Certifications can improve baseline governance, but they do not remove human risk. Many breaches still start with reused passwords, weak MFA adoption, phishing success, or employees mishandling suspicious messages. Security standards document controls, but they do not guarantee that people consistently follow them. A resilient programme must combine policy, training, and reinforcement.
Why certifications improve governance without eliminating breach paths
Security certifications usually show that an organisation has defined controls, assigned ownership, and can produce evidence for audits. That matters, but it is not the same as eliminating the everyday failure modes that attackers exploit. A breach can still happen when controls exist on paper but are inconsistently applied, weakly monitored, or bypassed in routine work.
In practice, attackers rarely need to defeat a full certification programme. They look for a small number of weak points, especially credential hygiene problems, weak access enforcement, or a human action that turns a guarded environment into an exposed one. The control set may be adequate in design, yet the operating reality can still leave a path open.
- Certifications often validate the presence of controls, not whether they are effective every day.
- People are still the most common point where safe process becomes unsafe execution.
- Attackers need only one successful phish, one reused password, or one mishandled alert to gain a foothold.
That is why a certified organisation can still be breached even when the programme appears mature from an audit perspective.
Where human behaviour breaks the control chain
Most real-world compromise sequences rely on ordinary behaviours that certifications cannot fully standardise away. Reused passwords, poor MFA uptake, rushed approval of messages, and inconsistent reporting of suspicious activity all weaken the last line of defence. Even strong policies lose value when users treat them as optional or when teams assume a control exists because it was documented once.
Training helps, but training alone is not enough. The control has to be reinforced through workflow design, clear escalation paths, and friction that makes unsafe behaviour harder than safe behaviour. For example, phishing resistance improves when users know what to do, but it becomes materially stronger when alerting, reporting, and response are easy enough to use under pressure.
- Reused credentials make one compromise reusable across multiple services.
- Weak MFA adoption leaves password theft as a direct path to account takeover.
- Delayed reporting gives attackers time to move, collect data, or intensify access.
Certifications can confirm that these risks are addressed in policy, but they do not guarantee the behaviour change that closes them.
The 52 NHI breaches Report shows why this matters at scale: the same access hygiene weaknesses that affect human users also appear in machine and service credentials. One useful NHIMG data point is that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which reinforces the broader lesson that documented controls do not prevent credential abuse when operational discipline is weak.
What a resilient programme does differently
A resilient programme treats certification as a baseline, not a finish line. The practical goal is to make unsafe actions harder, easier to detect, and faster to contain. That means measuring whether staff actually use approved authentication methods, whether suspicious messages are reported quickly, and whether access can be revoked or reset without delay when compromise is suspected.
The most useful mindset is to test the gap between policy and behaviour. If the written control says one thing but day-to-day execution depends on memory, convenience, or informal exceptions, breaches remain likely. Mature programmes therefore pair governance with repeatable checks, manager accountability, and response processes that assume human error will happen.
- Verify that MFA is not just enabled, but actually enforced for high-value access.
- Check whether phishing reporting and incident escalation are fast enough to matter.
- Measure how often exceptions, shared access, or workarounds are quietly accepted.
Practitioner takeaway: Certifications reduce variance, but breaches persist when the organisation trusts documentation more than behaviour, so the real test is whether access, reporting, and response still work under normal human error.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AT-1 — Awareness and Training Policy and Procedures | Human error and phishing success are central breach paths. |
| PR.AA-1 — Identity and Access Management Policy | Reused passwords and weak MFA adoption are direct access weaknesses. | |
| Recommendation — Reinforce user training and phishing reporting so people can recognise and escalate suspicious activity. Enforce strong authentication and access governance for all sensitive accounts. | ||
| CIS Controls v8 | 5 — Account Management | Breaches persist when accounts and access paths are not tightly governed. |
| 14 — Security Awareness and Skills Training | Phishing and mishandled messages remain common human failure modes. | |
| Recommendation — Review and harden account access to remove weak or stale access paths. Deliver role-based phishing training and require practiced reporting behaviour. | ||
| NIST SP 800-63 | IAL — Identity Assurance Level | Strong identity proofing and authentication reduce password-reuse and takeover risk. |
| Recommendation — Apply stronger identity assurance for users who can reach sensitive systems. | ||
Related resources from NHI Mgmt Group
- Why do phishing campaigns still work even when organisations have security tools in place?
- Why do Google Drive leaks happen even when organisations have sharing policies in place?
- Why do organisations still struggle with sensitive data exposure even when they have DLP controls in place?
- Why do weak or reused passwords still create risk even when organisations have detection tools in place?
