ROI-focused IAM security gaps are creating avoidable cyber risk

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Imprivata's blog post: ROI pressure is shaping cybersecurity spending, and poorly integrated IAM can become both an efficiency drag and a security exposure.

Why it matters: For IAM, IGA, PAM, and identity architects, the core issue is that usability failures often produce the very risky behaviours teams are trying to prevent, including credential sharing and policy bypass.

Context

Cybersecurity budget pressure is changing how organisations judge access controls: if IAM slows people down, users will often route around it. The article frames that tension as a governance problem, not a user-behaviour problem, because the control design itself can create shadow practices that weaken security.

The article also ties the issue to broader identity programme design across hybrid work and cloud access. The practical question is no longer whether IAM exists, but whether it is integrated well enough to support secure workflows without pushing users toward passwords, shared credentials, or manual exceptions.

Key questions

Q: How should security teams reduce IAM friction without weakening control?

A: Start by identifying the access paths that users bypass most often, then redesign those steps so they fit the actual workflow. The goal is not to remove verification, but to place it where it changes risk. If controls are too slow or disruptive, users will create shadow practices that reduce both security and visibility.

Q: Why do inefficient access workflows increase cyber risk?

A: Because users will route around controls that slow them down or interrupt work. When that happens, organisations lose accountability and create access paths that are harder to monitor, recertify, and revoke. Inefficiency becomes a risk multiplier when it pushes people into unmanaged identity behaviour.

Q: What do security teams get wrong about IAM and user experience?

A: Many teams treat IAM friction as an acceptable cost of security, but repeated login prompts, failed MFA, and password resets directly damage trust and adoption. Poor access design can reduce conversions and loyalty for customers, while also increasing support load internally. Good IAM balances strong authentication with smoother journeys through SSO, adaptive MFA, and passwordless access.

Q: How do organisations know whether IAM is actually reducing risk?

A: IAM is working when access is both current and explainable. That means fewer stale entitlements, faster revocation after lifecycle change, clearer ownership for each privilege set, and access reviews that remove rather than rubber-stamp permissions. If those signals are weak, the IAM programme is mostly administrative, not security-driving.

Technical breakdown

Why IAM friction creates shadow access paths

IAM friction changes how access is actually consumed. When login flows, approvals, or session handoffs are slow or inconsistent, users search for a faster path, which often means password sharing, shared accounts, or manual exceptions. Those behaviours are not just convenience issues. They break accountability, weaken auditability, and create access paths that are invisible to policy design. In identity terms, the control still exists on paper, but the operational state no longer matches the governed state. That is why usability is part of access security, not a separate optimisation problem.

Practical implication: treat user friction as an access-risk signal and map where workarounds are replacing governed authentication or authorisation.

Zero trust and continuous authentication in IAM design

The article points to zero trust and continuous authentication as the design direction for balancing security and efficiency. Zero trust assumes access should not be granted once and trusted indefinitely. Continuous authentication extends that idea by re-evaluating trust during the session, which is useful when users move between devices, networks, and applications in hybrid environments. For IAM programmes, this matters because static session assumptions fail when work is distributed and context changes quickly. The architecture has to preserve security without forcing repeated hard stops that users will bypass.

Practical implication: align authentication policy, session risk, and workflow context so step-up controls are proportional rather than disruptive.

ROI pressure is becoming an identity governance test

Budget scrutiny is pushing organisations to justify identity controls in business terms, but the real test is whether the control reduces both risk and workarounds. IAM that improves efficiency can strengthen security by reducing unmanaged exceptions, while IAM that only enforces policy can create hidden process debt. The article’s underlying point is that ROI in identity is not just cost takeout. It is the combined effect of fewer manual interventions, fewer risky user behaviours, and better resilience under operational pressure. That makes identity programme design a governance decision, not just a tooling decision.

Practical implication: evaluate IAM investments against both workflow efficiency and the reduction of compensating behaviours that create exposure.

NHI Mgmt Group analysis

Identity friction is a security control failure, not an acceptable trade-off. When users cannot move through access workflows cleanly, they create their own control plane through sharing, shortcuts, and exception handling. Those behaviours are predictable governance outcomes, not accidental misuse. The implication for practitioners is that access design must be measured by the workarounds it suppresses, not only by the policies it enforces.

ROI pressure is exposing the hidden cost of bad access design. Organisations that treat IAM only as a compliance layer miss the operational debt created by slow approvals, repeated logins, and inconsistent user journeys. That debt eventually shows up as support load, policy bypass, and weaker control adoption. The practitioner lesson is that access governance must be justified as an operating model, not just a security expense.

Zero trust only works when the identity experience is usable enough to sustain it. If continuous verification adds too much friction, users will route around it and the architecture loses integrity. That tension means modern IAM should be judged on whether it preserves governed access without forcing shadow practices. The practitioner conclusion is to design for resilience in the real workflow, not the ideal one.

Identity blast radius is often created by operational convenience. Shared credentials, broad exceptions, and manual access paths expand the number of users or processes that can misuse the same access. This is where IAM, PAM, and workforce productivity intersect: every shortcut increases the chance that one compromise or one mistake can cascade. Practitioners should treat convenience-driven access expansion as a governance signal, not a productivity win.

What this signals

Identity experience is now a governance control. When access is clumsy, users create shadow workarounds that undermine policy, accountability, and revocation. IAM teams should therefore measure friction as a leading indicator of control failure rather than treating it as a help-desk issue.

Secure-by-design IAM has to absorb ROI pressure. Budget scrutiny will keep favouring controls that demonstrate both risk reduction and operational efficiency, so identity leaders need to show that well-designed access reduces exceptions instead of creating them.

For practitioners

• Measure access friction as a security metric Track login failures, repeated prompts, approval delays, and manual exception requests alongside traditional security KPIs. Those signals reveal where users are most likely to create unsafe workarounds.
• Remove the need for credential sharing Identify workflows that still depend on shared passwords, shared accounts, or out-of-band handoffs, then redesign them so access is individual, auditable, and session-specific.
• Tune continuous authentication to workflow context Apply step-up checks where risk changes, not at every interaction. The goal is to preserve governed access while reducing the friction that drives users toward bypasses.
• Review IAM ROI through control adoption Assess whether an IAM change reduces help desk load, manual approvals, and policy exceptions, not just whether it satisfies a security requirement.

Key takeaways

• Poor IAM design can become a source of cyber risk when users compensate for friction with password sharing, manual exceptions, and other workarounds.
• The central evidence in this article is budget pressure, with cybersecurity spending up only 4% in 2025 and 61% of CIOs saying proving ROI is very challenging.
• Identity programmes need to be judged by whether they preserve secure workflows and reduce compensating behaviours, not by enforcement alone.

Key terms

• Identity Friction: The operational drag created when access controls slow work enough that users look for shortcuts. In practice, it is a governance signal, because repeated friction usually produces credential sharing, informal exceptions, and weaker audit evidence even when the formal policy looks sound.
• Shadow Access: Shadow access is unauthorised or unmanaged access that continues to exist because a credential, role, or account was forgotten, reused, or never properly revoked. In NHI programmes, shadow access is especially dangerous because it can remain active across cloud, SaaS, and automation layers without obvious human ownership.
• Continuous authentication: A model where access is re-evaluated after the initial login instead of being trusted for the full session. It uses live signals such as posture, telemetry, and policy to detect when a session should be stepped up, constrained, or revoked.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.