TL;DR: Only 14% of companies say they have the talent and resources they need to meet security goals in 2025, according to Imprivata, as teams absorb more cloud complexity, burnout, and response pressure while trying to scale protection. The real shift is toward automation, managed services, and IAM controls that reduce operational load without weakening access governance.
At a glance
What this is: This article argues that cybersecurity skills shortages are accelerating interest in automation, managed services, and IAM controls that reduce manual work while preserving access governance.
Why it matters: It matters because IAM teams now have to scale access, authentication, and support functions with fewer people, making operational efficiency part of governance rather than a separate IT concern.
Context
The primary problem here is not a lack of tools but a mismatch between the pace of digital change and the human capacity to operate security programmes. When cloud environments expand and response demand rises, manual IAM work becomes a bottleneck that increases burnout, slows remediation, and leaves access governance exposed to inconsistency.
For IAM practitioners, the article sits at the intersection of identity operations and security staffing. It frames automation and managed services as ways to preserve control quality while reducing help-desk load, which is especially relevant where password resets, authentication support, and routine access work consume scarce security time.
Key questions
Q: How can IAM teams reduce manual work without weakening controls?
A: They should automate lifecycle events, connect access decisions to authoritative data, and measure actual remediation rather than ticket closure. The goal is not fewer controls, but fewer manual handoffs that delay provisioning and revocation. Strong automation should shorten exposure windows while preserving traceability.
Q: Why do cybersecurity skills shortages increase IAM risk?
A: Shortages increase IAM risk because identity controls still need timely execution, but there are fewer people to carry out resets, provisioning, reviews, and exception handling. As queues grow, organisations become more likely to delay access changes, rely on manual workarounds, or miss monitoring signals.
Q: What breaks when access requests and password resets stay manual?
A: Manual handling breaks first at scale, where teams face queue buildup, inconsistent response times, and growing support demand. It also makes it harder to maintain evidence, exception tracking, and timely approvals. The result is an identity operation that reacts too slowly to protect the organisation effectively.
Q: When should organisations use managed services in identity security?
A: Use managed services when internal teams need repeatable operational support and the work can be measured, audited, and governed. They are most suitable for sustained lifecycle tasks, platform administration, and support functions that do not require constant strategic judgement from the enterprise itself.
Technical breakdown
Why IAM operations break under sustained staffing pressure
Cybersecurity skills shortages become an identity problem when routine access work consumes the time needed for governance, response, and exception handling. Password resets, account recovery, and repetitive approvals are low-complexity individually, but at scale they create queueing, delays, and inconsistent decisions. That inconsistency is where risk enters: if access work is slow, teams create workarounds; if it is manual, teams cannot sustain review quality under pressure. Automation changes the operating model by removing volume from human queues, not by eliminating governance responsibility. The key question is whether the IAM process still produces consistent, traceable decisions when people are overloaded.
Practical implication: Measure which IAM tasks are absorbing the most analyst time and move the highest-volume, lowest-risk work into controlled automation first.
Managed services as an operating control, not a staffing shortcut
Managed security services can absorb monitoring and operational repetition, but they only help when the division of responsibility is clear. In IAM, outsourcing can improve coverage for after-hours operations, routine response, and specialised tuning, yet it also introduces dependency on third-party process discipline. The governance issue is no longer simply who performs the task, but how decision rights, escalation paths, and evidence are retained. If the external service is faster but opaque, the programme may gain throughput while losing auditability. The article’s point is that managed services should augment identity operations, not create a second shadow governance layer.
Practical implication: Define which IAM activities may be outsourced, which approvals remain internal, and what evidence the service must retain for reviews and investigations.
Passwordless authentication and automation reduce load by design
Passwordless authentication and automated routine tasks reduce operational load because they remove recurring user support and credential maintenance from the workflow. That matters in a skills-constrained environment because help-desk effort is often consumed by authentication friction rather than true security work. The deeper value is not convenience alone. Fewer password resets mean fewer opportunities for weak recovery processes, repeated exceptions, and support-driven access shortcuts. In practice, the automation story is strongest where the control lowers both user friction and administrative burden at the same time, while keeping identity assurance intact.
Practical implication: Prioritise authentication changes that lower support demand and reduce recovery risk without creating new exception paths.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Automation is becoming an identity governance requirement, not just an efficiency play. The article reflects a programme reality that many teams already feel: when staffing cannot keep up with access demand, governance quality degrades first. That makes automation part of control design, because repeatable identity tasks are the only way to preserve consistency when headcount does not scale. The implication is that IAM maturity now depends on operational resilience, not just policy intent.
Managed services change the boundary of accountability, but they do not remove it. Outsourcing can absorb 24/7 monitoring and routine execution, yet the organisation still owns access decisions, evidence quality, and exception handling. That means the real governance question is not whether to outsource, but which identity functions can move outside the internal team without weakening traceability. Practitioner teams should treat service design as part of access governance, not a separate procurement exercise.
Passwordless and workflow automation are the clearest examples of control quality improving as labour demand falls. The strongest automation use cases are the ones that reduce both human effort and identity risk, especially where password resets, recovery workflows, and repetitive approvals create avoidable noise. This is where IAM stops being a support queue and starts acting as a force multiplier for scarce security staff.
Cybersecurity skills gaps expose the limits of people-centric control models. The industry still behaves as if more review volume can be solved by more review labour, but that assumption breaks under sustained cloud and identity pressure. The practical conclusion is that teams must evaluate controls by how well they scale under staffing constraints, not only by how they perform in steady state.
What this signals
Operational scale is now part of identity governance. Teams that cannot reduce manual IAM workload will keep turning staffing shortages into control inconsistency, especially where approvals and support tasks dominate day-to-day effort. The programme question is no longer whether automation is convenient, but whether the identity function can remain reliable under sustained pressure.
Managed services only help when accountability stays visible. Delegating monitoring or support can buy capacity, but the organisation still has to own policy, evidence, and escalation. Without that boundary, the team gains throughput while losing the assurance trail that IAM and audit functions depend on.
For practitioners
- Automate high-volume IAM tasks Target password resets, routine access requests, and other repeatable IAM workflows that consume disproportionate analyst and help-desk time. The goal is to remove avoidable operational load while keeping approvals, logging, and exception handling under policy control.
- Define outsourcing boundaries for identity operations Specify which monitoring, response, and support functions a managed service may execute, and retain internal ownership for access policy, escalation, and evidence review. Use a written responsibility model so the outsourced layer does not become an accountability gap.
- Prioritise passwordless access where support demand is highest Use passwordless authentication to cut authentication friction in user groups that drive repeated resets and recovery tickets. Focus on the areas where support burden and user friction are both materially affecting security operations.
- Track governance quality under staffing pressure Review whether approval times, exception rates, and access review completion stay stable when teams are short-staffed or overloaded. If those measures degrade, the control model is too dependent on manual labour.
Key takeaways
- Cybersecurity skills shortages are pushing IAM teams toward automation because manual identity work does not scale cleanly under cloud growth and response pressure.
- Managed services can absorb repetitive operational load, but they only strengthen governance when accountability and evidence stay clearly assigned.
- Passwordless authentication and workflow automation matter most when they reduce both help-desk burden and identity risk at the same time.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RR-01 — Roles, Responsibilities, and Authorities | The article is fundamentally about staffing, operating model, and responsibility under pressure. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | IAM automation directly affects how access requests and approvals are governed. | |
| Recommendation — Clarify who owns identity decisions and which tasks may be automated or outsourced without losing accountability. Automate entitlement handling only where authorisation logic remains documented, traceable, and policy-bound. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Password resets and passwordless adoption make credential lifecycle control central to the article. |
| AC-6 — Least Privilege | Reduced manual handling should preserve least-privilege decision quality while scaling operations. | |
| Recommendation — Use authenticator management controls to reduce reset volume and tighten identity support workflows. Keep least-privilege enforcement in place as identity workflows move into automation or managed services. | ||
| CIS Controls v8 | CIS-5 — Account Management | The topic centres on operational account and access handling at scale. |
| Recommendation — Standardise account lifecycle handling so repetitive IAM work can be automated without losing control. | ||
Key terms
- IAM Automation: IAM automation is the use of software to carry out identity and access tasks with minimal manual intervention. It is commonly applied to provisioning, de-provisioning, entitlement changes, and access review workflows so organizations can reduce delays, improve consistency, and support governance with less operational burden.
- Managed Security Service: A managed security service is an externally operated service that takes on defined security tasks such as monitoring, tuning, investigation, or remediation support. In data security, it can help organisations sustain coverage, respond faster, and reduce operational strain when internal teams lack time or specialist capacity.
- Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org