Topic starter
24/06/2026 11:57 pm
TL;DR: 14% of companies say they have the talent and resources to meet security goals, showing the capacity gap Imprivata cites from recent research. Identity programmes need less manual work if they are to keep access changes timely and ownership clear.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Rethinking the Cybersecurity Skills Gap with Automation, Identity, and Managed Services”.
Key questions
Q: Why do cybersecurity skills shortages increase IAM risk?
A: Shortages increase IAM risk because identity controls still need timely execution, but there are fewer people to carry out resets, provisioning, reviews, and exception handling.
Q: What are the signs that identity processes are becoming unsustainable?
A: Common signs include rising ticket backlogs, longer turnaround times for access requests, more exception handling, and repeated dependence on the help desk for password recovery.
Q: How should security teams reduce identity workload when staffing is limited?
A: They should automate repetitive identity tasks first, then delegate bounded operational work to managed services where runbooks and escalation paths are explicit.
Practitioner guidance
- Automate the highest-volume identity tasks Target password resets, access provisioning, and access removal first, because those workflows consume the most scarce operational time and create the most visible support burden.
- Adopt passwordless where support load is highest Prioritise user groups with frequent lockouts, reset demand, or recurring authentication friction so identity operations stop spending staff time on repetitive recovery work.
- Define what managed services may own Set explicit boundaries for monitoring, triage, and routine IAM administration so outsourcing expands capacity without diluting internal control or escalation ownership.
Bottom line: Cybersecurity skills shortages affect identity governance directly because routine IAM tasks still need timely execution even when staff are stretched thin.
Glossary terms: Identity automation, Passwordless Authentication, Managed Security Service, Operational Resilience
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 8:45 am
Identity automation is becoming a capacity control, not just an efficiency play. The article reflects a broader operational reality: when teams are understaffed, manual identity work becomes a security risk because delayed resets, provisioning mistakes, and incomplete access maintenance accumulate. In NHI and human IAM alike, automation now functions as a control that preserves consistency when human capacity is the constraint. The practical takeaway is that organisations should evaluate IAM automation by how much operational risk it removes, not only by how many hours it saves.
A question worth separating out:
Q: Should organisations outsource IAM operations or keep them in house?
A: Outsourcing makes sense when it adds specialist coverage or continuous monitoring that internal teams cannot sustain alone. It becomes a problem when it blurs accountability, hides decision ownership, or leaves escalation paths undefined. The right model preserves internal governance even when operations are augmented externally.
👉 Read our full editorial: Cybersecurity skills shortages are pushing IAM toward automation