Why do access reviews often fail to reduce real cyber risk?

Why This Matters for Security Teams

Access reviews are meant to confirm that privileges still match business need, but that assumption breaks when identities, workloads, and toolchains change faster than the review cycle. In NHI environments, the real risk is often not whether an account existed at one point in time, but whether its secrets, scopes, and downstream access remained valid after the snapshot was taken. The 2024 ESG Report: Managing Non-Human Identities found that 72% of organisations have experienced or suspect they have experienced an NHI breach, which shows how often governance gaps become operational incidents rather than audit findings.

This is why security teams should treat access reviews as one input, not the control plane. The bigger issue is drift: service accounts, API keys, CI/CD tokens, and AI agent credentials accumulate permissions that no longer reflect the workload’s current purpose. Guidance from the NIST Cybersecurity Framework 2.0 and the OWASP Non-Human Identity Top 10 points toward continuous governance, but current practice still relies too heavily on periodic certification. In practice, many security teams discover over-permissioned NHIs only after an exposure, an abuse pattern, or a failed audit has already exposed the gap.

How It Works in Practice

A useful access review process starts with inventory, but it cannot stop there. Security teams need to tie each NHI to an owner, a workload purpose, and an expiry condition. That means reviewing not only who can use the identity, but also whether the associated Ultimate Guide to NHIs shows how common lifecycle gaps and privilege sprawl are in practice. If a token or certificate is long-lived, the review outcome is already degrading the moment it is approved.

Operationally, the stronger pattern is to pair reviews with continuous detection and automated remediation:

• Reconcile entitlements against live workload inventory, not last quarter’s spreadsheet.
• Flag privileged NHIs, especially those able to mint tokens, read secrets, or call sensitive APIs.
• Use just-in-time issuance and short TTLs so approved access expires automatically when the task ends.
• Require removal workflows for orphaned identities, unused keys, and stale role bindings.
• Correlate review decisions with actual runtime activity so anomalous use is visible immediately.

This is also where zero standing privilege and workload identity matter. A review should verify that a workload proves what it is with a strong identity, then receives only the minimum access needed for that session. The CISA cyber threat advisories consistently show that attackers move quickly once credentials are exposed, which makes stale approvals especially dangerous. For NHI-specific governance patterns, NHI Lifecycle Management Guide is the better operational lens than a one-time certification exercise. These controls tend to break down when identities are embedded in automation pipelines or agentic workflows because the access path changes before the review queue does.

Common Variations and Edge Cases

Tighter access controls often increase operational overhead, requiring organisations to balance speed against assurance. That tradeoff is most visible in high-churn environments such as CI/CD, ephemeral containers, and AI agents that request tools dynamically. There is no universal standard for this yet, but current guidance suggests using policy-based approvals, short-lived secrets, and runtime checks rather than broad pre-approved roles. The The 52 NHI breaches Report and the Ultimate Guide to NHIs — Why NHI Security Matters Now both reinforce that compromise often comes from identities that were technically approved but no longer operationally safe.

For AI agents, the problem is sharper because behaviour is goal-driven and difficult to predict in advance. Static RBAC does not map well to an agent that can chain tools, escalate through delegated access, or follow a prompt into a new workflow. Best practice is evolving toward intent-based authorisation, where the system evaluates the request in context at runtime, using signals such as task, data sensitivity, environment, and trust level. Frameworks such as MITRE ATLAS adversarial AI threat matrix and Anthropic — first AI-orchestrated cyber espionage campaign report are useful reminders that autonomous systems can be abused in ways classic reviews do not anticipate. For that reason, access reviews should be treated as governance hygiene, while runtime policy enforcement and secret expiry carry the actual risk reduction.

Related resources from NHI Mgmt Group

• Why do access reviews often fail to reduce real risk?
• Why do access reviews often fail to reduce audit findings?
• What breaks when access reviews are used as the main risk control?
• How should security teams use GRC to reduce identity-related cyber risk?