Finance-security misalignment is letting identity attacks keep succeeding

At a glance

What this is: Expel argues that identity attacks keep succeeding because basic controls are not fully funded, fully deployed, or fully governed across the security-finance divide.

Why it matters: IAM and security teams need to treat budget translation as a control issue, because incomplete deployment and weak prioritisation leave known identity attack paths open.

Context

Identity attacks often succeed not because the threat is novel, but because foundational controls are unevenly funded and inconsistently deployed. In identity programmes, that means the gap is rarely the authentication method itself; it is the governance around adoption, configuration, and sustained enforcement.

Expel’s article ties that control gap to a security-finance communication problem: the teams may believe they are aligned, but they are not always using the same measures of risk or business value. For IAM, NHI, and human identity programmes, that mismatch can delay funding for MFA, access governance, and other baseline controls until attackers have already found the weakest path.

Key questions

Q: What fails when identity controls are only partially deployed?

A: Partial deployment creates a false sense of coverage. Attackers do not need to beat every control, only the parts that are missing or misconfigured. In practice, that means stolen credentials or tokens can still yield legitimate access when MFA, policy enforcement, or coverage across all user groups is incomplete.

Q: Why do identity attacks keep succeeding even when organisations say they are aligned?

A: Alignment claims often hide a measurement mismatch. Security may talk about maturity and blocked attempts, while finance evaluates business impact, cost avoidance, and continuity. If those frameworks are not shared, foundational identity controls remain underfunded or only partly implemented, and attackers continue to find usable gaps.

Q: How do teams know if identity security controls are actually working?

A: Identity security controls are working when teams can show a current view of high-risk entitlements, detect privilege drift quickly, and remove access before exposure spreads. A useful sign is reduced time between entitlement change and policy review. Another is fewer unresolved conflicts between approved access and actual production permissions.

Q: Who should own the risk when identity investment gaps persist?

A: Ownership should sit with executive leadership, because persistent gaps are a governance problem as much as a technical one. When CISO and CFO discussions stay at director level, the organisation tends to optimise local budgets rather than enterprise risk. The result is delayed funding for controls that attackers already know how to bypass.

Technical breakdown

Why identity attacks still land despite mature tooling

Identity-based attacks often succeed through legitimate authentication paths, not by breaking cryptography or exploiting exotic flaws. Stolen credentials and hijacked tokens can work when the environment has partial MFA coverage, weak conditional access, or inconsistent policy enforcement. The mechanism is governance failure rather than technical impossibility: the control exists, but it is not universally deployed or maintained. That creates a wide enough gap for attackers to blend into ordinary access flows and avoid noisy exploitation techniques. In practice, this means identity security must be measured by deployment completeness and enforcement quality, not by whether a control exists on paper.

Practical implication: Treat partial control rollout as an active exposure, not as a completed security measure.

Why budget language changes control adoption

Security teams and finance teams often evaluate risk through different lenses. Security leaders tend to describe maturity, blocked attacks, and incident metrics, while finance leaders look for cost avoidance, business continuity, and risk reduction tied to enterprise goals. When those languages do not align, foundational controls compete poorly against other investments, even when the threat is well understood. The technical issue is that deployment decisions for MFA, configuration hardening, and monitoring are not purely engineering choices; they depend on whether the organisation can justify operational friction and recurring cost in business terms.

Practical implication: Translate control gaps into financial exposure so funding decisions can be made on shared criteria.

What overreliance on metrics can hide in identity programmes

A security programme can appear active while still leaving key identity controls incomplete. Reporting on threats blocked, incident counts, or maturity scores can obscure the more important question: are the controls actually enforced across the full identity estate, including privileged users, service accounts, and external access paths? The article’s central lesson is that success depends on where controls are deployed and how consistently they are maintained, not on the existence of dashboard metrics. For identity governance, the real signal is whether high-risk access paths are covered end to end.

Practical implication: Audit enforcement coverage across the identity estate instead of relying on program-level activity metrics.

Threat narrative

Attacker objective: The attacker wants valid account access that bypasses defensive scrutiny and enables follow-on compromise through trusted identity paths.

1. Entry occurs through stolen credentials or hijacked authentication tokens that are accepted as legitimate access.
2. Escalation happens when partially deployed or misconfigured controls fail to block the session before account access is established.
3. Impact follows as attackers use that access to operate through normal identity channels and reach accounts that should have been protected.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Finance-security misalignment is now an identity control issue, not just a communication issue. When funding, risk language, and deployment priorities diverge, the organisation leaves known access paths partially governed. That creates predictable openings for credential abuse, token theft, and failed enforcement of MFA. The practitioner conclusion is that security-finance alignment must be treated as part of the control environment, not as a soft management exercise.

Identity attacks keep succeeding because partial deployment is a control failure with a governance wrapper. The article shows that controls such as MFA can work when enforced, but many environments never finish the job. That means the core problem is not lack of tooling, but lack of complete adoption, configuration discipline, and ongoing oversight. The practitioner conclusion is to measure identity control completeness, not just tool presence.

Budget conversations need a named concept: identity control funding gap. This is the distance between recognising identity risk and paying to close it at scale across users, workloads, and privileged access. In a mature IAM programme, that gap should shrink as the organisation ties risk to financial exposure and operational continuity. The practitioner conclusion is to make unresolved identity control funding gaps visible at executive level.

Foundational controls still matter more than threat sophistication. The attacks described here are effective because they meet environments where the basics were never fully finished. That pattern applies across IAM, PAM, NHI governance, and adjacent controls such as configuration and patch discipline. The practitioner conclusion is to prioritise consistent enforcement of the basics before chasing incremental detection sophistication.

The identity layer and the finance layer now intersect in the same failure mode. If the business cannot translate identity risk into the metrics finance uses, the result is underinvestment in access controls, monitoring, and resilience. That makes identity governance a cross-functional discipline, not a narrow IAM task. The practitioner conclusion is to align control reporting with enterprise risk language and decision cycles.

What this signals

Identity control funding gap: the real risk is not that organisations lack security tools, but that they fail to fund complete deployment and enforcement across the identity estate. Once finance and security use different risk languages, the budget process itself becomes part of the attack surface.

Security leaders should expect identity governance to be judged increasingly by business impact, not by control inventory. That means MFA coverage, access policy enforcement, and privileged access controls need to be reported as exposure reduction, not as program activity.

Where identity attacks succeed repeatedly, the issue is usually not attacker sophistication but unfinished fundamentals. The practitioner signal is clear: incomplete rollout, inconsistent configuration, and weak cross-functional ownership are the conditions that keep known identity attacks viable.

For practitioners

• Define a funding threshold for identity controls Set a formal rule for when MFA, conditional access, and privileged access controls must be funded and enforced across all in-scope populations, not piloted indefinitely.
• Measure deployment completeness, not just control availability Track whether identity controls are fully enabled for employees, contractors, admins, service accounts, and external access paths, then report coverage gaps as risk items.
• Translate identity risk into business exposure Map high-probability identity attack paths to downtime, recovery cost, and regulatory exposure so budget requests can be evaluated in the language finance uses.
• Escalate unresolved gaps to executive ownership Move recurring identity funding and deployment gaps into CISO-CFO review rather than leaving them at director level, where strategic trade-offs are harder to settle.
• Audit the fundamentals on a fixed cadence Recheck MFA enforcement, authentication policy consistency, and access coverage regularly so controls do not drift back into partial deployment after initial rollout.

Key takeaways

• Identity attacks continue to succeed when basic controls are only partly deployed and not consistently enforced across the access estate.
• The article links that operational weakness to a finance-security language gap that slows or distorts funding decisions.
• The practical response is to translate identity control gaps into business risk and verify coverage, not just tool presence.

Key terms

• Identity Coverage: The portion of an organisation’s application and account estate that is actually reachable by central identity controls. For disconnected environments, coverage is not just about count or inventory. It is about whether policy, lifecycle, and verification can be enforced end to end.
• Finance-Security Alignment: The ability of security leaders and finance leaders to use the same risk language when deciding what to fund and why. In practice, it determines whether foundational controls are approved early, delayed, or left partially implemented.
• Partial Control Deployment: A state in which a security control exists but does not apply consistently across the environment. This is a common failure mode for identity security because attackers only need one unprotected path to turn a theoretical safeguard into a practical gap.
• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is built for teams that need a shared language for access risk, control coverage, and governance decisions.