Topic starter
10/07/2026 9:08 pm
TL;DR: Persistent gaps in access management, MFA, passwordless adoption, and shared account control frame the 2026 state of identity security in finance around identity debt rather than isolated authentication failures, according to Secret Double Octopus. The finance sector still has unresolved governance and operating-model issues that undermine IAM, PAM, and NHI control assumptions.
Editorial analysis by NHI Mgmt Group, based on content published by Secret Double Octopus: “Blog”.
Key questions
Q: What breaks when shared accounts are still used for sensitive finance access?
A: Shared accounts break attribution, recertification, and incident investigation because the identity performing the action is no longer tied to a specific person or owner.
Q: Why do MFA deployments still leave organisations exposed to identity risk?
A: Because MFA only proves an identity at sign-in, it does not determine whether the identity should retain access afterward.
Q: How do organisations know whether passwordless access is actually improving security?
A: Look for reduced password dependence, fewer lockouts, lower help desk reset volume, and stronger control over high-risk workflows such as shared workstation access and privileged clinical systems.
Practitioner guidance
- Inventory shared accounts across privileged workflows Identify every shared account used in finance operations, then classify each by owner, purpose, and whether the account can be replaced with named access or delegated service identity.
- Test MFA coverage against real access paths Verify that MFA is enforced for the access paths staff actually use, including remote access, admin consoles, and exception routes that often bypass standard policy.
- Separate authentication uplift from authorization cleanup Treat passwordless adoption as a distinct workstream from entitlement review, privileged access cleanup, and recertification so stronger login assurance does not hide stale access.
Bottom line: Finance identity security problems often reflect identity debt across governance, not a single broken control or missing feature.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:31 pm
Identity debt is now a finance governance problem, not just an authentication problem. The report points to a sector where access management, MFA, passwordless adoption, and shared account control drift apart in practice. That is not a collection of isolated gaps. It shows that finance programmes can have modern controls on the books while still operating on legacy identity assumptions in production.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: When should finance teams prioritise access governance over new authentication methods?
A: Teams should prioritise access governance first when shared accounts, unclear ownership, or stale entitlements are already present. In that situation, new authentication methods will not repair the governance gap. Fixing who has access, why they have it, and when it should end produces more durable risk reduction.
👉 Read our full editorial: Finance identity security gaps show where MFA and access fail