Award finalist interviews are usually treated as industry colour rather than substantive commentary, but they often surface the operational realities that vendor marketing avoids. The security leader’s observations on the identity estate point to a consistent theme across mid-market and enterprise deployments: the technical controls have matured faster than the organisational discipline needed to operate them, and identity governance is where that imbalance shows up most clearly.
The core problem is one of ownership rather than tooling. Most organisations now have, or can buy, a platform capable of certifying access, detecting separation of duties conflicts and modelling role hierarchies. What they frequently lack is the institutional habit of treating entitlement decisions as business decisions with named accountable owners. When access review becomes an administrative task delegated to whoever has capacity, the output is a certification record that satisfies an auditor without materially reducing risk. The control exists on paper and is inert in practice.
Saviynt’s positioning in this space has leaned heavily into the argument that identity governance must be continuous rather than periodic, and that framing is worth examining on its own merits rather than as vendor messaging. The periodic model assumes that access changes slowly enough for a quarterly or annual review to be a meaningful safeguard. That assumption held when entitlements changed mainly at hire, transfer and termination. It does not hold in environments where cloud roles are created by engineering teams during a deployment sprint, where API credentials are issued by automated pipelines, and where AI agents are granted delegated authority to act on a user’s behalf.
Identity lifecycle management is the discipline that most often gets partially implemented. Organisations frequently automate the joiner and leaver paths because they are well understood, then leave mover processes largely manual. The consequence is that internal role changes, which are often the largest single source of entitlement drift, are handled inconsistently. A person who moves between departments may retain access from their previous role for months, and no automated control flags the discrepancy because no ticket was raised. Solving this requires the HR feed, the directory and the application entitlement layer to agree on a single definition of a role change, which is more an integration and data modelling problem than a product selection problem.
Non-human identities expose the limits of the review model. Service accounts, integration credentials, CI/CD tokens and workload identities typically do not have a manager, do not receive training, and are not subject to the same joiner and leaver events as employees. Yet they often hold broad standing privileges because they were provisioned to make an integration work. Governance teams report that a substantial share of these identities have no identifiable owner, which means no reviewer is accountable when certification time arrives. The practical fix is to attach ownership at creation, enforced through the provisioning workflow, rather than attempting to reconstruct it later through discovery alone.
Access reviews need to produce decisions, not records. A certification campaign that closes with a high approval rate and no remediation activity is a warning sign rather than a success metric. Effective programmes track what proportion of reviewed entitlements resulted in a removal, a role change or a compensating control, and they route the exceptions explicitly. Reviewers who approve everything are typically reviewers who lack the context to judge, which points back to the ownership problem.
Executive sponsorship has to be operational, not ceremonial. The organisations that sustain identity governance investment tend to have a business owner, not only a security sponsor, who is accountable for access accuracy in their function. That accountability is what makes review outcomes actionable, because it gives the reviewer a stake in the result rather than a compliance obligation to clear a queue. Without it, the programme will continue to generate documentation that describes the estate without changing it.