Notifications
Clear all
Topic starter
08/06/2026 4:31 pm
TL;DR: Enterprise password management remains fragmented, with Gartner putting password resets at roughly 40% of all IT help desk calls and Verizon finding human error in 68% of breaches, according to the source article and Verizon’s latest breach data. The governance problem is no longer convenience alone: weak reset flows, poor audit trails, and inconsistent verification create an identity control gap attackers can exploit.
NHIMG editorial — based on content published by Bravura Security: enterprise password management and hybrid reset governance
By the numbers:
- According to Gartner, roughly 40% of all IT help desk calls are password resets.
- According to Verizon, human error is involved in 68% of breaches.
Questions worth separating out
Q: What breaks when password reset processes stay fragmented across systems?
A: Fragmented reset processes break visibility, consistency, and accountability.
Q: Why do password resets become a security issue in hybrid environments?
A: Password resets become a security issue in hybrid environments because users often need recovery when they are off-network, yet legacy tools still depend on on-site or VPN-connected state.
Q: How do security teams know whether password reset governance is working?
A: A working reset programme produces a complete audit trail, consistent user experience, and low exception rates across all major systems.
Practitioner guidance
- Centralise reset evidence across every identity store Build one audit trail for all password reset events, including proofing method, system touched, and propagation status.
- Replace help desk caller checks with governed self-service Remove ad hoc phone verification paths wherever possible and use repeatable identity proofing steps that are enforced by policy.
- Design recovery to work off-network by default Make sure remote users can reset access without VPN dependence and without manual IT intervention.
What's in the full article
Bravura Security's full article covers the operational detail this post intentionally leaves for the source:
- A practical breakdown of centralised password reset features across hybrid environments, including on-premises and cloud directories.
- Examples of self-service reset workflows that reduce help desk load while keeping policy enforcement in place.
- Guidance on audit logging and compliance reporting for organisations that need evidence for SOX, HIPAA, NIST, and similar obligations.
- Implementation considerations for off-network password recovery without VPN dependence or manual IT intervention.
👉 Read Bravura Security's article on modernising enterprise password management →
Password resets in hybrid IT: where identity controls break down?
Explore further
08/06/2026 6:12 pm
Legacy password reset is an identity control failure, not an efficiency gap. The article’s evidence points to a programme that has allowed access recovery to become fragmented across systems, teams, and procedures. That fragmentation weakens both security and auditability because no one can reliably answer who reset what, when, and under which proofing method. The practitioner conclusion is that password reset now needs to be governed as part of identity control, not treated as an isolated service desk function.
A few things that frame the scale:
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks, according to The 2024 ESG Report: Managing Non-Human Identities.
- The average organisation believes more than 1 in 5 of their non-human identities are insufficiently secured, which is a useful benchmark for board-level risk discussions.
A question worth separating out:
Q: Who is accountable when weak password resets enable account takeover?
A: Accountability sits with the organisation that owns the reset control, not with the attacker who exploited it. The relevant governance question is whether identity proofing, logging, and policy enforcement were strong enough to prevent unauthorised recovery. If they were not, the control owner must treat reset design as a high-risk access control.
👉 Read our full editorial: Enterprise password reset is still a hidden identity risk
