Why do identity security programmes struggle to gain traction with admins and business users even when the risk is clear?

Adoption usually fails when security requirements feel disconnected from daily work. If controls slow administrators down or add complexity without obvious benefit, people resist them or create shadow processes. Strong programmes link policy to operational efficiency, explain the risk in practical terms, and make secure behaviour the easiest path for routine tasks.

Why This Matters for Security Teams

identity security programmes lose traction when they are experienced as friction instead of enablement. Admins want to complete routine work quickly, and business users care about getting access that fits how they actually operate. If governance only shows up as extra approvals, confusing exceptions, or slower provisioning, people route around it. That creates shadow processes, unreviewed access, and stale credentials that never get cleaned up.

The problem is not usually awareness. Most teams already understand that identity risk is real. The gap is translation: policy language does not always map to daily tasks, and controls are often designed around audit requirements rather than operational reality. NIST’s Cybersecurity Framework 2.0 and SP 800-53 Rev. 5 both reinforce that access governance must be usable, measurable, and tied to business outcomes. NHIMG’s Ultimate Guide to NHIs shows why this matters in practice: NHIs outnumber human identities by 25x to 50x, so even small usability problems scale quickly.

In practice, many security teams encounter resistance only after users have already built workarounds that are harder to unwind than the original control.

How It Works in Practice

Adoption improves when identity controls reduce effort in the exact workflows people use every day. That means security teams need to design for speed, clarity, and repeatability, not just enforcement. The strongest programmes embed policy into the tools administrators already use, automate low-risk approvals, and reserve manual review for edge cases that truly need judgement. For business users, the experience should feel like faster access with fewer surprises, not a gate that appears after work has already started.

For admins, the operational win usually comes from removing repetitive work: automated joiner-mover-leaver flows, role templates, time-bound elevation, and clearer ownership for exceptions. For business users, the win is shorter wait time, fewer tickets, and access that expires when it is no longer needed. NHIMG’s Key Challenges and Risks section is a useful reminder that unmanaged secrets, over-privileged accounts, and poor visibility are not abstract concerns; they are operational failure points. The wider research base also shows how hard this becomes at scale, with only 1.5 out of 10 organisations highly confident in securing NHIs.

• Make policy decisions at request time, not months earlier in a static spreadsheet.
• Use role design that matches actual job functions and service ownership, then review it regularly.
• Shorten exception paths so users do not create shadow access just to keep work moving.
• Show users what changed, why it changed, and who approved it.

Current guidance suggests that identity programmes work best when controls are embedded into operational systems rather than bolted onto the side of them. These controls tend to break down when approvals are disconnected from real workflows, because users treat them as delay rather than protection.

Common Variations and Edge Cases

Tighter identity control often increases administrative overhead, so organisations have to balance assurance against day-to-day throughput. That tradeoff becomes visible in teams with high-change environments, shared service accounts, or frequent vendor access, where strict approvals can slow delivery enough that staff begin to bypass official processes. The practical answer is not to remove control, but to calibrate it.

Best practice is evolving toward risk-based friction: stronger checks for privileged actions, lighter-touch controls for routine low-risk access, and more automation where the business impact is predictable. In some environments, such as DevOps pipelines or finance close periods, users need access that is both rapid and auditable. In others, like third-party support access, the bigger issue is short-lived authorization and strong logging. NHIMG’s Top 10 NHI Issues and the 52 NHI Breaches Analysis both reinforce the same pattern: identity controls fail most often where ownership is unclear and access outlives the task.

There is no universal standard for perfect adoption measurement yet, but teams should watch for ticket volume, exception growth, overdue reviews, and repeated manual overrides. If those numbers rise while users complain about “security getting in the way,” the programme is probably optimising for compliance optics instead of secure usability.

Related resources from NHI Mgmt Group

• Why do low maturity identity programmes struggle to deliver consistent security and business value?
• Why do business applications create hidden identity risk even when perimeter security is strong?
• What breaks when identity security only covers a portion of users and non-human identities?
• Who should be accountable for moving identity security from tactical projects to a business programme?