Why do IAM modernisation projects often fail to improve access reviews?

Why This Matters for Security Teams

IAM modernisation usually improves provisioning, policy enforcement, and federation, but access reviews fail when the certification model still assumes human-like, stable access. Certifiers are asked to approve or remove privileges without task context, ownership clarity, or evidence of actual use, so the review becomes a document exercise instead of a control. That gap matters more for non-human identities, where access is often secret-backed, ephemeral, and tied to changing workloads rather than fixed roles.

Current guidance from the OWASP Non-Human Identity Top 10 and NHIMG’s Ultimate Guide to NHIs points to a consistent pattern: the control often exists, but the review workflow is not redesigned for non-human access semantics. The result is noise, rubber-stamping, and delayed remediation. NHIMG research also shows that 88.5% of organisations say non-human IAM still lags human IAM, which helps explain why review quality does not improve after platform upgrades. In practice, many security teams encounter toxic access recertification only after a cloud migration has already increased entitlement sprawl.

How It Works in Practice

Modernisation improves access review only when it changes the evidence model, not just the directory or workflow engine. Security teams need review records that describe what the identity does, which workload owns it, what data or system it touched, and whether the access was actually used in the last cycle. Without that, certifiers cannot distinguish a critical service credential from stale privilege, and they default to approvals to avoid breaking production.

The practical fix is to make access reviews context-driven:

• Use workload ownership metadata so every non-human identity maps to a service, application, or deployment pipeline.
• Pull in runtime signals such as last use, scope, environment, and authentication method rather than only static entitlements.
• Separate human review cadence from machine review cadence; many machine identities need event-based review, not quarterly sign-off.
• Pair certification with lifecycle controls from the NHI Lifecycle Management Guide so revoked access is actually replaced, retired, or reissued in a controlled way.

This is where OWASP guidance and 52 NHI Breaches Analysis are useful in combination: the first clarifies common NHI failure modes, while the second shows how weak ownership and static secrets turn review gaps into incidents. Mature programmes also enrich reviews with secrets inventory data, because a credential that is still active but never rotated is not a benign finding. These controls tend to break down in multi-cloud estates with shared service accounts and unclear application ownership because reviewers cannot reliably tell which access is safe to remove.

Common Variations and Edge Cases

Tighter review controls often increase operational overhead, requiring organisations to balance better assurance against reviewer fatigue and release risk. That tradeoff is especially visible in environments with hundreds of service accounts, CI/CD robots, and integration tokens, where a single quarterly campaign can overwhelm certifiers and produce blanket approvals.

There is no universal standard for this yet, but current guidance suggests three common patterns. First, high-risk non-human identities should move to event-driven review triggers, such as privilege expansion, ownership change, failed rotation, or unusual runtime behaviour. Second, low-risk automation can use policy-based attestation instead of manual recertification, provided the policy checks are backed by reliable telemetry. Third, sensitive environments should treat access review as part of a broader dynamic credential and lifecycle program, not as a standalone checklist.

The exception is legacy infrastructure that cannot emit trustworthy usage signals. In those cases, review teams may need compensating controls such as shorter credential lifetimes, stronger ownership approval, and hard decommission dates. The main failure mode remains the same: modern IAM tooling can reduce administrative friction, but it does not automatically create better review decisions unless the organisation also changes what evidence certifiers see and how often they are asked to act.

Related resources from NHI Mgmt Group

• Why do user access reviews often fail to improve security in practice?
• Why do access reviews often fail to improve identity governance?
• Why do access reviews often fail to improve governance?
• How should insurers govern access during large core-system modernisation projects?