Periodic access reviews have long been the default for managing identity risk and maintaining regulatory compliance. These reviews were designed when most identity risks came from human users, who follow the “joiner, mover, leaver” pattern of access changes. Additionally, core business risks and functions were encapsulated within a single business application, allowing reviews to be scoped around individual applications.
Since then, the identity risk landscape has changed dramatically. Identities, entitlements, and risk span multiple, interconnected business applications, SaaS tools, and cloud environments. Additionally, the introduction of non-human identities (NHIs) and AI agents means that risks change continuously, as NHIs and AI agents can be deployed, assigned privileges, and retired within hours or days, rather than months or years.
Periodic reviews can keep up with human-centric identity risks, but they miss the larger picture. Risks can emerge and disappear between review cycles, and focusing on individual applications lacks the visibility and context required to truly understand business risk. Instead, organizations need continuous, contextual visibility and governance.
Why traditional access reviews can't keep up
Traditional certifications and access reviews were designed around a single-application, on-prem operating model. These reviews assumed that risks and SoD issues were largely static and contained within a single application or system’s entitlement list.
Modern identity risk spans multiple applications. These include business apps (Workday, Salesforce, etc.), SaaS, cloud infrastructure, hybrid identity systems, and interconnected platforms. Analyzing risk on a per-application basis overlooks these relationships and how access and risk accumulate across environments.
Identity and risk also evolve continuously and dynamically. AI agents and NHIs operate continuously and are granted access on an ad hoc, as-needed basis. As a result, organizations often have inadequate visibility into and ownership of these tools and the associated risks. Risks accumulate and expand exponentially as new access is granted and combines with existing entitlements.
Quarterly, per-application reviews don’t align to the reality of modern risk. These reviews provide a point-in-time view into the organization’s risk exposure that misses how access combines across the organization’s environment.
What reviewers are actually missing
Traditional access reviews and certifications often focus on entitlement lists. The purpose of these is to describe the access that human users, NHIs, and AI agents have.
However, there’s a significant difference between seeing an entitlement and understanding what it means and its impacts on the organization’s risk exposure. Without context, reviewers don’t know what the access enables and why it matters for the business.
Traditional approaches to access reviews fall short for several reasons, including:
- Cross-Application SoD Conflicts: No single system shows how access in one app combines with access in another to create SoD conflicts.
- Toxic Entitlement Combinations: Entitlements that are individually logical and safe may combine into risky pairings that only become visible when correlated across platforms.
- Standing Privileged Access: Persistent elevated access that isn't flagged because it's "always been there."
- Dormant or Unused Access: Access reviews don’t include usage data, so stale entitlements and dormant accounts are overlooked.
- Sensitive Business Entitlements: Access to critical financial, HR, or customer data and business-critical actions, such as executing sensitive transactions or business processes, buried in generic role names.
- Non-Human Identities: Service accounts, API integrations, and system-to-system access that don’t fit the model of traditional, human-centric review workflows.
- AI-Driven Identities: Autonomous AI agents and AI-powered workflows are a growing category without established governance patterns.
Traditional access reviews are often focused on individual apps and their associated permissions. However, business and application context is essential to understanding risk exposure.
Why organizations keep seeing the same audit findings
Many organizations find themselves completing audits and seeing the same findings and gaps over and over again. The reason for this is the difference between completing a governance process and actually reducing the organization’s risk exposure. A completed certification can create confidence that access risks have been addressed, when all it really means is that the required review process was completed.
Organizations can successfully execute certifications and still have the same findings resurface because the process only addresses the risks it can see. If visibility remains fragmented by application and lacks the context to identify cross-application and systemic risk, completing more reviews doesn't necessarily address the underlying exposure. Per-application reviews miss identity risks that span multiple platforms and overlook systemic and underlying risks within the organization’s environment.
These visibility gaps create significant security gaps for the organization. Common audit findings, such as toxic combinations, dormant accounts, and SoD conflicts, resurface because they were never actually visible in the first place. Reviewers simply can’t find gaps where they lack the required visibility and business context.
Modern governance requires better decisions — not more reviews
Periodic reviews are too slow to catch many business risks since the growth of NHIs and AI agents means that privileges can evolve in seconds or minutes. However, increasing review cadence won’t help since periodic reviews will never occur often enough to catch these evolving threats, and a lack of business context will always produce poor results.
Instead, companies need continuous visibility into identity and access across multiple applications, as well as an understanding of the business impacts of that access. This requires access to usage data, cross-application correlation, business criticality, and identity type (human, non-human, or AI).
Organizations should focus on achieving the visibility and control needed to govern risk effectively. This moves the focus to actual risk management rather than more certifications and entitlement checklists. With an ongoing, operational understanding of identity, access, and risk, organizations can make periodic or event-driven certifications more intelligent and risk-based.
Organizations need reviews informed by continuous visibility
Access reviews are failing because legacy processes weren’t designed to see and address modern risk. These reviews are periodic and focus on risks within individual apps. However, modern risk is cross-application and constantly evolving.
Companies need continuous, contextual visibility to actually effectively manage and reduce risk, rather than just checking the box for periodic certifications. To learn more about building a continuous governance model for identity risk, check out our eBook, Why Application Access Governance Is at an Inflection Point.
Back to Blog
