Topic starter
09/07/2026 3:25 pm
TL;DR: Consumers punish breach exposure but still practice risky habits such as password reuse and public Wi-Fi, turning security into a trust and loyalty issue rather than a back-office concern, according to Commvault research from a survey of more than 1,000 New Yorkers. The lesson for identity teams is that resilience now has to cover people, systems, and recovery assumptions at once.
Editorial analysis by NHI Mgmt Group, based on content published by Commvault: “The Trust Tightrope: Why New Yorkers Demand More from Businesses Than They Do from Themselves”.
Key questions
Q: How should security teams reduce trust loss after a customer data breach?
A: Security teams should reduce trust loss by treating breach response as a customer identity and recovery issue, not only an incident management issue.
Q: Why do weak recovery processes damage consumer trust even when authentication is strong?
A: Weak recovery processes damage trust because customers experience them as proof that the organisation cannot reliably protect or restore their access.
Q: What are the signs that resilience is not really supporting customer trust?
A: The main signs are delayed restoration, inconsistent messaging, repeat support friction, and customer churn after incidents.
Practitioner guidance
- Map customer trust to recovery controls Review where account recovery, session recovery, breach notification, and service restoration sit in separate workflows.
- Harden customer-facing identity flows Assume users will keep choosing convenience over perfect hygiene and design controls that contain the resulting risk.
- Test breach communication against trust loss Measure whether incident messaging explains impact, recovery timing, and user action clearly enough to preserve confidence.
Bottom line: Consumer trust is now shaped by how well an organisation protects and restores access after a breach, not just by whether a breach occurs.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:44 pm
Consumer trust is now an identity governance problem, not a communications afterthought. The article shows that people are willing to punish breach exposure even when they themselves accept convenience trade-offs such as password reuse. That means trust is being evaluated at the identity boundary where access, recovery, and assurance meet. Organisations that still treat trust as a downstream marketing issue will miss the operational controls that actually preserve it.
A question worth separating out:
Q: What should organisations prioritise first, breach prevention or recovery readiness?
A: Organisations should prioritise both, but recovery readiness often exposes gaps faster because customers judge the aftermath immediately. Prevention reduces likelihood, while recovery determines whether a breach becomes a trust event. If one must move first, teams should ensure they can restore access, communicate clearly, and avoid compounding harm during response.
👉 Read our full editorial: Consumer trust now depends on resilience, not just breach response