Topic starter
24/06/2026 11:41 pm
TL;DR: Manual identity processes still govern access changes in 55% of companies, creating avoidable risk, wasted effort, and delayed response across onboarding, certifications, and access changes, according to SailPoint. The real issue is not efficiency alone: governance breaks when access decisions depend on human-scale handling for machine-scale identity volume.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Close Risky Security Gaps and Increase Efficiency with Identity Security Automation”.
By the numbers:
- 55% of companies still rely on manual processes to adjust user access when IT environments change.
- New user access was reduced from 14 hours to 2.5 minutes.
Key questions
Q: What breaks when access governance is still managed through manual workflows and static policies?
A: Manual workflows and static policies break down when data access must change quickly across clouds, teams, and AI use cases.
Q: When do manual identity workflows create more risk than they reduce?
A: Manual identity workflows create more risk when approval chains, access changes, and exception handling depend on ad hoc coordination across teams.
Q: How can security teams tell whether automation is helping or harming identity governance?
A: Automation is helping when it reduces manual handling without creating duplicate records, orphaned entitlements, or unclear ownership.
Practitioner guidance
- Map manual identity tasks to automation candidates Inventory onboarding, access changes, certifications, password resets, and access removals to find the repeatable tasks that should no longer depend on tickets or spreadsheets.
- Reduce exception handling in access workflows Replace out-of-band approvals and ad hoc parsing with policy-based workflow paths so routine requests follow the same governed process every time.
- Shorten certification cycles where risk is highest Prioritise the access reviews that currently take too long to complete and use automation to bring high-risk certifying activity closer to the moment of change.
Bottom line: Manual access governance leaves identity programmes exposed to delay, error, and entitlement drift when access changes happen faster than people can process them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:38 am
Manual access governance creates identity debt: When access changes depend on people pushing spreadsheets and tickets, entitlement state inevitably lags business reality. That lag produces stale access, inconsistent revocation, and weak auditability across the identity lifecycle. The implication is that IAM teams are managing growing identity debt, not just inefficient operations.
A question worth separating out:
Q: When should organisations automate access certifications in identity programmes?
A: Only when the access pattern is stable, the policy model is well understood, and the programme can reliably distinguish routine activity from exceptions. Automation works best for predictable low-risk decisions. Anything ambiguous, sensitive, or poorly observed should stay in a human-led review path.
👉 Read our full editorial: Identity security automation exposes the cost of manual access governance