Topic starter
25/06/2026 10:42 pm
TL;DR: Password resets and authentication issues can account for 10-50% of help desk calls, while 20-40% of those calls could be avoided with self-service capabilities, making password recovery a cost, productivity, and governance problem, according to Imprivata. The real issue is that password-heavy IAM scales support work faster than it scales secure user access.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Can self-service password reset tools save me money?”.
By the numbers:
- Password resets and authentication issues can account for 10-50% of help desk calls, according to Imprivata.
- 20-40% of those calls could be avoided with self-service functionalities, according to Imprivata.
Key questions
Q: How should security teams evaluate self-service password reset in hybrid IAM environments?
A: They should test reset coverage, policy consistency, identity verification, and auditability across every connected system, not just the primary directory.
Q: Why do password resets create such a large operating cost in IAM programmes?
A: They consume IT labour, interrupt employee workflows, and scale with the number of applications and logins users must manage.
Q: What are the signs that password authentication is failing as a control?
A: Common warning signs include frequent password resets, users reusing passwords across accounts, abandoned checkout sessions, and repeated login friction.
Practitioner guidance
- Define recovery assurance tiers Set different identity verification requirements for low-risk and high-risk accounts before allowing self-service reset, so the recovery path matches business impact.
- Log and review reset events Capture who reset, when they reset, what factors were used, and whether the event was self-service or assisted, then feed that data into audit and abuse monitoring.
- Reduce dependence on passwords Prioritise passwordless authentication for user populations with repeated lockouts so that the need for recovery falls over time.
Bottom line: Password resets are a governance and operating cost issue, not merely a help desk inconvenience.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 11:21 pm
Password reset is a governance problem, not just a service desk problem. Once resets account for a meaningful share of user support demand, the organisation is really paying for a weak recovery model. The control question shifts from call handling to identity assurance, because recovery is where access is most often re-established under pressure. Practitioners should treat reset workflows as part of access governance, not an afterthought.
A few things that frame the scale:
- According to Forrester Research, a single password reset can cost around $70.
A question worth separating out:
Q: How do teams decide whether to invest in self-service reset or passwordless access first?
A: Prioritise the control that removes the biggest source of friction. If resets dominate support demand, self-service may deliver quick relief. If password dependence is already driving repeated failures and weak recovery behaviour, passwordless should become the longer-term target.
👉 Read our full editorial: Self-service password reset reduces IAM cost and user friction