Notifications
Clear all
Topic starter
02/08/2026 11:59 am
TL;DR: Boards fund security when leaders turn abstract risk into bounded decisions, expected loss, and clear tradeoffs, according to Aikido’s analysis. The practical shift is away from posture dashboards and toward decision support, containment, and measurable uncertainty reduction.
NHIMG editorial — based on content published by Aikido: How to Get Your Board to Care About Security (Before a Breach Forces the Issue)
By the numbers:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- Only 5.7% of organisations have full visibility into their service accounts.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: How should security teams quantify identity risk for board reporting?
A: Start by linking identity and access failures to the business processes they can affect, then score each scenario by likelihood, financial exposure, and remediation effort.
Q: Why do non-human identities change the security model?
A: Non-human identities change the model because they create high-volume, machine-driven access that can outlive the work they were created for.
Q: What do teams get wrong when they report security success to the board?
A: They often report output instead of outcome.
Practitioner guidance
- Translate identity metrics into decision narratives Report on service account exposure, privileged access scope, and revocation latency in terms of business risk, likely blast radius, and expected operational impact.
- Prioritise containment over control volume Show the board which identity failures would let an attacker move laterally, persist, or escalate privileges, then map those paths to the smallest set of controls that shrink blast radius.
- Use bounded evaluation for identity tooling decisions Define a timeboxed evaluation for IAM, PAM, or NHI controls with explicit success criteria, such as reduced exposure windows, faster detection, and clearer ownership.
What's in the full article
Aikido's full guide covers the operational detail this post intentionally leaves for the source:
- The board-question framing and talk-track examples that turn risk metrics into executive decisions.
- The specific objection-handling patterns for cost, compliance, and build-versus-buy conversations.
- The practical examples of breach cost, recovery disruption, and resilience-oriented reporting.
- The step-by-step structure for running a bounded proof-of-concept as a decision tool.
👉 Read Aikido's guide on getting your board to care about security →
Board-ready security decisions: what security teams need to change?
Explore further
02/08/2026 1:06 pm
Boards do not fund security because it is important, they fund it when the decision becomes rational. The article’s strongest insight is that security leaders must turn uncertainty into a bounded choice. That logic is directly relevant to IAM and PAM, where access scope, privilege duration, and revocation speed determine whether risk feels abstract or actionable. Practitioners should frame identity controls as decision support for the board, not as technical housekeeping.
A question worth separating out:
Q: Who is accountable when a vulnerability becomes an identity-driven breach?
A: Accountability spans application owners, cloud platform teams, and identity governance teams because the failure crosses security domains. Patch management addresses the flaw, but IAM controls determine the blast radius. A mature programme assigns ownership for workload permissions, trust relationships, and post-exploit containment so the same incident does not recur.
👉 Read our full editorial: Board-ready security decisions: how to turn risk into action
