouched. These controls tend to break down in organisations that batch all certification work into a post-holiday cleanup window because revocation becomes slower than attacker dwell time.

Common Variations and Edge Cases

Tighter review timing often increases operational overhead, requiring organisations to balance faster access decisions against business continuity, especially when holiday staffing is already limited. There is no universal standard for whether all access must be reviewed before year-end, but current guidance suggests prioritising risk-based certification instead of waiting for a single enterprise-wide cleanup.

Edge cases include systems with emergency access, outsourced operations, and machine identities embedded in CI/CD pipelines. In those environments, a delayed review can accidentally remove access that is still needed for incident response or automated deployment, so the review must distinguish between unused and temporarily idle. That is especially important when identities are shared across teams or tied to legacy applications, because ownership is often unclear.

Where organisations have strong PAM and ZTA controls, the damage from delayed review is reduced but not eliminated. PAM can help constrain standing privilege, while Zero Trust reduces implicit trust, yet neither replaces timely certification. The safest approach is to treat holiday-period reviews as a precondition for reduced staffing, not an after-the-fact housekeeping task. If a review queue is already waiting until January, the organisation has effectively extended attacker opportunity into the least supervised part of the operating calendar.

Related resources from NHI Mgmt Group

• What breaks when organisations rely on static identity audits instead of continuous validation?
• What breaks when organisations delay access removal for leavers and role changes?
• What breaks when organisations try to force a one-size-fits-all identity strategy across different environments?
• What breaks when organisations postpone post-quantum testing until the last minute?