Notifications
Clear all
Topic starter
08/07/2026 6:56 pm
TL;DR: Mid-sized companies face the same compliance, breach, and access-management expectations as large enterprises, but with leaner teams and heavier manual work, according to OpenIAM. The real issue is not lack of intent, but that identity processes built for scale are too costly, slow, and error-prone for mid-market reality.
NHIMG editorial — based on content published by OpenIAM: Workforce Identity Challenges for Mid-Sized Companies
By the numbers:
- 70% of helpdesk tickets are password-related, elated, leaving employees idle until IT resolves them.
- The average cost of a breach was $4.45 million in IBM’s Cost of a Data Breach Report 2023.
Questions worth separating out
A: Start with the highest-friction processes first: joiner-mover-leaver workflows, password recovery, and access certification.
Q: Why do access reviews often fail in smaller IAM programmes?
A: They fail when the review is disconnected from current system reality.
Q: What should organisations prioritise first when workforce identity is consuming too much IT time?
A: Prioritise the controls that remove repetitive work and reduce error rates: self-service password reset, SSO, automated deprovisioning, and clearer role design.
Practitioner guidance
- Automate joiner-mover-leaver workflows Link HR or source-of-truth events to provisioning and deprovisioning so access changes do not depend on manual ticket closure or spreadsheet cleanup.
- Reduce helpdesk dependence with self-service recovery Use self-service password reset, MFA, and SSO to remove routine credential recovery from the service desk and reserve manual handling for exceptions.
- Shorten access review cycles around real lifecycle events Run entitlement reviews after role changes, promotions, and departures, and require named owners for every high-risk account before certification is closed.
What's in the full article
OpenIAM's full article covers the operational detail this post intentionally leaves for the source:
- A mid-market framing of how password reset burden affects IT capacity and employee productivity.
- Specific examples of the compliance tasks that become hard to sustain when entitlement reviews are manual.
- A vendor-side explanation of the workforce IAM capabilities OpenIAM says are designed for smaller teams.
- The article's own positioning on enterprise IAM complexity versus mid-sized deployment needs.
👉 Read OpenIAM's analysis of workforce identity challenges for mid-sized companies →
Workforce identity in mid-sized firms: where do controls fail?
Explore further
08/07/2026 7:19 pm
Manual identity operations are the hidden control failure in mid-sized firms. This article is really about governance debt, not just workflow inefficiency. When access reviews, onboarding, and deprovisioning depend on human follow-through, the control fails at the point of scale. The implication is that identity programmes for mid-market organisations must be measured against operational reality, not enterprise architecture assumptions.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who is accountable when orphan accounts or excessive access remain after an employee leaves?
A: Accountability should be shared across HR, IT, and the business owner of the application, but the control owner must be explicit. If nobody owns offboarding and entitlement cleanup, revocation becomes optional in practice. Frameworks such as the NIST Cybersecurity Framework 2.0 expect clear governance ownership for access control outcomes.
👉 Read our full editorial: Mid-sized workforce identity is breaking under manual control
