Why do periodic access reviews miss the real NHI risk?

Why This Matters for Security Teams

Periodic access reviews were designed for stable human roles, not for NHIs that can be created by pipelines, reused by integrations, or left active after the business purpose changes. That is why the issue is usually not whether an entitlement existed on review day, but whether the credential, token, or app secret was still valid the rest of the month. NHIMG research shows 91.6% of secrets remain valid five days after notification, which underscores how slowly remediation can lag behind exposure in the real world. See the broader risk patterns in the Ultimate Guide to NHIs and the incident patterns in 52 NHI Breaches Analysis.

Access certification tends to confirm paperwork, while attackers exploit live paths: stale API keys, overbroad service accounts, and orphaned OAuth apps. The problem is amplified because NHIs often outnumber humans by orders of magnitude, making point-in-time review operationally shallow and easy to game. Current guidance from OWASP Non-Human Identity Top 10 and NIST Cybersecurity Framework 2.0 both point toward continuous control, not periodic reassurance. In practice, many security teams encounter NHI misuse only after an integration has already been repurposed or a secret has already leaked, rather than through intentional review.

How It Works in Practice

The core failure mode is static governance applied to dynamic machine access. A reviewer may see a service account mapped to a valid owner and conclude the access is acceptable, yet the actual risk depends on whether the account still has a live secret, whether the workload still needs the permission, and whether the account can be used outside its intended runtime. For NHIs, the right question is not simply “who approved this?” but “what is the workload doing now, and what should it be allowed to do at this moment?”

Better practice is to combine inventory, runtime telemetry, and automated response. That means correlating identity records with observed activity, secret age, rotation status, and blast radius. It also means treating offboarding as a technical event, not an annual checklist item. The NHI Lifecycle Management Guide and the Ultimate Guide to NHIs — Key Challenges and Risks both reinforce the same pattern: review tells you what was assigned, but lifecycle controls tell you what is still usable.

• Track each NHI to a workload, owner, and purpose.
• Measure secret age, token lifetime, and last use, not just entitlement membership.
• Use JIT credential provisioning and revoke access when the task ends.
• Prefer workload identity and policy evaluation at request time over broad standing access.
• Flag dormant or overprivileged NHIs for automatic quarantine or rotation.

These controls align with NIST guidance on continuous risk management and Zero Trust, but they depend on real-time data and integration across vaults, CI/CD, cloud control planes, and IAM. They tend to break down in fast-moving CI/CD environments where secrets are embedded in deployment artifacts and ownership changes faster than review cycles can be completed.

Common Variations and Edge Cases

Tighter NHI control often increases operational overhead, requiring organisations to balance faster access for automation against more frequent rotation, stronger approvals, and more telemetry. That tradeoff is especially visible in agentic and event-driven systems, where an autonomous agent may need to act quickly, but not permanently. Best practice is evolving here: there is no universal standard yet for every agent pattern, but the direction is clear. Intent-based authorisation and runtime policy evaluation are increasingly preferred over static RBAC when the workload can change goals mid-execution.

Edge cases include long-lived integrations with vendor systems, emergency access for incident response, and legacy applications that cannot tolerate short-lived credentials without redesign. In those environments, organisations should still reduce standing privilege, segment access more tightly, and shorten secret lifetime wherever possible. The Top 10 NHI Issues page is useful for spotting recurring control failures, while the OWASP view helps distinguish access review from continuous authorisation. For standards grounding, OWASP Non-Human Identity Top 10 and NIST Cybersecurity Framework 2.0 both support a shift from periodic sign-off to live control.

In practice, the hardest cases are the ones where teams cannot easily see the secret, cannot easily change the workload, and cannot easily prove the access is still needed. Those are the situations where periodic review looks complete on paper while real exposure remains unchanged.

Related resources from NHI Mgmt Group

• When do NHI access reviews create more value than a one-time cleanup?
• How should security teams govern high-risk ERP transactions beyond access reviews?
• How should security teams run access reviews for non-human identities?
• Why do leaked secrets remain such a persistent NHI risk?