What signals show that access review is not working in practice?

Why This Matters for Security Teams

access review are supposed to prove that privileges are still justified, but in practice they often become a paperwork exercise. When reviewers click through long lists of accounts, approve the same entitlements, and close the ticket without removing anything, the control is not reducing risk. That is especially dangerous for service accounts, API keys, and other NHIs, where stale access can persist long after the original use case has changed. The Ultimate Guide to NHIs notes that only 5.7% of organisations have full visibility into their service accounts, which means many reviews start from incomplete data.

Signal quality matters more than meeting completion. Security teams should expect access reviews to produce removals, scope reduction, or time-bound exceptions with follow-up, not just sign-offs. The OWASP Non-Human Identity Top 10 reinforces that weak lifecycle control and excessive privilege are recurring NHI failure modes. In practice, many security teams discover review failure only after a breach investigation shows that the “approved” access had never been meaningfully challenged.

How It Works in Practice

A working access review program produces evidence of decision and remediation, not just evidence of participation. For NHIs, that means the review must connect each identity to an owner, purpose, privilege set, and last-used signal. Reviews based only on account names or group membership miss the operational context that tells you whether access is still needed. NHI Management Group’s NHI Lifecycle Management Guide treats lifecycle state as the anchor for governance because access should be examined against onboarding, rotation, workload change, and offboarding events.

• Confirm every entitlement has a business or technical owner who can actually approve removal.
• Compare current privilege to observed usage, not just assigned role.
• Track exceptions separately so repeated approvals do not hide drift.
• Require revocation or expiry dates for temporary access.
• Measure the percentage of reviewed items that resulted in changes.

Useful reviews also pull from surrounding controls: secret scanners, CMDB or inventory data, PAM logs, and workload telemetry. The 52 NHI Breaches Analysis shows that many real incidents involved identities that remained active after they were no longer needed, which is exactly the kind of drift a review should catch. The baseline from the OWASP Non-Human Identity Top 10 is straightforward: if an identity cannot be tied to a current purpose, it should not keep standing access. These controls tend to break down when inventories are incomplete and owners cannot validate technical entitlements because the review becomes a batch approval exercise instead of an evidence-based decision.

Common Variations and Edge Cases

Tighter review rules often increase operational overhead, requiring organisations to balance stronger reduction of unnecessary access against the speed needed by engineering and operations teams. That tradeoff is real, especially for high-churn environments where permissions change frequently. Current guidance suggests using risk-based review cadence rather than treating all NHIs the same. High-impact service accounts, internet-facing workloads, and third-party integrations should be reviewed more often than low-risk internal jobs.

There is no universal standard for this yet, but best practice is evolving toward continuous review signals instead of periodic checkbox attestations. If a team repeatedly grants exceptions, the problem may be the access model itself, not reviewer discipline. In those cases, scope should be reduced with stronger Ultimate Guide to NHIs — Key Challenges and Risks framing: excessive privilege, poor visibility, and weak offboarding are structural issues. For short-lived workloads, the better pattern is to shift from persistent entitlement to time-bound access and automated revocation. Reviews also become misleading when managers approve access they cannot verify technically, so the process should require evidence from logs or inventory before sign-off. That approach aligns with the reality that NHI risk is often hidden until the next incident, not surfaced by the review meeting itself.

Related resources from NHI Mgmt Group

• What signals show that access review processes are becoming too manual?
• What signals show that patient identity controls are not working?
• What signals show that identity access is out of alignment with business need?
• When should organizations review access controls?