Notifications
Clear all
Topic starter
17/08/2026 4:40 pm
TL;DR: Late or manual onboarding, offboarding, and role changes turn identity lifecycle management into a security exposure, not just an operations problem, according to Soffid. With 71% of organisations reporting at least one identity-related breach in the past year, the case for automated lifecycle controls is no longer optional.
NHIMG editorial — based on content published by Soffid: Why automating onboarding, offboarding and role changes is the foundation of any IAM strategy
By the numbers:
- 71% of organisations have suffered at least one identity-related security breach in the past 12 months, with an average of 3 identity attacks per year.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: What breaks when onboarding and offboarding are handled informally?
A: Informal onboarding and offboarding usually breaks the evidence trail first, then the control itself.
Q: Why do role changes create privilege creep in identity programmes?
A: Role changes create privilege creep when old entitlements are left in place and new ones are layered on top.
Q: How do security teams know if lifecycle automation is actually working?
A: Measure removal completeness, not just provisioning speed.
Practitioner guidance
- Automate joiner, mover, leaver triggers Tie onboarding, role change, and deprovisioning workflows to authoritative HR and directory events so access updates happen from the source of truth, not from ticket closure.
- Recompute entitlements on every role change Require each mover event to remove obsolete permissions and generate a documented entitlement delta before any new access is considered complete.
- Measure deprovisioning latency Track the elapsed time between leaver confirmation and actual revocation across accounts, tokens, and application entitlements to expose where stale access persists.
What's in the full article
Soffid's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step lifecycle automation logic for onboarding, offboarding, role changes, and deactivations across IAM workflows.
- The platform's traceability and control model for proving that access changes were executed and not just requested.
- How the article maps lifecycle automation to compliance, auditability, and reduced manual workload in identity operations.
👉 Read Soffid's analysis of why identity lifecycle automation is the IAM baseline →
Identity lifecycle automation: where manual IAM breaks down?
Explore further
17/08/2026 4:45 pm
Manual identity lifecycle management is a control gap, not an operational preference. When onboarding, offboarding, and role changes depend on tickets and human follow-up, access state inevitably diverges from business reality. That divergence creates orphaned accounts, stale privileges, and audit blind spots that an IGA programme must treat as exposure, not inconvenience. Practitioners should recognise lifecycle latency as a measurable security defect.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which makes lifecycle drift hard to detect before it becomes an incident.
A question worth separating out:
Q: Who is accountable when deprovisioning fails after someone leaves?
A: Accountability sits with the governance process owner, even if the identity management platform executes the revocation. If offboarding is not triggered, approved, or verified through a governed workflow, the failure is not just technical. It is a lifecycle control gap that should be visible in audit evidence, ownership mapping, and exception reporting.
👉 Read our full editorial: Automating identity lifecycle management is now IAM’s security baseline
