Notifications
Clear all
Topic starter
01/08/2026 10:43 pm
TL;DR: Cybersecurity failures are often organisational failures, because ownership, incentives, and consequences are disconnected across the enterprise, according to Abstract Security’s commentary. The real security test is whether controls close the loop between finding, decision, and outcome, not whether dashboards look green.
NHIMG editorial — based on content published by Abstract Security: Why Cybersecurity Leadership is an Organizational Problem First
Questions worth separating out
Q: How should security teams turn accountability into a measurable identity control?
A: Security teams should assign one owner for approval, one for review, and one for revocation, then measure whether each step completes on time.
Q: Why do cloud security dashboards often fail to improve posture?
A: Because visibility does not create action on its own.
Q: What breaks when ownership and consequence are separated?
A: Findings age, exceptions persist, and teams optimise for reporting instead of risk reduction.
Practitioner guidance
- Assign outcome owners for every control decision Require a named owner for access approvals, risk acceptances, privileged exceptions, and remediation deferrals so the consequence of failure is traceable to a specific role.
- Validate controls in real operating conditions Test identity workflows, detections, and escalation paths during normal business pressure, not only during audits or implementation rehearsals, so failures surface before incident response.
- Replace completion metrics with exposure metrics Track whether access scope, privilege duration, and exception count actually shrink after remediation instead of relying on ticket closure or dashboard colour.
What's in the full article
Abstract Security's full article covers the organisational and leadership detail this post intentionally leaves for the source:
- The article expands on the feedback-loop model and how it maps to security decision-making.
- It outlines the three-step accountability architecture described by Carl Saiyed for closing organisational loops.
- It discusses how teams should think about turning visible risk into owned consequence across the enterprise.
- It includes the author’s leadership framing on why technology works best when incentives and ownership are aligned.
👉 Read Abstract Security's analysis of why cybersecurity leadership is an organisational problem →
Cybersecurity leadership and the accountability gap teams are missing?
Explore further
01/08/2026 10:53 pm
Accountability is the missing control plane in many security programmes. The article is right that technology cannot fix a governance model in which decision makers are insulated from consequences. In identity terms, that insulation is what allows stale access, unowned exceptions, and over-privileged accounts to persist. Security teams should treat accountability as a control plane, because without it, even accurate telemetry produces weak outcomes.
A question worth separating out:
Q: Who is accountable when a control looks effective but does not reduce risk?
A: The accountable party is the owner of the outcome, not just the person who configured the tool or closed the ticket. Organisations should define responsibility for residual risk, remediation, and verification so that security cannot be reduced to compliance theatre.
👉 Read our full editorial: Cybersecurity leadership fails when accountability loops stay open
