Topic starter
24/06/2026 11:57 pm
TL;DR: Only 14% of companies say they have the talent and resources they need to meet security goals in 2025, according to Imprivata, as teams absorb more cloud complexity, burnout, and response pressure while trying to scale protection. The real shift is toward automation, managed services, and IAM controls that reduce operational load without weakening access governance.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Rethinking the Cybersecurity Skills Gap with Automation, Identity, and Managed Services”.
Key questions
Q: How can IAM teams reduce manual work without weakening controls?
A: They should automate lifecycle events, connect access decisions to authoritative data, and measure actual remediation rather than ticket closure.
Q: Why do cybersecurity skills shortages increase IAM risk?
A: Shortages increase IAM risk because identity controls still need timely execution, but there are fewer people to carry out resets, provisioning, reviews, and exception handling.
Q: What breaks when access requests and password resets stay manual?
A: Manual handling breaks first at scale, where teams face queue buildup, inconsistent response times, and growing support demand.
Practitioner guidance
- Automate high-volume IAM tasks Target password resets, routine access requests, and other repeatable IAM workflows that consume disproportionate analyst and help-desk time.
- Define outsourcing boundaries for identity operations Specify which monitoring, response, and support functions a managed service may execute, and retain internal ownership for access policy, escalation, and evidence review.
- Prioritise passwordless access where support demand is highest Use passwordless authentication to cut authentication friction in user groups that drive repeated resets and recovery tickets.
Bottom line: Cybersecurity skills shortages are pushing IAM teams toward automation because manual identity work does not scale cleanly under cloud growth and response pressure.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:45 am
Automation is becoming an identity governance requirement, not just an efficiency play. The article reflects a programme reality that many teams already feel: when staffing cannot keep up with access demand, governance quality degrades first. That makes automation part of control design, because repeatable identity tasks are the only way to preserve consistency when headcount does not scale. The implication is that IAM maturity now depends on operational resilience, not just policy intent.
A question worth separating out:
Q: When should organisations use managed services in identity security?
A: Use managed services when internal teams need repeatable operational support and the work can be measured, audited, and governed. They are most suitable for sustained lifecycle tasks, platform administration, and support functions that do not require constant strategic judgement from the enterprise itself.
👉 Read our full editorial: Cybersecurity skills gaps are pushing IAM toward automation