Topic starter
24/06/2026 11:57 pm
TL;DR: Security teams are operating with a widening capacity gap, and Imprivata cites recent research showing that only 14% of companies say they have the talent and resources needed to meet their security goals. The practical answer is not simply more headcount, but tighter use of managed services, identity automation, and passwordless access to reduce toil and protect overstretched teams.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Rethinking the Cybersecurity Skills Gap with Automation, Identity, and Managed Services”.
Key questions
Q: How should security teams reduce identity workload when staffing is limited?
A: They should automate repetitive identity tasks first, then delegate bounded operational work to managed services where runbooks and escalation paths are explicit.
Q: Why do cybersecurity skills shortages increase IAM risk?
A: Shortages increase IAM risk because identity controls still need timely execution, but there are fewer people to carry out resets, provisioning, reviews, and exception handling.
Q: What are the signs that identity processes are becoming unsustainable?
A: Common signs include rising ticket backlogs, longer turnaround times for access requests, more exception handling, and repeated dependence on the help desk for password recovery.
Practitioner guidance
- Automate the highest-volume identity tasks Target password resets, access provisioning, and access removal first, because those workflows consume the most scarce operational time and create the most visible support burden.
- Adopt passwordless where support load is highest Prioritise user groups with frequent lockouts, reset demand, or recurring authentication friction so identity operations stop spending staff time on repetitive recovery work.
- Define what managed services may own Set explicit boundaries for monitoring, triage, and routine IAM administration so outsourcing expands capacity without diluting internal control or escalation ownership.
Bottom line: Cybersecurity skills shortages affect identity governance directly because routine IAM tasks still need timely execution even when staff are stretched thin.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:45 am
Identity automation is becoming a capacity control, not just an efficiency play. The article reflects a broader operational reality: when teams are understaffed, manual identity work becomes a security risk because delayed resets, provisioning mistakes, and incomplete access maintenance accumulate. In NHI and human IAM alike, automation now functions as a control that preserves consistency when human capacity is the constraint. The practical takeaway is that organisations should evaluate IAM automation by how much operational risk it removes, not only by how many hours it saves.
A question worth separating out:
Q: Should organisations outsource IAM operations or keep them in house?
A: Outsourcing makes sense when it adds specialist coverage or continuous monitoring that internal teams cannot sustain alone. It becomes a problem when it blurs accountability, hides decision ownership, or leaves escalation paths undefined. The right model preserves internal governance even when operations are augmented externally.
👉 Read our full editorial: Cybersecurity skills shortages are pushing IAM toward automation