Topic starter
25/06/2026 10:44 pm
TL;DR: Cybersecurity budgets rose only 4% in 2025, while 61% of CIOs said proving ROI is very challenging, according to Imprivata, and that pressure is pushing organisations toward efficiency-first spending that can expose weak IAM integrations, password sharing, and manual workarounds.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Experts Urge Shift Toward ROI-Focused Cyber Spending as IAM Gaps Introduce Security Risk and Inefficiencies”.
Key questions
Q: How should security teams reduce IAM friction without weakening control?
A: Start by identifying the access paths that users bypass most often, then redesign those steps so they fit the actual workflow.
Q: Why do inefficient access workflows increase cyber risk?
A: Because users will route around controls that slow them down or interrupt work.
Q: What do security teams get wrong about IAM and user experience?
A: Many teams treat IAM friction as an acceptable cost of security, but repeated login prompts, failed MFA, and password resets directly damage trust and adoption.
Practitioner guidance
- Measure access friction as a security metric Track login failures, repeated prompts, approval delays, and manual exception requests alongside traditional security KPIs.
- Remove the need for credential sharing Identify workflows that still depend on shared passwords, shared accounts, or out-of-band handoffs, then redesign them so access is individual, auditable, and session-specific.
- Tune continuous authentication to workflow context Apply step-up checks where risk changes, not at every interaction.
Bottom line: Poor IAM design can become a source of cyber risk when users compensate for friction with password sharing, manual exceptions, and other workarounds.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 11:25 pm
Identity friction is a security control failure, not an acceptable trade-off. When users cannot move through access workflows cleanly, they create their own control plane through sharing, shortcuts, and exception handling. Those behaviours are predictable governance outcomes, not accidental misuse. The implication for practitioners is that access design must be measured by the workarounds it suppresses, not only by the policies it enforces.
A question worth separating out:
Q: How do organisations know whether IAM is actually reducing risk?
A: IAM is working when access is both current and explainable. That means fewer stale entitlements, faster revocation after lifecycle change, clearer ownership for each privilege set, and access reviews that remove rather than rubber-stamp permissions. If those signals are weak, the IAM programme is mostly administrative, not security-driving.
👉 Read our full editorial: ROI-focused IAM security gaps are creating avoidable cyber risk