Topic starter
19/08/2026 4:01 pm
TL;DR: Attackers usually choose the cheapest path, according to Expel’s webinar-based analysis of 300 CISOs and CFOs, while identity incidents still dominated 68.6% of events and 52.3% were blocked by basic controls such as MFA and conditional access. The security case for finance is now about measurable risk reduction, business enablement, and the cost of leaving fundamentals unfinished.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “Cybersecurity ROI: why boring security is your best investment”.
By the numbers:
- Identity attacks made up 68.6% of incidents in Expel’s 2026 Annual Threat Report.
- Over half of identity attacks, 52.3%, were immediately blocked by existing controls such as conditional access policies and multi-factor authentication.
- Expel’s research surveyed 300 CISOs and CFOs about the security-finance relationship.
Key questions
Q: What breaks when security protocols are not followed and enforced consistently?
A: When security protocols are treated as optional, sensitive data can be left exposed on cloud systems, password controls may be absent, and multiple parties can access information before anyone notices.
Q: Why do identity controls produce the clearest cybersecurity ROI?
A: Identity controls produce clear ROI because they directly reduce the probability of account takeover and the scale of misuse after access is granted.
Q: What do security teams get wrong about boring controls?
A: Teams often treat fundamentals as low-status work instead of the controls that most consistently reduce real losses.
Practitioner guidance
- Strengthen conditional access before expanding advanced detections Make login location, device trust and authentication strength part of every access decision so common identity attacks fail before session creation.
- Treat MFA as baseline loss prevention Require phishing-resistant MFA for privileged and high-risk users, then extend coverage to the identity classes that generate repeat incidents.
- Use patch compliance as a board metric Track critical vulnerability remediation by business service so finance can see where unpatched systems still create avoidable exposure.
Bottom line: Attackers still prefer the lowest-cost path, which keeps identity, access and patching at the centre of practical defence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:37 pm
Boring controls are the real resilience layer: The market still overvalues novel attack narratives and undervalues the controls that most often decide whether an attack succeeds. Expel’s analysis reinforces a familiar but uncomfortable truth: attackers follow the easiest path, and that path usually runs through identity, access and configuration. For practitioners, the lesson is to fund the controls that shrink the attack surface first, because that is where measurable loss reduction happens.
A question worth separating out:
Q: How should security leaders explain control investment to finance?
A: Frame investment around business enablement, measurable risk reduction and the cost of not acting. Finance usually responds better to blocked incidents, reduced exposure and safer delivery of business initiatives than to abstract threat language. The strongest case shows how a control changes both operational resilience and expected loss.
👉 Read our full editorial: Boring security controls deliver the clearest cybersecurity ROI