Topic starter
06/07/2026 9:42 am
TL;DR: Manual joiner-mover-leaver processes still create ticket sprawl, delayed onboarding, slow revocation, and audit gaps, while Lumos cites CrowdStrike’s 2025 Global Threat Report that 80% of cyberattacks leverage identity-based methods. The real issue is that lifecycle governance built on human-paced tickets cannot keep up with access changes that need to happen in real time.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “JML Automation: Optimizing the Joiner-Mover-Leaver (JML) Process with Lumos”.
By the numbers:
- 80% of cyberattacks leverage identity-based methods, according to CrowdStrike’s 2025 Global Threat Report cited by Lumos.
Key questions
Q: What breaks when joiner-mover-leaver workflows are mostly manual?
A: Manual workflows create delay, inconsistency, and missed revocations.
Q: Why does slow offboarding increase identity risk?
A: Slow offboarding increases risk because former employees can retain access long enough to read data, alter records, or continue using subscriptions after separation.
Q: How do you know if JML automation is actually working?
A: JML automation is working when the access outcome matches the lifecycle event across all connected systems, with no unexplained exceptions.
Practitioner guidance
- Map every joiner, mover, and leaver event to an authoritative trigger Tie provisioning and revocation to HRIS or IdP events so access changes occur when the employment state changes, not when someone opens a ticket.
- Replace manual offboarding queues with event-driven deprovisioning Design leaver workflows so access removal fires automatically on termination or departure signals across SaaS, on-prem, and cloud systems.
- Define persona-based access bundles for common roles Create role, department, or seniority-based bundles so new starters receive the right baseline access without ad hoc approval chains.
Bottom line: Manual JML creates a control lag that shows up as delayed onboarding, stale mover access, and slow offboarding.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:57 am
Manual JML is a governance latency problem, not a workflow annoyance. Tickets, spreadsheets, and ad hoc approvals create a gap between business change and access change that modern identity programmes can no longer absorb. When lifecycle action depends on human pacing, least privilege becomes an after-the-fact review exercise instead of an operational control. Practitioners should treat lifecycle latency as a measurable security exposure, not an administrative inconvenience.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations prioritise access review or lifecycle automation first?
A: Organisations should prioritise lifecycle automation first when review cycles cannot keep pace with change. Reviews can confirm policy, but automation removes stale access when the underlying event occurs. For high-volume NHIs, that is usually the only practical way to keep entitlements current enough to matter.
👉 Read our full editorial: JML automation exposes the limits of manual identity lifecycle control