Access review fatigue

Expanded Definition

access review fatigue is a governance failure mode that appears when reviewers are asked to repeatedly approve large volumes of routine or low-value entitlements, causing attention to drift from genuinely risky access. In NHI environments, the problem is amplified because service accounts, API keys, workload identities, and automation tokens often accumulate permissions faster than humans can meaningfully assess them. The result is not just slow review cycles but reduced review quality, where “approved” becomes a default outcome rather than a reasoned decision.

Industry usage is still evolving, but the concept aligns closely with access recertification and entitlement review practices in frameworks such as the OWASP Non-Human Identity Top 10. In NHI Management Group guidance, this is best treated as a signal that the review model itself is too broad, too frequent, or too undifferentiated to surface real risk. The most common misapplication is treating campaign completion as evidence of control effectiveness, which occurs when organizations measure completion rates instead of reviewer signal quality.

Examples and Use Cases

Implementing access reviews rigorously often introduces reviewer burden and operational delay, requiring organisations to weigh stronger oversight against the cost of attention decay and workflow friction.

• A quarterly recertification campaign includes hundreds of low-risk service accounts, and reviewers approve them without inspection because the list is too long to assess carefully.
• An engineering team inherits dozens of CI/CD tokens after a platform migration, but the review spreadsheet lacks context on which tokens still support production systems.
• A shared API key used by multiple automation jobs appears in a review queue alongside dozens of dormant accounts, making it hard to identify which entitlement actually needs removal.
• After repeated “approve unless obvious” cycles, a privileged workload identity remains active even though its owner left the team months earlier.
• The NHI Lifecycle Management Guide is used to tie review evidence to ownership, rotation, and offboarding so that approvals reflect current operational need rather than historical inheritance.

For a broader NHI risk context, the Ultimate Guide to NHIs explains why visibility and lifecycle discipline matter when entitlement inventories are already large and fast-changing.

Why It Matters in NHI Security

Access review fatigue matters because NHI attack paths often hide in plain sight: overprivileged service accounts, stale API keys, and automation credentials can remain active long after the business need has changed. When reviewers are overwhelmed, compensating controls such as rotation, offboarding, and privilege reduction stop getting meaningful scrutiny. That makes access review campaign look successful while the underlying risk profile stays unchanged or worsens.

NHI Management Group research shows that 97% of NHIs carry excessive privileges, which means reviewers are often asked to validate access that is already broader than necessary and harder to judge quickly. The Ultimate Guide to NHIs also notes that only 5.7% of organisations have full visibility into their service accounts, a visibility gap that makes fatigue even more dangerous because reviewers cannot confidently distinguish active, dormant, and high-risk identities. The 52 NHI Breaches Analysis shows how these weaknesses repeatedly precede compromise. Organisations typically encounter the consequence only after an incident review reveals that “approved” access had never been meaningfully challenged, at which point access review fatigue becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• How should security teams reduce access review fatigue without weakening governance?
• How should security teams reduce user access review fatigue without weakening control?
• Non-Human Identity Access Management
• When should organizations review access controls?