Why do periodic access reviews miss the risks this article describes?

Why periodic access reviews are too slow for fast-moving risk

Periodic access reviews are a backward-looking control. They certify what access existed at a snapshot in time, but they do not govern the decision while the access is being used, expanded, or made risky by a new event. When the risk window can open and close between campaigns, the review becomes evidence of oversight rather than a mechanism for prevention.

The practical failure is timing. A user, service account, or integration can become excessive because of a change in role, environment, vendor status, incident response, or privilege path long before the next certification cycle. By the time the reviewer sees it, the exposure may already have been exploited, remediated elsewhere, or normalized into the baseline.

That is why Access Reviews and Certification Guide treats review design as a control architecture problem, not a calendar problem. The goal is to reduce review volume, add context, and close the loop so that the review is informed by current risk rather than stale entitlement state.

What runtime governance changes that reviews cannot

Runtime governance moves the decision closer to the moment of use. Instead of asking whether access was acceptable last month, it asks whether the access should be allowed now, under the current context, with the current blast radius, and for the current purpose. That shift matters when access is conditional, short-lived, or tied to a volatile workload, agent, or privileged session.

This is especially important for access that changes faster than review cadence. The need is not merely to know who has access, but to control when access is active, when it is justified, and when it should be removed or constrained immediately. IAM and IGA Basics frames that distinction clearly: governance is strongest when provisioning, entitlement changes, and review are connected to lifecycle events instead of treated as isolated periodic tasks.

For non-human access, the mismatch is even sharper because credentials, tokens, and service permissions can persist long after the operational reason for them has changed. The NHI Lifecycle Management Guide emphasizes provisioning, rotation, offboarding, and visibility because static certification alone cannot keep pace with machine credentials that are created, reused, or forgotten between review cycles.

A useful mental model is this: periodic review asks whether a permission was once justified, while runtime governance asks whether the permission is justified at the point it can cause harm. Those are not interchangeable controls, and the second is the one that answers fast-moving risk.

Where periodic reviews still help, and where they fail first

Periodic reviews still have value for governance evidence, ownership clarity, and cleanup of obvious entitlement drift. They are useful for discovering stale access patterns, reaffirming accountability, and forcing a periodic reset of assumptions. But they fail first when access is dynamic, privilege is high impact, or the environment changes frequently enough that human review cannot keep up.

The most common blind spots are stale-but-validated entitlements, standing privileged access, dormant service credentials, and approvals that are formally correct but operationally obsolete. A review can confirm that someone had a role at the time of certification without detecting that the role should already have been revoked, reduced, or segmented. Privileged Access Management Guide is relevant here because just-in-time access, session control, and zero standing privilege directly reduce the period during which stale access can do damage.

For that reason, the strongest programs pair reviews with continuous signals such as use frequency, role change, account age, credential rotation, and abnormal access paths. Review then becomes a reconciliation layer, not the only decision point. If the business depends on the access being safe between cycles, the control design is already too weak.

Risk and Threat Considerations

Periodic access reviews create a window in which access can be granted, misused, or left in place after the original justification has disappeared. The longer the cycle, the more likely the environment has changed before the reviewer acts, and the more attractive the gap becomes to attackers looking for stale privilege or neglected credentials.

Failure mechanism: Access state drifts between review dates, so excessive privilege, inactive accounts, or lingering machine credentials can remain effective long enough to be abused before the next certification cycle catches them.

Impact: The organisation can retain unauthorized or overbroad access, miss the moment to remove it, and allow lateral movement or privilege abuse to proceed under an apparently approved entitlement model.

Practitioner Guidance

What to prioritise: Put runtime decisions around the highest-risk access first, especially privileged, third-party, and machine access that can materially affect production or sensitive data. Those are the cases where a stale review is least defensible.

What to verify: Confirm that every certification campaign is tied to a current trigger, current owner, and current entitlement source, not just a recurring date. If the control cannot show what changed since the last review, it is not protecting against fast-moving risk.

Decision rule: If access can create meaningful harm before the next review cycle, treat periodic review as supporting evidence and add a runtime control that can narrow, pause, or revoke access immediately.

Practitioner takeaway: The real test is not whether access was reviewed, but whether the organisation could still prevent misuse after the risk changed.

Related resources from NHI Mgmt Group

• How should security teams run access reviews for non-human identities?
• When do NHI access reviews create more value than a one-time cleanup?
• Why do periodic access reviews miss the real NHI risk?
• Why do periodic access reviews miss real identity risk in modern estates?