Topic starter
25/06/2026 12:03 am
TL;DR: Password resets remain a major enterprise friction point, with analyst estimates often putting 20% to 50% of help desk calls in this category and each manual reset taking 10 to 20 minutes, according to Bravura Security. The real issue is not convenience but identity governance, because weak reset processes create audit gaps and social-engineering openings.
Editorial analysis by NHI Mgmt Group, based on content published by Bravura Security: “Why Enterprise Password Management Fails—and How to Fix It”.
Key questions
Q: What breaks when password resets are not centrally governed?
A: When reset workflows are fragmented, organisations lose consistent verification, auditability, and policy enforcement.
Q: Why do frequent password resets increase security risk?
A: Frequent resets increase risk because they encourage weak user behaviour such as password reuse, predictable patterns, and reliance on fallback channels.
Q: How do security teams know whether password reset controls are actually working?
A: They should test whether resets propagate to every dependent system, whether identity verification remains strong in fallback scenarios, and whether the full event can be reconstructed during review.
Practitioner guidance
- Map the reset workflow end to end Document every step from user lockout to access restoration, including identity proofing, approval, system update, and logging.
- Centralise proof of reset events Require one system of record for reset requests, approvals, verification evidence, and completion status.
- Reduce the number of manual exceptions Identify which accounts, applications, or legacy systems still force help desk intervention and prioritise them for self-service or policy-driven recovery.
Bottom line: Password reset breakdowns are a governance problem because they determine whether identity recovery remains auditable and consistent at enterprise scale.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:51 am
Password reset is an IAM control, not a support task: The process determines whether identity assurance survives a failed login. When reset handling sits outside formal governance, the organisation loses consistency, evidence, and policy enforcement. That is why reset breakdowns should be assessed as identity control failures, not just service desk inefficiency.
A few things that frame the scale:
- The average user manages 70 to 100 passwords, many of them outside centralised identity platforms.
A question worth separating out:
Q: What should organisations do when reset procedures depend on the help desk?
A: Organisations should move repetitive reset steps out of the help desk and into a policy-driven self-service flow backed by strong identity verification and central logging. The key test is whether the process remains secure and auditable when volume increases or when the request is adversarial.
👉 Read our full editorial: Password reset breakdowns expose the real enterprise IAM gap