What should organisations prioritise first: AI automation or access cleanup?

Why This Matters for Security Teams

Security teams usually treat AI automation and access cleanup as separate programmes, but they are tightly coupled. If entitlement data is noisy, any automation that ranks access, flags anomalies, or recommends removals will inherit the same confusion. The baseline matters because AI only sees the permissions, group membership, and naming patterns already present in the environment. That is why NHI Management Group places identity hygiene before optimisation in its guidance on non-human identities, and why the OWASP Non-Human Identity Top 10 treats credential sprawl and weak lifecycle control as core risks rather than secondary issues.

The practical issue is not whether AI can help, but whether it can help with enough signal quality to be trusted. In the State of Secrets in AppSec research, 43% of security professionals said they are concerned about AI systems learning and reproducing sensitive information patterns from codebases. That concern maps directly to access governance: automation amplifies what it is trained or tuned on, including stale entitlements and inconsistent role design. In practice, many security teams encounter bad automation only after a review cycle or production incident has already exposed the underlying entitlement mess, rather than through intentional governance.

How It Works in Practice

Start with access cleanup as a prerequisite for automation, not as a parallel stream. The objective is to remove stale accounts, collapse duplicate roles, standardise naming, and separate human access from NHI access so that policy decisions are based on current reality. For NHI-heavy environments, this often means inventorying service accounts, API keys, workload identities, and CI/CD tokens first, then mapping each to an owner, purpose, and expiry path. The Ultimate Guide to NHIs is useful here because it frames non-human access as a lifecycle problem, not a one-time review exercise.

Once the baseline is cleaner, AI can support the work in narrower, more reliable ways. Common use cases include:

• Clustering similar entitlements to reveal redundant roles.
• Detecting access outliers that do not match job function or workload purpose.
• Prioritising risky permissions for human review based on blast radius.
• Suggesting candidates for JIT access or tighter TTLs where standing access is unnecessary.

Good automation still needs human policy. Best practice is evolving toward policy-as-code and context-aware review, but there is no universal standard for this yet. Teams should use AI to surface patterns, then validate them against business ownership, tool usage, and actual runtime need. For NHI and secrets exposure patterns, the LLMjacking research shows how quickly exposed credentials can be abused, which is why cleanup should focus first on reducing the reachable attack surface. These controls tend to break down when identity data is spread across multiple directories and ticketing systems because no single dataset is accurate enough for automation to trust.

Common Variations and Edge Cases

Tighter access cleanup often increases short-term operational friction, requiring organisations to balance faster AI adoption against slower review cycles and application owner dependency. That tradeoff is real, especially where business units have grown used to broad standing access or where service accounts are embedded in legacy workflows. Current guidance suggests avoiding a big-bang cleanup if it risks breaking critical workloads; instead, clean the highest-risk entitlements first and use AI to accelerate prioritisation, not to approve removals automatically.

There are a few edge cases where organisations may pilot AI earlier. If access data is already well-governed, highly centralised, and consistently labelled, limited automation can help prioritise reviews while cleanup continues. The opposite is also true: if the environment contains many orphaned NHI credentials, weak ownership, or undocumented integrations, automation will mostly rank noise. The 52 NHI Breaches Analysis underscores how often identity failures become incident material once secrets or service access are left unmanaged. In those environments, access cleanup is not a preparatory task; it is the control that makes AI worth deploying at all.

Related resources from NHI Mgmt Group

• Should organisations prioritise external exposure or internal credential governance first?
• Should organisations prioritise discovery or access restriction first for shadow AI?
• Should organisations prioritise access review or lifecycle automation first?
• Should organisations prioritise AI agent access controls before broader NHI cleanup?