"Zombie work": Why nearly half of security leaders' tasks never get done

When you leave a job, someone is supposed to shut off your accounts. Your email, your file storage, the customer database you had access to on your last day. You might assume this happens automatically. New data suggests it often doesn't.

‍

Vanta, an agentic trust platform, analyzed anonymized task data from its platform between January and June 2026 to see which security and compliance work actually gets finished and which stalls. The pattern that emerged has a name: Zombie work. These are the living dead, the tasks that are assigned to a real person but are never completed, yet never formally abandoned either.

‍

What "zombie work" looks like

Every organization has work that’s not done yet. Zombie work, in contrast, refers to tasks that have owners but remain both incomplete and not abandoned. The person responsible knows about it, and may have even started it, but they hit a wall: they're waiting on another team to grant access, on a manager to approve a budget, or for a week where they have the time to get to it.

‍

Because someone owns it, the task doesn't show up as a gap in anyone else’s dashboard. It just sits there, technically “in progress,” but waiting indefinitely.

‍

Small companies don’t have zombie work. Big ones do.

The clearest finding in the data is that zombie work is a symptom of growth, not incompetence.

‍

According to Vanta’s data, when a growing company makes its first dedicated security hire, that person closes 96% of the tasks assigned to them. And it’s easy to see why: There’s one owner and no ambiguity about who does what.

‍

That success rate falls apart as headcount climbs:

‍

• Governance, risk, and compliance staff leave 44% of their tasks incomplete. Of those unfinished tasks, 70% have shown no activity at all for 60 days or more.
• Chief information security officers (CISOs), the executives ultimately accountable for a company's security, leave 49% of their tasks incomplete. Roughly a third of those have gone untouched for 60-plus days.

‍

The work didn't get harder. The org chart got bigger, wider, and more interconnected. As companies add compliance frameworks, expand into new countries, and pick up new regulatory obligations, the number of tasks grows fast. And because each task tends to require more hands, the pace of tasks completed can never quite catch up to the growing list.

‍

The two kinds of work that stall

The stalled tasks don't happen randomly and unpredictably. Each role has its own graveyard.

‍

For compliance staff, it's audit findings and compliance gaps. This category captures 81% of their unresolved work. In practice, that means things like standing up an intrusion detection system or launching a formal review process across departments. Almost all of it requires cooperation from teams that don't report to them, which is one of the conditions most likely to produce zombie work.

‍

For security chiefs, it's deprovisioning. This category is over 90% of their backlog. Deprovisioning is the unglamorous work of removing a departed employee's access from every tool the company uses. Nearly 60% of those tasks sit unresolved for 30 days or longer.

‍

This gap is so big because deprovisioning tasks are often owned by an executive who is accountable for it, technically, even though they are almost never the person who executes it. It's supposed to be done by IT, the tool owner, or the manager who ran the offboarding process. When ownership sits with one person and execution sits with another, tasks often become zombie work.

‍

The cost of an account nobody removed

An account left open after someone walks out the door is one of the most reliable ways into a company's systems. If a former employee's credentials are still live a month later, so is every path those credentials open, whether the person is malicious, careless with an old password, or reusing it on a site that later gets breached.

‍

The financial exposure is well documented. IBM puts the global average cost of a data breach at nearly $5 million. 

‍

What actually moves zombie work along

The data points toward a few practical changes for anyone responsible for security work at a growing company:

‍

1. Separate the owner from the executor. If an executive is accountable for a task someone else has to perform, name both people when the task is created.
2. Treat a 30-day-old offboarding ticket as an incident. Set an escalation trigger rather than waiting for a quarterly review to surface it.
3. Route cross-departmental work through a standing forum. The tasks that die are the ones that need a team outside security to act, and those rarely move over email.
4. Watch for aging, not volume. A long backlog is normal at scale. A backlog where nothing has moved in two months is a different problem.
5. Stop treating weekend work as the fix. Vanta's data found that every role it tracked, from the lone security hire at a startup to CISOs at large companies, logs weekend activity. The backlog persists anyway, which suggests the constraint is coordination, not hours.

‍

None of this makes security work less cross-functional. Complexity comes with scale. But the gap between a company that closes 96% of its security tasks and one that closes half isn’t the result of not working hard. The gap can only be crossed, and stay crossed, when the whole organization treats security work as a priority.

‍

Companies looking to reduce the coordination drag on this kind of work can explore how third-party risk management tooling helps route and track cross-departmental compliance tasks, stopping zombie work before it becomes undead.

‍

About the data

The findings come from Vanta's product telemetry and task management system, covering user-created tasks across its customer base from January through June 2026. Roles are classified using Vanta's internal taxonomy of user types, including CISO, GRC, security operations, engineering, and founder. The analysis is limited to organizations with at least one identified CISO user and to tasks created since January 2025. "Incomplete rate" means tasks in an open or overdue state as a share of all tasks that persona created. Because this is one platform's usage data rather than a survey of the whole industry, it reflects the behavior of companies already using compliance software, which is a group likely to be more organized than average, not less.