What should organisations measure instead of review completion rates?

Why This Matters for Security Teams

Review completion rates are useful for audit evidence, but they do not tell a security team whether access was actually reduced, corrected, or contained. For NHI governance, the real risk is not whether a reviewer clicked approve or reject. It is whether unowned access still exists, whether standing privilege remains in place, and whether entitlement changes are acted on quickly enough to matter.

This is especially important because NHI sprawl is usually invisible until something breaks. NHIMG notes in the Ultimate Guide to NHIs that NHIs outnumber human identities by 25x to 50x in modern enterprises, and only 5.7% of organisations have full visibility into their service accounts. That means a high completion rate can coexist with large amounts of unmanaged access. Current guidance in the NIST Cybersecurity Framework 2.0 pushes teams toward outcome-based risk management, not paper-based process success. In practice, many security teams discover bad access state only after a credential is abused, rather than through the review process that was meant to prevent it.

How It Works in Practice

Organisations should measure whether identity governance is changing the actual access environment. That means tracking unowned access, standing privilege, and the elapsed time between an entitlement change and the governance response. These metrics are closer to operational reality because they show whether access is being reduced, remediated, or left to accumulate.

A practical measurement model usually includes three layers:

• Exposure state: count NHIs with no clear owner, stale credentials, excessive roles, or direct production access.

• Response speed: measure time from entitlement drift, role escalation, or service-account creation to approval, revocation, or remediation.

• Control effectiveness: compare detected risky access against the amount actually removed or constrained.

This is where review completion falls short. A completed review can still leave a service account overprivileged, a CI/CD token unrotated, or an orphaned integration still active. The Ultimate Guide to NHIs highlights that 97% of NHIs carry excessive privileges and 71% are not rotated within recommended time frames. Those findings show why the metric should be “did risk decline?” rather than “was the form submitted?” Teams that align to the NIST Cybersecurity Framework 2.0 can map these signals to continuous monitoring and access governance outcomes instead of treating reviews as a compliance endpoint. These controls tend to break down in fast-moving CI/CD and agentic workloads because entitlement changes can occur faster than manual reviewers can assess them.

Common Variations and Edge Cases

Tighter measurement often increases operational overhead, requiring organisations to balance better risk visibility against data quality and workflow friction. That tradeoff matters because not every environment can measure the same way. Some teams can track ownerless accounts cleanly, while others have ambiguous ownership across shared service accounts, outsourced operations, or ephemeral workload identities.

Best practice is evolving, but the direction is clear: if an access review cannot tell you whether privilege shrank, it is not enough. For high-churn platforms, time-to-remediate is often more important than whether every reviewer participated. For low-risk systems, a smaller set of measures may be acceptable, but the organisation still needs evidence of standing privilege reduction and orphaned access cleanup. NHIMG’s data in the Ultimate Guide to NHIs shows that 79% of organisations have experienced secrets leaks and 77% of those incidents caused tangible damage, which is why speed and exposure state matter more than paperwork completion. In edge cases such as outsourced administration or delegated platform ownership, the measurement model must explicitly assign accountability or the metrics will look healthy while risk remains unresolved.

Related resources from NHI Mgmt Group

• When should organisations use non-document proof of address instead of bills?
• How should organisations prove compliance continuously instead of by snapshot?
• How do organisations operationalise NHI ownership at scale?
• When should organisations treat an NHI as a high-priority risk?