Topic starter
20/08/2026 5:21 pm
TL;DR: Balancing innovation, risk management, and resilience in environments shaped by legacy systems, regulatory pressure, and interconnected operations is a central challenge for global institutions, according to Sprocket Security. The main lesson is that security at scale depends as much on communication, governance, and business alignment as it does on technical controls.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “Ahead of the Breach - Citi's Ryan Hays Navigating Risk and Resilience at Scale”.
Key questions
Q: Why does security governance become harder at enterprise scale?
A: Because risk decisions stop being local.
Q: What breaks when legacy systems and modern security controls collide?
A: Controls often fail at the integration boundary.
Q: How do security teams know whether communication is strong enough during risk events?
A: They should look for whether decisions move quickly enough across security, IT, and business ownership boundaries.
Practitioner guidance
- Map enterprise risk ownership across business and technical layers Document who owns each major risk decision, including exception approval, escalation, and remediation authority.
- Inventory legacy dependencies that constrain control changes Identify where older platforms limit authentication, logging, segmentation, or recovery improvements.
- Build communication paths for high-impact security decisions Establish an explicit path for translating technical risk into business impact, including who must be informed, when escalation occurs, and what decision thresholds apply.
Bottom line: Security at scale is driven by operating model complexity, not just by the number of tools deployed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:12 pm
Security at scale is a governance problem before it is a tooling problem. Once an organisation becomes sufficiently interconnected, technical controls cannot succeed in isolation because ownership, exceptions, and dependencies determine whether the control is actually enforceable. That is why large-enterprise security increasingly resembles operating model design. The practitioner conclusion is that governance maturity becomes a first-order security control.
A question worth separating out:
Q: How should IAM teams adapt when access governance no longer fits the pace of the business?
A: They should tighten ownership and review around the highest-risk access paths first, especially privileged and third-party access. When scale increases, stale approvals and unclear accountability become more dangerous than isolated technical defects. The objective is to make access decisions visible, reviewable, and timely enough for the organisation’s current operating tempo.
👉 Read our full editorial: Security at scale: what large enterprises change about risk