Boring security controls deliver the clearest cybersecurity ROI

At a glance

What this is: Expel’s analysis argues that basic security controls deliver the best return because attackers prefer easy wins and the majority of incidents still fall to identity weaknesses.

Why it matters: It matters because IAM, PAM, NHI and broader security teams need to defend foundational controls in business terms, especially where conditional access, MFA, patching and least privilege reduce real loss exposure.

By the numbers:

• Identity attacks made up 68.6% of incidents in Expel’s 2026 Annual Threat Report.
• Over half of identity attacks, 52.3%, were immediately blocked by existing controls such as conditional access policies and multi-factor authentication.
• Expel’s research surveyed 300 CISOs and CFOs about the security-finance relationship.

Context

Boring security controls are the controls that stop common attacks before they become incidents, especially identity, access, patching and cloud hygiene measures. This article is really about the governance gap between what finance leaders want to fund and what security teams often prefer to talk about, with identity controls at the centre of that gap.

The practical point is that attackers optimise for the easiest path, so the controls that look unglamorous in a board deck are often the ones that reduce the most risk. For IAM, NHI and PAM programmes, that means the question is not whether fundamentals are exciting, but whether they are consistently configured, monitored and tied to business enablement.

Key questions

Q: What breaks when security protocols are not followed and enforced consistently?

A: When security protocols are treated as optional, sensitive data can be left exposed on cloud systems, password controls may be absent, and multiple parties can access information before anyone notices. The failure is operational as much as technical. Controls only work when teams perform them daily, verify compliance, and make enforcement part of normal IT operations.

Q: Why do identity controls produce the clearest cybersecurity ROI?

A: Identity controls produce clear ROI because they directly reduce the probability of account takeover and the scale of misuse after access is granted. You can measure coverage, blocked attempts and residual exposure far more easily than you can measure many advanced detections. That makes identity governance easier to defend in budget discussions.

Q: What do security teams get wrong about boring controls?

A: Teams often treat fundamentals as low-status work instead of the controls that most consistently reduce real losses. The mistake is to fund visible novelty while leaving authentication, patching, access governance and cloud hygiene incomplete. That leaves attackers with the cheapest path and makes later-stage controls carry more risk than they should.

Q: How should security leaders explain control investment to finance?

A: Frame investment around business enablement, measurable risk reduction and the cost of not acting. Finance usually responds better to blocked incidents, reduced exposure and safer delivery of business initiatives than to abstract threat language. The strongest case shows how a control changes both operational resilience and expected loss.

Technical breakdown

Why basic controls stop most attacks

Attackers rarely need novel techniques when identity compromise, weak authentication, stale access and poor endpoint hygiene remain available. The economics are simple: if a compromised account, exposed credential or misconfigured control gets the same result with less effort, adversaries will take that route. In practice, this means MFA, conditional access, patching and least privilege are not supporting controls, they are the first line of cost-effective defence. The article’s central evidence is that common attack paths still dominate because they are reliable, scalable and easier to hide inside normal traffic.

Practical implication: prioritise controls that remove easy attack paths before funding niche detections.

Why identity controls dominate security ROI

Identity is the control plane for modern access, so failure there gives attackers immediate leverage across cloud, application and data environments. Conditional access and MFA work because they constrain authentication, not just alert on abuse after access is granted. For human identity, this reduces account takeover risk; for non-human identity, the same logic applies to service accounts, API keys and other secrets that can be replayed. The article is ultimately describing a governance reality: if access is weak, every downstream control inherits that weakness.

Practical implication: treat identity controls as loss-reduction controls, not just login friction.

Why finance can measure boring security

Boring controls are easier to quantify because they map to known threats, known control coverage and known residual risk. You can measure how many accounts are protected by MFA, how many systems are patched on time, how many identities are subject to conditional access, and how many incidents are blocked before escalation. That makes the business case materially stronger than abstract threat narratives. The article’s deeper point is that security investment becomes finance-ready when the control outcome is visible in operational data, not only in incident postmortems.

Practical implication: build ROI reporting around control coverage, blocked incidents and avoided exposure.

Threat narrative

Attacker objective: The attacker’s objective is to gain usable access quickly and cheaply, then convert that access into business impact without needing advanced tooling.

1. Entry occurs through the cheapest available path, usually a weak identity control, exposed credential or unpatched system rather than a sophisticated exploit.
2. Escalation follows when attackers exploit the absence of MFA, conditional access or least privilege to turn a single compromise into broader access.
3. Impact is achieved by using ordinary access to steal data, move laterally or disrupt operations while blending in with normal activity.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Boring controls are the real resilience layer: The market still overvalues novel attack narratives and undervalues the controls that most often decide whether an attack succeeds. Expel’s analysis reinforces a familiar but uncomfortable truth: attackers follow the easiest path, and that path usually runs through identity, access and configuration. For practitioners, the lesson is to fund the controls that shrink the attack surface first, because that is where measurable loss reduction happens.

Control coverage, not control rhetoric, is what finance can underwrite: CFOs do not need another abstract threat story, they need evidence that a control changes the loss curve. Conditional access, MFA, patch discipline and access review create visible prevention outcomes that can be reported in operational terms. That is why basic control maturity is a finance conversation as much as a security one: the value is in reduced probability and reduced blast radius, not in the elegance of the tooling.

Identity and NHI governance share the same economic logic: Whether the principal is a person, service account or workload, the attacker still looks for the cheapest authentication failure. That makes access governance for human and non-human identities part of the same budget argument, even if the implementation differs. The organisation that cannot explain control coverage for identities cannot credibly claim resilience.

Expel’s argument exposes a governance blind spot we should call boring-control debt: This is the accumulated risk created when foundational controls are deferred in favour of more visible projects. The debt shows up as preventable incidents, weak audit narratives and inflated residual risk. Practitioners should treat this as a programme design issue, not a technology issue, because unfinished fundamentals distort every higher-order investment.

Security enablement is the better ROI language than threat avoidance: The article’s strongest point is not that controls prevent bad outcomes, but that they make modern business operating models safer to run. Remote work, third-party integrations and faster application delivery all depend on trustworthy identity and access governance. Security leaders who can frame fundamentals as business enablers will get a better hearing than those who only describe threat severity.

What this signals

Boring-control debt: The real risk is not that organisations lack sophisticated tools, but that they leave foundational controls partially implemented and then assume higher-order security will compensate. That gap matters because the cheapest attacks still target identity, patching and access misconfiguration first. Finance will increasingly reward teams that can show control coverage and blocked-loss outcomes rather than generic threat monitoring.

Security leaders should expect more scrutiny on whether fundamental controls are complete, measurable and tied to business change. Conditional access, MFA, patch hygiene and access review will keep showing up as the controls that determine whether the rest of the programme is carrying real risk or just reporting on it.

For practitioners

• Strengthen conditional access before expanding advanced detections Make login location, device trust and authentication strength part of every access decision so common identity attacks fail before session creation.
• Treat MFA as baseline loss prevention Require phishing-resistant MFA for privileged and high-risk users, then extend coverage to the identity classes that generate repeat incidents.
• Use patch compliance as a board metric Track critical vulnerability remediation by business service so finance can see where unpatched systems still create avoidable exposure.
• Tighten least-privilege access reviews Review human and non-human access against actual job and workload need, then remove unused entitlements that expand blast radius.
• Report security ROI in blocked-loss terms Translate control coverage into prevented compromise, reduced exposure and avoided downtime so finance can compare spend with residual risk.

Key takeaways

• Attackers still prefer the lowest-cost path, which keeps identity, access and patching at the centre of practical defence.
• Expel’s data shows that more than half of identity attacks were blocked by basic controls, underscoring how often fundamentals decide outcomes.
• The strongest security budget case is not novelty, but control coverage tied to measurable risk reduction and business enablement.

Key terms

• Conditional Access: Conditional access is a policy model that decides whether an action should proceed based on context such as posture, resource sensitivity, timing, and scope. For AI agents, it must be evaluated at request time so a valid credential does not automatically equal permitted behaviour.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.
• Identity Security ROI: Identity security ROI is the measurable business return from reducing access risk and operational overhead through identity controls. It typically combines productivity gains, audit savings, tool consolidation, and lower exposure from excessive or stale access across both human and non-human identities.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It gives identity and security practitioners a practical way to connect control design to real-world risk reduction.