Topic starter
08/07/2026 7:00 pm
TL;DR: Password resets still consume 20% to 50% of help desk tickets and cost around $70 each, according to Efecte's analysis citing Gartner and Forrester. The real problem is an IAM design that turns routine recovery into recurring operational cost and avoidable security exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Efecte: “The Hidden Drains of Password Resets”.
By the numbers:
- Password resets account for 20% to 50% of all IT help desk tickets, according to Efecte.
Key questions
Q: What breaks when password reset still depends on help desk workflows?
A: Help desk-dependent reset workflows break because they slow down containment, create inconsistent handling across systems, and leave gaps in verification.
Q: Why do weak password recovery flows increase credential risk?
A: Because users and support teams often optimise for speed when recovery is painful.
Q: How should organisations reduce password reset volume without weakening access control?
A: Use self-service password reset only when the reset flow is protected by strong verification, audit logging, and policy enforcement inside a governed IAM or enterprise access management model.
Practitioner guidance
- Instrument password reset demand Measure reset volume, ticket drivers, and average handling time across help desk and identity systems so you can separate process noise from structural IAM failure.
- Redesign recovery for self-service Move routine resets out of the support queue by using policy-backed self-service flows with strong verification and clear step-up rules.
- Audit recovery assurance controls Review how identity proofing, verification questions, and exception handling are used during account recovery, then remove low-assurance paths that weaken authentication.
Bottom line: Password reset volume is a design signal, not just a service metric, because it exposes how much identity work still depends on manual recovery.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/07/2026 7:23 pm
Password reset volume is a symptom, not the root cause. The underlying issue is an IAM model that still treats recovery as a manual exception path instead of a governed control surface. When 20% to 50% of service desk traffic comes from resets, the organisation is paying repeatedly for a design problem that should have been eliminated upstream. Practitioners should read reset volume as evidence that identity design is carrying hidden operational debt.
A question worth separating out:
Q: When do password resets become an IAM governance problem rather than a support issue?
A: They become a governance problem when reset handling is inconsistent, overly manual, or used as a substitute for better identity design. At that point, the reset process influences access assurance, user behaviour, and operating cost, so it belongs in IAM policy and control review.
👉 Read our full editorial: Password resets expose the hidden cost of weak IAM design