Why do access certifications fail in practice?

Why This Matters for Security Teams

Access certifications are supposed to prove that entitlements still make sense, but in many organisations they collapse into a checkbox exercise. Reviewers are often asked to approve or reject access without knowing who owns the account, what the access supports, whether the resource is sensitive, or whether the entitlement is still in use. That turns certification into a compliance artefact instead of a governance control, which is exactly why the OWASP Non-Human Identity Top 10 treats identity lifecycle and privilege hygiene as operational risks, not paperwork.

This problem is especially visible for non-human identities, where service accounts, API keys, and automation tokens often have unclear business owners and little human memory of why they were created. NHIMG research on the Ultimate Guide to NHIs — Key Challenges and Risks shows that the real issue is usually not the review itself but the absence of context before the review begins. In practice, many security teams discover excessive access only after an audit exception, an outage, or a credential abuse incident has already exposed the gap.

How It Works in Practice

Effective certification depends on evidence, not memory. The reviewer needs enough context to make a decision quickly and consistently: who owns the identity, what system it touches, what data it can reach, whether the access is privileged, and when it was last used. For NHIs, that context should be pulled from inventory, secrets systems, cloud platforms, and observability data rather than reconstructed manually. The Ultimate Guide to NHIs is useful here because it frames NHI governance as an inventory and lifecycle problem before it becomes a review problem.

Strong certification programs usually do four things:

• Attach each entitlement to a named owner and an accountable approver.
• Show last-used timestamps and resource sensitivity so reviewers can spot dead or risky access.
• Separate standard access from privileged access so high-risk items do not hide in bulk recertification.
• Feed decisions back into deprovisioning, rotation, or JIT workflows instead of stopping at approval.

That operating model aligns with the OWASP Non-Human Identity Top 10 because certification only works when identity governance is tied to actual exposure, not to static role membership. Current guidance suggests that recertification is most valuable when it is risk-based and exception-driven, with sensitive or dormant entitlements reviewed more often than low-risk ones. These controls tend to break down in large multi-cloud environments because ownership data drifts faster than the review cadence and the evidence trail becomes inconsistent across platforms.

Common Variations and Edge Cases

Tighter certification often increases operational overhead, so organisations have to balance review depth against reviewer fatigue. That tradeoff is real, especially when thousands of entitlements are involved and many are inherited through nested groups, shared service accounts, or infrastructure-as-code pipelines. Best practice is evolving, but there is no universal standard for perfect frequency or granularity yet.

Edge cases usually expose why the process fails:

• Privileged service accounts are certified like ordinary user access, which hides risk behind role names.
• Short-lived automation credentials are reviewed after they have already expired, making the control look effective but adding no value.
• Multiple systems disagree on ownership, so approvers default to rubber-stamping.
• Audit teams want evidence of completion, while operators need proof of access reduction.

NHIMG’s analysis of the 52 NHI Breaches Analysis reinforces the pattern: when entitlement reviews are detached from real ownership and exposure data, organisations keep certifying the same excess access until something breaks. The right question is not whether the review happened, but whether it removed risk and produced evidence that can be acted on later.

Related resources from NHI Mgmt Group

• Why do entitlement reviews often fail to reduce access exposure?
• Why do data classification programmes fail in practice?
• Why do ticketing systems fail as access governance controls?
• Why do age assurance programmes fail in practice?