When people picture a security incident, they picture an attacker. Most of the time the real opening was quieter: access that got granted without a standard, or never taken away when it should have been.
Both come from the same place. Not carelessness, and not a missing tool. A missing procedure.
The grant you never standardized
When there’s no written standard for what access a role gets, people improvise. They copy someone else’s permissions, or grant a little extra “just in case,” because it’s faster than working out the minimum. Multiply that across a team over a few years and you get accounts carrying far more access than the work needs.
Microsoft found identities use about 1% of the permissions they’re granted. The other 99% just sits there, and every bit of it is attack surface. It’s also what turns a routine access review into a failed one. You can’t justify access nobody decided on.
The access you forgot to remove
The other half is worse, because it’s invisible. Someone changes roles, or leaves, and their access stays behind. No standard offboarding procedure means it gets done from memory, and memory misses things.
Varonis found 88% of organizations have ghost users, accounts still live after the person is gone. And in one survey, 58% of former employees said they could still log into a past employer’s systems after leaving. That’s not a sophisticated breach. That’s a door left open.
The fix isn’t a product. It’s a procedure.
You don’t close these gaps by buying another tool. You close them by writing down how access actually gets granted and removed, as a procedure anyone can follow the same way every time. What a role gets on day one. What happens the day someone changes teams. What happens the hour they leave.
When that procedure exists and gets followed, over-provisioning stops piling up and access doesn’t outlive the person. Your access reviews get boring, which is exactly what you want from an access review.
Fewer open doors. Cleaner audits. A lot less of the quiet risk that doesn’t show up until it does.