Why do repeated breaches keep happening even in organisations with large security budgets?

Repeated breaches often persist because spending is directed at tools rather than fundamentals. If attackers can find the same weakness in multiple divisions or network segments, they will use it again. The real risk comes from unresolved exposure, poor data handling, and weak hygiene. Security improves when teams focus on reducing reachable sensitive data and closing obvious access paths.

Why breaches recur even after major spending

Large budgets often buy more products, not more risk reduction. Repeated breaches usually mean the same exposed path still exists somewhere in the environment, whether that is a reachable account, a reused secret, an unsegmented segment, or sensitive data that remains too easy to find. The budget question is therefore really a control question: what was hardened, what was left reachable, and what remains reusable after the first incident?

When that pattern appears across divisions, inherited infrastructure, or acquired environments, attackers do not need a new technique. They only need the same weakness to remain visible enough to exploit again. That is why mature security programmes focus less on tool count and more on reducing attack surface, shrinking trust boundaries, and making sensitive material harder to reach at scale.

That distinction is consistent with the evidence in The 52 NHI Breaches Report, which shows how repeated compromise paths often involve the same exposed credentials, secrets, or service access patterns rather than one-off novelty.

Why exposure persists across large organisations

Security spend fails when it is absorbed by perimeter change, platform replacement, or control duplication while the underlying exposure stays intact. In practice, recurring breach conditions are usually created by a small set of repeatable problems: excessive access, weak segmentation, poor secret hygiene, legacy integrations, and inconsistent ownership of critical data and accounts.

That is why a repeated breach often crosses team boundaries. One group may harden one environment, while another keeps the same access path open in a different business unit, cloud account, or production segment. If identity, data handling, and network reachability are not governed consistently, attackers can move from one weak area to the next without needing a fresh intrusion method.

The business case problem is captured well in Identity and NHI Security Business Case Guide, because the real cost driver is not the number of tools purchased but the persistence of unresolved access and exposure that keeps producing the same loss scenarios.

For practitioners, the useful question is not whether the company spent enough in aggregate, but whether the spend removed reachable sensitive data, closed obvious access paths, and eliminated reusable footholds that survive one incident and invite the next.

What breaks the repeat cycle

Repeated breaches fall when security teams treat exposure reduction as a measurable operational outcome. The practical sequence is to identify the most reachable data, the most reused credentials or secrets, and the most obvious paths between low-value and high-value segments, then remove or constrain those paths before buying more detection capability.

That usually means aligning ownership around the assets that matter most, not the controls that are easiest to deploy. If a control cannot answer who can reach sensitive data, how access is granted, and what happens when a secret or account is reused elsewhere, it is unlikely to stop the next repeat incident.

A useful reference point is NIST Cybersecurity Framework 2.0, because the repeated-breach problem sits across identify, protect, detect, respond, and recover rather than inside a single product category. For attackers that keep reusing the same path, the operational priority is to make that path materially less reachable and less reusable.

Risk and Threat Considerations

Repeated breaches are risky because they signal that the organisation has not removed the conditions that made the first compromise possible. The exposure may sit in stale accounts, shared secrets, weak segmentation, or sensitive data that remains broadly accessible, which means the next attacker often finds a familiar path instead of a new one.

Failure mechanism: A control gap remains in place after the first incident, so the same credential, trust path, or data exposure can be reused across systems, business units, or environments.

Impact: The organisation experiences recurring compromise, larger blast radius over time, and a false sense of progress because tooling improves while the actual attack surface does not shrink.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-5 — Account Management	Repeated breaches often persist through reused or excessive access paths.
Recommendation — Remove stale accounts and tighten access to reduce repeat compromise paths.
NIST CSF 2.0	PR.AA-01 — Identity Management, Authentication, and Access Control	The issue is unresolved access and reachability across environments.
	PR.DS-01 — Data-at-Rest is Protected	The answer centers on reducing reachable sensitive data that attackers keep finding.
	GV.RM-01 — Risk Management Strategy	Large budgets fail when spending is not tied to measurable exposure reduction.
Recommendation — Govern identities and access paths to shrink repeatable attack surface. Protect sensitive data so exposure is harder to reuse after compromise. Tie security investment to reduced exposure and repeat-loss scenarios.
NIST SP 800-53 Rev 5	AC-6 — Least Privilege	Excessive access is a common reason the same breach path remains usable.
Recommendation — Enforce least privilege to limit what attackers can reuse after compromise.

Practitioner Guidance

What to prioritise: Start with the smallest set of exposures that can be reached repeatedly, especially shared secrets, broad access paths, and sensitive data that remains easy to enumerate. Those are the conditions that most often explain why a second or third breach looks like the first.

What to verify: Validate that each high-value path has an owner, an expiry or review cycle, and a clear reason to exist. If you cannot show that for a path, assume it is a candidate for reuse by an attacker or for accidental reintroduction by another team.

Practitioner takeaway: The most reliable way to stop repeated breaches is to reduce what can still be reached, reused, or inherited after the first incident, not to keep layering tools over the same exposure.