Notifications
Clear all
Topic starter
02/08/2026 11:56 am
TL;DR: IT automation should remove repetitive work from human queues and use deeper orchestration, approvals, and audit controls to manage access provisioning, onboarding, offboarding, and JIT workflows, according to torq, with claims of 60% lower identity management costs, 99% fewer access errors, and up to 70% lower ticket volume. The governance question is whether automated workflows are reducing standing privilege and manual error, or simply accelerating weak identity processes at machine speed.
NHIMG editorial — based on content published by torq: IT automation tools and workflow automation for enterprise IT operations
By the numbers:
- For employee onboarding and offboarding, automation can reduce identity management costs by 60% and cut access errors by 99%.
- Just-in-time access workflows can provision access 70% faster.
Questions worth separating out
Q: How should security teams govern user provisioning workflows without creating more access sprawl?
A: Security teams should tie provisioning to explicit ownership, role design, and revocation evidence.
Q: When does JIT access create more risk than it reduces?
A: JIT creates more risk than it reduces when teams assume expiration alone is enough and skip assurance around the requester.
Q: What do identity teams get wrong about automation in access governance?
A: They often treat automation as a substitute for governance rather than a way to make governance scalable.
Practitioner guidance
- Define the control boundary for every automated identity workflow List the exact point where a workflow can create, elevate, or remove access, then require an owner, an approval rule, and a rollback path for that step.
- Separate workflow administration from identity administration Restrict who can edit automation logic, who can approve privileged actions, and who can maintain connectors into identity providers.
- Measure revocation latency for JIT access Track the time between task completion and access removal for every privileged workflow.
What's in the full article
Torq's full article covers the operational detail this post intentionally leaves for the source:
- Specific workflow examples for onboarding, offboarding, and access provisioning across IT systems
- Platform architecture details behind integration depth, conditional logic, and human-in-the-loop checkpoints
- Implementation claims around reduced identity management cost, fewer access errors, and faster access turnaround
- Examples of how Hyperautomation connects SecOps, IT, DevOps, and HR in one workflow model
👉 Read torq's analysis of IT workflow automation and identity governance →
IT workflow automation: are your identity controls keeping up?
Explore further
02/08/2026 1:04 pm
Workflow depth, not workflow count, is what changes identity risk. The article correctly argues that automation only matters when it can span multiple systems, preserve state, and enforce controls through exceptions. That is the point at which IT automation becomes identity governance infrastructure, not just task reduction. For IAM, IGA, and PAM teams, the practical conclusion is that every orchestration layer must be assessed as a control surface, not just a productivity tool.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: What should organisations check before automating onboarding and offboarding?
A: They should verify that account creation, access removal, notification steps, and audit logging all complete in the right order across every connected system. Offboarding is especially sensitive because delayed revocation leaves lingering access after employment ends. If any system can lag behind the workflow, the process is not yet safe to automate end to end.
👉 Read our full editorial: IT workflow automation and identity governance: what teams need
