According to the 2025 State of IGA Report, 91% of organizations report that the scope of their access reviews has increased over the past three years, while 84% expect that growth to continue. Source: https://zillasecurity.com/wp-content/uploads/Zilla-Security-2025-State-of-IGA-Report.pdf
Those numbers confirm what many security leaders, auditors, compliance professionals, and IT teams are already experiencing firsthand. Identity governance is becoming more difficult, not less. Every new SaaS application, cloud platform, contractor relationship, business process, service account, and AI-enabled system introduces additional permissions that must be reviewed, certified, and governed.
Yet while the volume of access requiring oversight continues to expand, identity governance maturity often fails to keep pace. Organizations are conducting more reviews, collecting more evidence, and supporting more compliance frameworks than ever before, but many still rely on manual processes to manage increasingly complex identity environments.
The result is a growing challenge that many organizations have not fully recognized: the Identity Compliance Gap.
More Applications Mean More Access Reviews
The average organization today manages significantly more applications than it did just a few years ago. Cloud adoption, SaaS expansion, mergers and acquisitions, remote work, third-party relationships, and digital transformation initiatives have all contributed to an explosion of identities and permissions.
Every new application creates new questions that compliance and security teams must answer:
- Who has access?
- Should they still have access?
- Is the access appropriate for their role?
- Can the organization prove that access was reviewed?
The compliance requirements themselves have not changed dramatically. Auditors are still asking organizations to demonstrate proper access governance, enforce least privilege, and periodically review user permissions. What has changed is the sheer number of systems, identities, and entitlements that now fall within the scope of those reviews.
That reality helps explain why 91% of organizations report increasing review scope. The challenge is no longer convincing organizations to perform access reviews. The challenge is keeping up with the expanding volume of access that requires review.
Organizations Are Doing the Reviews
One of the most encouraging findings in the industry is that organizations understand the importance of access governance.
According to CyberArk’s 2025 State of Identity Governance and Administration Survey Report, 99% of organizations conduct access reviews, and 55% support five or more compliance frameworks. Source: https://www.cyberark.com/resources/white-papers/2025-state-of-iga-survey-report-2
This demonstrates that access certifications and periodic reviews have become standard practice across most organizations. Security and compliance teams recognize that reviewing user access is essential for maintaining compliance with frameworks such as SOC 2, ISO 27001, HIPAA, PCI DSS, NIST, and CMMC.
The problem is not whether reviews are occurring.
The problem is how those reviews are being performed.
Most Organizations Still Depend on Manual Processes
While access reviews have become commonplace, automation remains surprisingly rare.
According to the same CyberArk report, only 6% of organizations have fully automated identity governance processes, while 84% continue to rely heavily on manual activities for access reviews and provisioning. Source: https://www.cyberark.com/resources/white-papers/2025-state-of-iga-survey-report-2
For many organizations, access reviews still involve spreadsheets, email approvals, screenshots, ticketing systems, exported reports, and manual evidence collection. These approaches may have worked when organizations managed a handful of applications and a limited number of users. They become increasingly difficult to sustain as environments grow.
As review scope expands, manual processes often expand with it. More applications create more reports. More users create more certifications. More systems create more evidence that must be collected and retained.
Organizations find themselves working harder simply to maintain the same level of compliance.
Access Reviews Continue to Uncover Risk
The growing workload would be easier to justify if access reviews consistently found no issues. The reality is quite the opposite.
According to reporting on the 2025 State of IGA Survey, 52% of organizations reported that more than 11% of reviewed entitlements were unnecessary, excessive, or otherwise inappropriate. Source: https://www.cybersecuritydive.com/spons/access-reviews-can-be-fixed-heres-how/746548/
This statistic highlights why access reviews remain one of the most important identity governance controls. Organizations continue to discover permissions that should not exist, including excessive access, inherited privileges, dormant entitlements, and permissions retained after role changes.
The reviews are producing value.
The concern is whether organizations can continue reviewing an ever-growing universe of permissions using processes that remain largely manual.
Role Management Remains a Major Obstacle
Compounding the problem is the ongoing challenge of role management.
According to the 2025 State of IGA Report, 90% of organizations struggle to define and maintain business roles effectively. Source: https://www.cyberark.com/press/zilla-securitys-2025-state-of-iga-report-uncovers-widespread-challenges-in-identity-governance/
Role management is one of the foundational elements of identity governance. When roles are poorly defined, organizations often provision access inconsistently, managers struggle to review permissions accurately, and least-privilege initiatives become difficult to enforce.
As identity environments grow, role complexity grows with them. What may have been manageable five years ago can quickly become difficult to govern across hundreds of applications and thousands of users.
The Identity Compliance Gap
Taken together, these findings reveal a troubling trend.
Organizations are performing more access reviews than ever before. They are supporting more compliance frameworks, managing more applications, reviewing more permissions, and collecting more audit evidence.
Yet they continue to face growing workloads, manual processes, inconsistent role definitions, and significant access-related findings during reviews.
The Identity Compliance Gap is the difference between the amount of compliance activity being performed and an organization’s ability to govern identity efficiently at scale.
For many organizations, that gap is widening.
The fact that 91% of organizations report increased access review scope suggests that the challenge is not temporary. Identity environments will continue to expand, and governance programs must evolve accordingly.
Why This Matters for the Future — And How YouAttest Can Help
Historically, identity governance was viewed primarily as a compliance requirement. Today, identity has become the control plane for modern business operations, determining what users, systems, and increasingly AI tools can access.
Every excessive permission, orphaned account, or unmanaged entitlement now represents operational, security, and compliance risk. As access review scope continues to grow, organizations need a scalable way to certify user access, collect audit evidence, and maintain continuous visibility into who has access to what.
The question is no longer whether access reviews are important. The question is whether organizations can continue managing exponentially growing review requirements using processes designed for a much smaller world.
YouAttest helps organizations automate user access reviews, simplify audit preparation, and strengthen identity governance. To learn more, visit:
Sources
- Zilla Security. 2025 State of IGA Report
https://zillasecurity.com/wp-content/uploads/Zilla-Security-2025-State-of-IGA-Report.pdf - CyberArk. 2025 State of Identity Governance and Administration Survey Report
https://www.cyberark.com/resources/white-papers/2025-state-of-iga-survey-report-2 - Cybersecurity Dive. Access Reviews Can Be Fixed — Here’s How
https://www.cybersecuritydive.com/spons/access-reviews-can-be-fixed-heres-how/746548/ - CyberArk. Zilla Security’s 2025 State of IGA Report Uncovers Widespread Challenges in Identity Governance
https://www.cyberark.com/press/zilla-securitys-2025-state-of-iga-report-uncovers-widespread-challenges-in-identity-governance/
- AI Agents Are Privileged Identities. Their Access Needs to Be Reviewed. - October 3, 2026
- AI Is the Unrealized Insider Threat: Why Enterprise AI Security Starts With Existing User Access - September 20, 2026
- The Service Account Wasn’t the Initial Breach. It Became Part of the Attack. - September 13, 2026
