Topic starter
19/08/2026 3:54 pm
TL;DR: 68.6% of cases were identity-based, and 47.7% of those led to successful account access in Expel’s 2026 Annual Threat Report data. Identity controls stay brittle when coverage and enforcement are uneven across the access estate.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Cybersecurity ROI: Attackers benefit from security & finance misalignment”.
Key questions
Q: Why do identity attacks keep succeeding even when organisations say they are aligned?
A: Alignment claims often hide a measurement mismatch.
Q: How do teams know if identity security controls are actually working?
A: Identity security controls are working when teams can show a current view of high-risk entitlements, detect privilege drift quickly, and remove access before exposure spreads.
Q: What fails when identity controls are only partially deployed?
A: Partial deployment creates a false sense of coverage.
Practitioner guidance
- Define a funding threshold for identity controls Set a formal rule for when MFA, conditional access, and privileged access controls must be funded and enforced across all in-scope populations, not piloted indefinitely.
- Measure deployment completeness, not just control availability Track whether identity controls are fully enabled for employees, contractors, admins, service accounts, and external access paths, then report coverage gaps as risk items.
- Translate identity risk into business exposure Map high-probability identity attack paths to downtime, recovery cost, and regulatory exposure so budget requests can be evaluated in the language finance uses.
Bottom line: Identity attacks continue to succeed when basic controls are only partly deployed and not consistently enforced across the access estate.
Glossary terms: Identity Coverage, Finance-Security Alignment, Partial Control Deployment, Identity Governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
19/08/2026 4:30 pm
Finance-security misalignment is now an identity control issue, not just a communication issue. When funding, risk language, and deployment priorities diverge, the organisation leaves known access paths partially governed. That creates predictable openings for credential abuse, token theft, and failed enforcement of MFA. The practitioner conclusion is that security-finance alignment must be treated as part of the control environment, not as a soft management exercise.
A question worth separating out:
Q: Who should own the risk when identity investment gaps persist?
A: Ownership should sit with executive leadership, because persistent gaps are a governance problem as much as a technical one. When CISO and CFO discussions stay at director level, the organisation tends to optimise local budgets rather than enterprise risk. The result is delayed funding for controls that attackers already know how to bypass.
👉 Read our full editorial: Finance-security misalignment is letting identity attacks keep succeeding
This post was modified 1 day ago by NHI Mgmt Group