Why do access reviews fail even when certification campaigns are completed?

Why This Matters for Security Teams

Certification campaigns often measure completion, not correctness. That creates a dangerous gap: reviewers can mark access as approved without enough operational context to know whether the entitlement is still needed, whether it is tied to a real workload, or whether the account has drifted from its original purpose. This is especially risky for machine identities and service accounts, where access is not exercised like a human user’s and stale permissions can remain invisible for long periods.

NHIMG’s research on the Ultimate Guide to NHIs and the 52 NHI Breaches Analysis shows that unmanaged identities and weak lifecycle controls repeatedly turn into privilege accumulation and exposure. The problem is not that reviews are skipped; it is that the review process often lacks authoritative telemetry, ownership clarity, and enforcement after the decision. That same pattern appears in access governance programs that focus on attestation artifacts instead of runtime access state. In practice, many security teams discover the gap only after stale entitlements have already been used or inherited by a compromised identity.

Current guidance from the OWASP Non-Human Identity Top 10 aligns with this: identity review without lifecycle validation is not enough.

How It Works in Practice

Access reviews fail when the campaign treats every entitlement as a static yes or no decision. A reviewer may see a role name, a ticket reference, or an old approval chain, but not the workload that consumes the credential, the owner who still depends on it, or whether the secret has been rotated since issuance. For NHI governance, the real question is not just “was this approved?” but “is this still required, by whom, in what environment, and under what expiration rule?”

Practically, strong review programs connect certification workflows to evidence from identity, secrets, and workload systems. That means linking the account to a known service, proving ownership, checking last use, checking privilege scope, and verifying whether the credential is ephemeral or long-lived. The NHI Lifecycle Management Guide is useful here because lifecycle state is what makes review decisions actionable, not the approval itself.

• Use source-of-truth ownership, not directory names, to route certifiers.
• Require evidence such as last activity, workload binding, and business justification.
• Separate human access from NHI access, because review cadence and risk differ.
• Automate remediation so revocation, rotation, or deprovisioning happens immediately after denial.
• Recheck effective permissions after remediation, since approval and execution often diverge.

Security teams should also align review outcomes with policy enforcement and secret rotation. The NHI angle matters because service accounts, API keys, and automation tokens often have no obvious end user, which makes “rubber stamp” approvals more likely. The DeepSeek breach and related industry reporting on exposed secrets reinforce the same lesson: long-lived credentials remain dangerous even after governance paperwork is complete. These controls tend to break down in hybrid environments where ownership is split across SaaS, cloud, and CI/CD systems because no single team can validate the full access chain.

Common Variations and Edge Cases

Tighter review controls often increase operational overhead, requiring organisations to balance stronger assurance against slower certification cycles. That tradeoff becomes more visible when teams try to use one campaign design for both people and machines, even though the risk model is different.

There is no universal standard for this yet, but current guidance suggests the most reliable programs treat non-human access as a separate class with its own evidence requirements, approval rules, and remediation SLAs. For example, a dormant service account with no owner should not be reviewed like a contractor’s application role. Likewise, a high-privilege integration token may need automatic expiration or just-in-time reissuance rather than recurring manual recertification. This is where the operational answer overlaps with the broader governance themes in the Ultimate Guide to NHIs — Key Challenges and Risks and the attack patterns described in the Sisense breach.

Edge cases include shared service accounts, ephemeral pipelines, and delegated admin models. In those environments, completion metrics can look healthy while actual exposure persists because the remediation step is delayed, partially executed, or blocked by dependency chains. That is why access review success should be measured by risk reduction, not campaign completion alone.

Related resources from NHI Mgmt Group

• Why do access reviews often fail to reduce privilege creep?
• Why do access reviews fail when identity data is stale?
• Why do user access reviews often fail to improve security in practice?
• Why do access reviews fail when entitlement data is incomplete?