How do organisations know whether routine identity tasks are costing more than they realise?

Why This Matters for Security Teams

routine identity work often looks cheap because each request is small. Password resets, access changes, account unlocks, and entitlement checks become expensive when they are repeated at scale, routed through skilled staff, and slowed by approvals. The real issue is not just labour cost. It is also risk: delayed access can push users toward workarounds, while rushed handling can weaken verification and privilege controls. NIST Cybersecurity Framework 2.0 is useful here because it treats operational outcomes and control effectiveness as part of the security picture, not a separate finance exercise.

Teams often underestimate how much time is absorbed by Tier 1 and Tier 2 support, how much rework comes from incomplete tickets, and how often identity queues create downstream delay in onboarding, offboarding, and privileged access reviews. Those delays can also hide failures in governance, especially where IAM, PAM, and credential lifecycle tasks are handled inconsistently. In practice, many security teams encounter the real cost only after service backlogs, audit findings, or incident response pressure have already exposed the inefficiency, rather than through intentional measurement.

How It Works in Practice

The practical way to test cost is to measure identity operations as a repeatable service, then compare the effort against the business value of the task. Start with ticket categories, average handling time, escalation rate, rework rate, and the staff grade doing the work. A password reset handled by a senior analyst is not a minor task if it happens hundreds of times a month. The same logic applies to access requests, joiner-mover-leaver changes, privileged approvals, and service account updates.

Once the baseline is visible, organisations can separate direct labour from hidden overhead. Hidden costs usually include context switching, approval chasing, after-hours support, and delay caused by manual verification. If the task touches sensitive access, the security cost also matters: every extra handoff is another place where identity assurance, segregation of duties, or audit evidence can fail. For broader control mapping, the NIST Cybersecurity Framework 2.0 helps teams tie identity operations to governance, protection, detection, and recovery outcomes rather than treating them as isolated help desk activities.

A useful measurement pattern is:

• Count the request volume by task type for the last 12 months.
• Multiply average handling time by the hourly cost of the staff performing it.
• Add escalation time, manager approvals, and rework from failed requests.
• Compare manual handling cost with the cost of policy-driven automation or self-service.
• Track risk indicators such as SLA breaches, access delays, and exception rates alongside cost.

This becomes more meaningful when identity tasks are mapped to workflows in IAM, PAM, and ticketing systems so that the same request is measured the same way each time. These controls tend to break down when identity processes are split across multiple tools and business units because request data is incomplete, ticket categories are inconsistent, and no single owner can see the full operating cost.

Common Variations and Edge Cases

Tighter measurement often increases reporting overhead, requiring organisations to balance better cost visibility against administrative effort. That tradeoff matters most when identity work is handled differently across regions, business units, or acquisition boundaries. In those environments, a simple average can hide serious differences in volume, risk, and staff cost, so best practice is evolving toward service-level segmentation rather than one enterprise-wide number.

There is also no universal standard for what counts as an identity task cost. Some organisations include only labour. Others include tooling, queue delay, audit support, and risk of error. The right model depends on whether leadership wants a service efficiency view, a security operations view, or both. For regulated or high-assurance environments, the cost of manual identity handling should also be compared with control expectations from frameworks such as NIST Cybersecurity Framework 2.0 and, where privileged access is involved, the operational burden created by approval and evidence requirements.

Edge cases often appear where automation is possible but not yet safe, such as high-risk access, break-glass accounts, or exceptions tied to legal or HR review. In those cases, the question is not whether to automate everything, but whether the current manual path is worth its friction. If the manual route is slow, expensive, and heavily exception-driven, the organisation already has enough evidence to justify redesign.

Related resources from NHI Mgmt Group

• How can organisations know whether identity controls are keeping up with change?
• How do organisations know whether identity visibility is actually improving?
• How do organisations know whether AI identity monitoring is actually working?
• How do organisations know whether executive collaboration is improving identity security?