Notifications
Clear all
Topic starter
11/07/2026 8:32 pm
TL;DR: Delaying modernization leaves organisations exposed to avoidable resilience failures, according to Illumio’s interview with Tony Scott, with the 2015 OPM response cited as proof that faster MFA, privilege reduction, and patching can materially change outcomes. The practical lesson is that resilience is a design discipline, not a recovery plan, and waiting for a breach usually makes the eventual fix more expensive and less effective.
NHIMG editorial — based on content published by Illumio: Cyber resilience and the risks of delaying cyber modernization
By the numbers:
- In just over two months, Tony Scott’s team brought MFA adoption above 90%, reduced elevated privileges by two-thirds, and cut unpatched vulnerabilities from hundreds of thousands to just a few hundred.
Questions worth separating out
Q: What fails when organisations delay cyber modernization too long?
A: The main failure is governance drift.
Q: Why do identity and privilege controls matter so much for resilience?
A: Because they limit how far a compromise can spread.
Q: How do security teams know modernization is actually reducing risk?
A: They should look for fewer standing privileged accounts, higher MFA coverage, shorter patching cycles, and clearer inventory of human and non-human access.
Practitioner guidance
- Map modernization debt to identity risk Create a register that links outdated systems to MFA coverage, privileged access exposure, and patching lag.
- Tighten privileged access before the next review cycle Reduce standing elevated access, remove unnecessary admin roles, and require explicit approval for high-risk privilege paths.
- Use resilience testing to expose governance gaps Include identity and privilege failure scenarios in resilience exercises, such as MFA outage, privileged account compromise, and incomplete inventory.
What's in the full article
Illumio's full article covers the leadership framing and operational context this post intentionally leaves for the source:
- Tony Scott's commentary on why waiting for a breach usually makes modernization more expensive.
- The broader interview context around resilience, organizational friction, and AI-driven change.
- The discussion of people-first cybersecurity leadership and how teams maintain momentum through transformation.
- Additional examples from the podcast that expand the modernization argument beyond the OPM case.
👉 Read Illumio's analysis of why delaying cyber modernization increases resilience risk →
Cyber modernization delays: what resilience teams need to change now?
Explore further
11/07/2026 9:02 pm
Modernization delay is now an identity governance issue, not just an infrastructure issue. The article shows that weak MFA, uncontrolled privilege, and inconsistent patching do not stay isolated inside operations teams. They create governance debt that eventually lands in IAM, PAM, and access review workflows. For practitioners, the lesson is that modernization must be measured as a control-state problem, not a technology refresh.
A question worth separating out:
Q: Who is accountable when resilience fails because modernization was deferred?
A: Accountability sits with the business and security leaders who allowed known control gaps to persist. Governance frameworks such as the NIST Cybersecurity Framework 2.0 and NIST SP 800-53 both expect organisations to manage risk continuously, not wait for failure to force remediation.
👉 Read our full editorial: Cyber modernization delays are creating avoidable resilience gaps
