Topic starter
11/07/2026 8:32 pm
TL;DR: Delaying modernization leaves organisations exposed to avoidable resilience failures, according to Illumio’s interview with Tony Scott, with the 2015 OPM response cited as proof that faster MFA, privilege reduction, and patching can materially change outcomes. The practical lesson is that resilience is a design discipline, not a recovery plan, and waiting for a breach usually makes the eventual fix more expensive and less effective.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “What Are You Waiting For? Delaying Cyber Modernization Is Putting You at Risk”.
Key questions
Q: What breaks when cyber modernization is repeatedly deferred?
A: Deferred modernization leaves organisations with stale authentication, inconsistent patching, and privilege sprawl that enlarge the blast radius of both attacks and outages.
Q: Why do privilege reduction and MFA matter so much to resilience?
A: Because they directly reduce how much damage a compromised account or system can do.
Q: What are the signs that modernization gaps are becoming operational risk?
A: Common signs include large numbers of unpatched systems, broad exceptions to access policy, legacy assets with unclear ownership, and critical services that still rely on standing administrative access.
Practitioner guidance
- Reduce standing privileged access now Audit administrative and elevated accounts for permanent access that can be replaced with task-scoped permissions, and remove unnecessary escalation paths from legacy systems.
- Treat MFA coverage as a resilience metric Measure authentication coverage across high-value systems and prioritise gaps where remote access, privileged login, or third-party access still bypass stronger authentication.
- Build modernization queues around exposure, not age Rank replacement and remediation work by blast radius, dependency criticality, and exposure to failure, rather than by system age or calendar planning.
Bottom line: Delaying cyber modernization keeps known exposure conditions in place, so resilience gaps widen even when no incident is visible yet.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:02 pm
Modernization delay is now a control failure, not a planning issue. When organisations defer patching, privilege cleanup, and authentication upgrades, they preserve the exact conditions that turn routine disruption into systemic fragility. The risk is not abstract technical debt but a widening exposure window that resilience plans cannot fully absorb. Practitioners should treat delayed modernization as an active governance defect.
A question worth separating out:
Q: How should organisations balance recovery planning and resilience engineering?
A: Recovery planning should answer how to restore service after failure, but resilience engineering should answer how to keep critical functions operating while the failure is contained. Organisations need both, yet resilience has to come first in design decisions because it reduces the scale of the event that recovery must absorb. That balance is especially important in identity-heavy environments.
👉 Read our full editorial: Cyber modernization delays are creating avoidable resilience gaps