Topic starter
20/08/2026 5:21 pm
TL;DR: Operating model complexity, not tool count, drives security at scale in large enterprises, according to Sprocket Security. Legacy systems, regulation, and interdependence make ownership clarity and compensating controls central to keeping risk decisions consistent.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “Ahead of the Breach - Citi's Ryan Hays Navigating Risk and Resilience at Scale”.
Key questions
Q: What breaks when legacy systems and modern security controls collide?
A: Controls often fail at the integration boundary.
Q: How do security teams know whether communication is strong enough during risk events?
A: They should look for whether decisions move quickly enough across security, IT, and business ownership boundaries.
Q: Why does security governance become harder at enterprise scale?
A: Because risk decisions stop being local.
Practitioner guidance
- Map enterprise risk ownership across business and technical layers Document who owns each major risk decision, including exception approval, escalation, and remediation authority.
- Inventory legacy dependencies that constrain control changes Identify where older platforms limit authentication, logging, segmentation, or recovery improvements.
- Build communication paths for high-impact security decisions Establish an explicit path for translating technical risk into business impact, including who must be informed, when escalation occurs, and what decision thresholds apply.
Bottom line: Security at scale is driven by operating model complexity, not just by the number of tools deployed.
Glossary terms: Security At Scale, Compensating Control, Decision latency, Legacy System Resilience Debt
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
20/08/2026 6:12 pm
Security at scale is a governance problem before it is a tooling problem. Once an organisation becomes sufficiently interconnected, technical controls cannot succeed in isolation because ownership, exceptions, and dependencies determine whether the control is actually enforceable. That is why large-enterprise security increasingly resembles operating model design. The practitioner conclusion is that governance maturity becomes a first-order security control.
A question worth separating out:
Q: How should IAM teams adapt when access governance no longer fits the pace of the business?
A: They should tighten ownership and review around the highest-risk access paths first, especially privileged and third-party access. When scale increases, stale approvals and unclear accountability become more dangerous than isolated technical defects. The objective is to make access decisions visible, reviewable, and timely enough for the organisation’s current operating tempo.
👉 Read our full editorial: Security at scale: what large enterprises change about risk