Topic starter
19/08/2026 3:54 pm
TL;DR: Identity-based incidents accounted for 68.6% of cases and 47.7% of those led to successful account access, according to Expel’s 2026 Annual Threat Report, while its CISO-CFO disconnect report shows budget and language gaps that leave basic controls underfunded. The real problem is governance: organisations still fail on controls they already understand.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Cybersecurity ROI: Attackers benefit from security & finance misalignment”.
Key questions
Q: What fails when identity controls are only partially deployed?
A: Partial deployment creates a false sense of coverage.
Q: Why do identity attacks keep succeeding even when organisations say they are aligned?
A: Alignment claims often hide a measurement mismatch.
Q: How do teams know if identity security controls are actually working?
A: Identity security controls are working when teams can show a current view of high-risk entitlements, detect privilege drift quickly, and remove access before exposure spreads.
Practitioner guidance
- Define a funding threshold for identity controls Set a formal rule for when MFA, conditional access, and privileged access controls must be funded and enforced across all in-scope populations, not piloted indefinitely.
- Measure deployment completeness, not just control availability Track whether identity controls are fully enabled for employees, contractors, admins, service accounts, and external access paths, then report coverage gaps as risk items.
- Translate identity risk into business exposure Map high-probability identity attack paths to downtime, recovery cost, and regulatory exposure so budget requests can be evaluated in the language finance uses.
Bottom line: Identity attacks continue to succeed when basic controls are only partly deployed and not consistently enforced across the access estate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:30 pm
Finance-security misalignment is now an identity control issue, not just a communication issue. When funding, risk language, and deployment priorities diverge, the organisation leaves known access paths partially governed. That creates predictable openings for credential abuse, token theft, and failed enforcement of MFA. The practitioner conclusion is that security-finance alignment must be treated as part of the control environment, not as a soft management exercise.
A question worth separating out:
Q: Who should own the risk when identity investment gaps persist?
A: Ownership should sit with executive leadership, because persistent gaps are a governance problem as much as a technical one. When CISO and CFO discussions stay at director level, the organisation tends to optimise local budgets rather than enterprise risk. The result is delayed funding for controls that attackers already know how to bypass.
👉 Read our full editorial: Finance-security misalignment is letting identity attacks keep succeeding