Topic starter
19/08/2026 4:01 pm
TL;DR: Attackers still prefer the cheapest path, with identity incidents dominating 68.6% of events and 52.3% blocked by basic controls, according to Expel. Identity and access coverage now decides how much risk the core controls can remove before more advanced tools are needed.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Cybersecurity ROI: why boring security is your best investment”.
By the numbers:
- Identity attacks made up 68.6% of incidents in Expel’s 2026 Annual Threat Report.
- Over half of identity attacks, 52.3%, were immediately blocked by existing controls such as conditional access policies and multi-factor authentication.
- Expel’s research surveyed 300 CISOs and CFOs about the security-finance relationship.
Key questions
Q: Why do identity controls produce the clearest cybersecurity ROI?
A: Identity controls produce clear ROI because they directly reduce the probability of account takeover and the scale of misuse after access is granted.
Q: What do security teams get wrong about boring controls?
A: Teams often treat fundamentals as low-status work instead of the controls that most consistently reduce real losses.
Q: What breaks when security protocols are not followed and enforced consistently?
A: When security protocols are treated as optional, sensitive data can be left exposed on cloud systems, password controls may be absent, and multiple parties can access information before anyone notices.
Practitioner guidance
- Strengthen conditional access before expanding advanced detections Make login location, device trust and authentication strength part of every access decision so common identity attacks fail before session creation.
- Treat MFA as baseline loss prevention Require phishing-resistant MFA for privileged and high-risk users, then extend coverage to the identity classes that generate repeat incidents.
- Use patch compliance as a board metric Track critical vulnerability remediation by business service so finance can see where unpatched systems still create avoidable exposure.
Bottom line: Attackers still prefer the lowest-cost path, which keeps identity, access and patching at the centre of practical defence.
Glossary terms: Conditional Access, Phishing-Resistant MFA, Least Privilege, Identity Security ROI
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
19/08/2026 4:37 pm
Boring controls are the real resilience layer: The market still overvalues novel attack narratives and undervalues the controls that most often decide whether an attack succeeds. Expel’s analysis reinforces a familiar but uncomfortable truth: attackers follow the easiest path, and that path usually runs through identity, access and configuration. For practitioners, the lesson is to fund the controls that shrink the attack surface first, because that is where measurable loss reduction happens.
A question worth separating out:
Q: How should security leaders explain control investment to finance?
A: Frame investment around business enablement, measurable risk reduction and the cost of not acting. Finance usually responds better to blocked incidents, reduced exposure and safer delivery of business initiatives than to abstract threat language. The strongest case shows how a control changes both operational resilience and expected loss.
👉 Read our full editorial: Boring security controls deliver the clearest cybersecurity ROI