TL;DR: Security teams are operating with a widening capacity gap, and Imprivata cites recent research showing that only 14% of companies say they have the talent and resources needed to meet their security goals. The practical answer is not simply more headcount, but tighter use of managed services, identity automation, and passwordless access to reduce toil and protect overstretched teams.
At a glance
What this is: This is a view of how cybersecurity skills shortages are changing IAM priorities, with automation, managed services, and passwordless access framed as ways to absorb operational pressure.
Why it matters: It matters because IAM teams cannot treat staffing gaps as a temporary inconvenience when access workflows, help-desk load, and incident response all degrade under shortage conditions.
Context
Cybersecurity skills shortages are no longer just a resourcing problem. They change how identity programmes are run, because the work of resets, approvals, access maintenance, and monitoring still has to happen even when teams are thin.
In that environment, IAM becomes a pressure-release mechanism for the wider security programme. The article frames automation, managed services, and passwordless access as ways to reduce repetitive work while keeping access governance under control.
Key questions
Q: How should security teams reduce identity workload when staffing is limited?
A: They should automate repetitive identity tasks first, then delegate bounded operational work to managed services where runbooks and escalation paths are explicit. The goal is to reduce manual handling without losing auditability or ownership. Teams should focus on high-volume work such as resets, fulfilment, and monitoring before trying to automate complex exceptions.
Q: Why do cybersecurity skills shortages increase IAM risk?
A: Shortages increase IAM risk because identity controls still need timely execution, but there are fewer people to carry out resets, provisioning, reviews, and exception handling. As queues grow, organisations become more likely to delay access changes, rely on manual workarounds, or miss monitoring signals.
Q: What are the signs that identity processes are becoming unsustainable?
A: Common signs include rising ticket backlogs, longer turnaround times for access requests, more exception handling, and repeated dependence on the help desk for password recovery. Those signals show that identity work is consuming capacity faster than the programme can replenish it.
Q: Should organisations outsource IAM operations or keep them in house?
A: Outsourcing makes sense when it adds specialist coverage or continuous monitoring that internal teams cannot sustain alone. It becomes a problem when it blurs accountability, hides decision ownership, or leaves escalation paths undefined. The right model preserves internal governance even when operations are augmented externally.
Technical breakdown
Why IAM automation absorbs security team strain
IAM automation reduces the amount of manual work needed for routine identity operations such as password resets, access provisioning, and access removal. In practice, that shifts repetitive administrative burden away from scarce staff and toward policy-driven workflows, which lowers the chance that routine requests become backlogs or are handled inconsistently. The key point is not speed alone. It is that access operations become repeatable enough to survive staffing pressure without turning into an ad hoc service desk process.
Practical implication: automate the identity tasks that create the most human toil before shortages turn them into control gaps.
How passwordless access changes the help-desk load
Passwordless authentication reduces reliance on passwords, which are still a major source of resets, lockouts, and support tickets. For human identity programmes, that matters because every password-related issue consumes time from both users and support staff, while also introducing weak-workaround behaviour. Passwordless does not remove governance requirements, but it does reduce one of the most expensive sources of friction in access delivery. In a shortage environment, that can free capacity for higher-value security work.
Practical implication: prioritise passwordless for user groups where resets and lockouts are driving avoidable support volume.
Why managed services change the operating model
Managed security services add specialist coverage and continuous monitoring when internal teams cannot staff every function in-house. That is especially relevant where the security programme needs consistent execution across identity operations, incident triage, and monitoring but lacks enough people to do it all internally. The trade-off is governance, not just coverage. Organisations still need clear ownership, scope boundaries, and escalation paths so that outsourced operations do not become opaque or detached from internal control.
Practical implication: define which IAM and monitoring functions can be outsourced without weakening ownership, review, or escalation.
NHI Mgmt Group analysis
Identity automation is becoming a capacity control, not just an efficiency play. The article reflects a broader operational reality: when teams are understaffed, manual identity work becomes a security risk because delayed resets, provisioning mistakes, and incomplete access maintenance accumulate. In NHI and human IAM alike, automation now functions as a control that preserves consistency when human capacity is the constraint. The practical takeaway is that organisations should evaluate IAM automation by how much operational risk it removes, not only by how many hours it saves.
Passwordless access is a workload reduction strategy with governance value. Password-related support demand is not just user friction. It is security labour that competes with monitoring, access review, and incident response. Replacing password dependence with stronger authentication paths can reduce avoidable operational churn and let scarce staff focus on exceptions rather than routine recovery. The implication for practitioners is that authentication design should be judged partly by support burden and response capacity.
Managed services are most defensible when they augment, not obscure, accountability. The article's outsourcing argument is directionally sound, but identity operations cannot be delegated without clear decision rights, service boundaries, and escalation ownership. The risk is not outsourcing itself; it is losing visibility into who controls what, especially when access and monitoring are handled externally. Practitioners should treat managed services as an extension of governance, not a substitute for it.
Cybersecurity skills shortages expose a broader identity operating model problem. Organisations that rely on ad hoc manual work are already operating beyond sustainable capacity, and identity control quality will fall first where staff are stretched thinnest. That makes IAM maturity a resilience issue, not a tooling preference. The field should read this as confirmation that access governance must be designed for low-touch execution and measurable control consistency.
Tool quality matters more when headcount is scarce. The article points toward a future in which the effectiveness of identity workflows, not just team size, determines whether security operations scale. That is true across human IAM, NHI governance, and emerging agentic environments. Practitioners should reassess whether current controls are built for steady-state staffing or for sustained operational pressure.
What this signals
Identity automation is becoming a resilience requirement, not an optimisation project. When security teams are understaffed, manual access work is one of the first places control quality degrades. Organisations need to judge automation by whether it keeps identity decisions consistent under pressure, not by whether it simply removes tickets.
Passwordless access helps capacity planning as much as user experience. Every reset avoided is time returned to higher-value security work, which matters when the same staff must also handle monitoring, approvals, and incident response. For identity programmes, friction reduction and operational resilience are now the same conversation.
For practitioners
- Automate the highest-volume identity tasks Target password resets, access provisioning, and access removal first, because those workflows consume the most scarce operational time and create the most visible support burden.
- Adopt passwordless where support load is highest Prioritise user groups with frequent lockouts, reset demand, or recurring authentication friction so identity operations stop spending staff time on repetitive recovery work.
- Define what managed services may own Set explicit boundaries for monitoring, triage, and routine IAM administration so outsourcing expands capacity without diluting internal control or escalation ownership.
- Measure IAM by operational resilience Track the backlog, turnaround, and exception rate for identity work, then use those signals to decide whether automation or service augmentation is actually reducing strain.
Key takeaways
- Cybersecurity skills shortages affect identity governance directly because routine IAM tasks still need timely execution even when staff are stretched thin.
- The article points to automation, passwordless access, and managed services as the main levers for reducing toil and preserving security capacity.
- Practitioners should measure identity programmes by whether they reduce operational strain without weakening control ownership or escalation clarity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0, NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Password resets and authentication workload are central to the article's IAM efficiency argument. |
| Recommendation — Automate authenticator lifecycle tasks to reduce help-desk load and preserve control consistency. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about maintaining access operations when staffing is constrained. |
| Recommendation — Use PR.AA-05 to standardise access administration so shortages do not create inconsistent entitlement handling. | ||
| NIST SP 800-63 | SP 800-63B — Authentication | Passwordless authentication is directly relevant to the article's access and support burden theme. |
| Recommendation — Apply strong authentication design to cut password dependence and reduce repetitive recovery work. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centres on managing access operations efficiently under resource pressure. |
| Recommendation — Use CIS-5 to formalise account lifecycle handling and reduce manual account administration. | ||
Key terms
- Identity automation: Identity automation is the use of rule-based workflows to carry out provisioning, revocation, reviews, and notifications when a trusted source system changes. It reduces manual effort, but its assurance depends on accurate triggers, stable entitlements, and clear exception handling.
- Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
- Managed Security Service: A managed security service is an externally operated service that takes on defined security tasks such as monitoring, tuning, investigation, or remediation support. In data security, it can help organisations sustain coverage, respond faster, and reduce operational strain when internal teams lack time or specialist capacity.
- Operational Resilience: Operational resilience is the ability to keep critical services running or recover them quickly after disruption. In identity-led environments, that depends on authentication services, privilege management, and recovery procedures that can be tested under realistic failure conditions.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 24, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org