How do you know if cybersecurity spending is actually working?

Why This Matters for Security Teams

Cybersecurity spending is only working if it measurably reduces exposure, slows attackers, and shortens recovery. Budgets that add tools without improving control performance often create more dashboards than resilience. For NHI-heavy environments, the real question is whether spending is shrinking the attack surface around service accounts, API keys, OAuth grants, and secrets. NHIMG research shows that only the Ultimate Guide to NHIs reports 79% of organisations have experienced secrets leaks, with 77% causing tangible damage.

That matters because identity failures rarely show up as a clean budget failure. They show up as over-privileged credentials that linger, secrets that stay valid after notification, and access paths that are never removed fast enough. A programme can look busy while still leaving the organisation exposed to the same abuse patterns documented in The 52 NHI breaches Report and in current CISA cyber threat advisories. In practice, many security teams discover poor spending efficiency only after a credential or access path has already been abused, rather than through intentional measurement.

How It Works in Practice

The most reliable way to judge whether spending is working is to track control outcomes, not tool counts. That means measuring whether access is becoming narrower, secrets are becoming shorter-lived, and response is becoming faster. For NHI governance, useful indicators include rotation latency, standing privilege reduction, dormant account cleanup, secrets-in-code reduction, and time-to-revoke after offboarding or compromise. These are the operational signals that translate spend into risk reduction.

For example, if investment goes into vaulting and lifecycle automation, the organisation should see fewer long-term secrets in code and config, fewer exposed credentials in CI/CD, and faster revocation when a token is suspected compromised. If investment goes into monitoring, the programme should detect abnormal API usage, third-party OAuth exposure, and privilege drift sooner. NIST control families are useful here because they focus attention on control effectiveness, not just policy existence. NIST SP 800-53 Rev. 5 gives a practical structure for measuring access control, auditability, and incident handling.

NHIMG research also shows why these metrics matter: 71% of NHIs are not rotated within recommended time frames, and 96% of organisations store secrets outside secrets managers in vulnerable locations. If a spend programme does not move those numbers in the right direction, it is not reducing exposure in a meaningful way. The control question should be simple: are identities easier to remove, harder to misuse, and less likely to be found in places they should never have been? That is also how to test whether the organisation is closing the operational gaps described in Top 10 NHI Issues.

These controls tend to break down in legacy estates with hard-coded secrets, shared service accounts, and inconsistent ownership because the environment cannot produce trustworthy lifecycle data.

Common Variations and Edge Cases

Tighter measurement often increases reporting overhead, requiring organisations to balance better assurance against the cost of instrumenting every control path. That tradeoff is real when spending spans cloud, DevOps, and legacy infrastructure, because each environment exposes different identity signals and different failure modes.

There is no universal standard for this yet, but current guidance suggests looking for trend lines rather than a single ROI number. In mature environments, spending should produce faster secret rotation, fewer excessive privileges, lower exposure in third-party integrations, and shorter dwell time after incidents. In distributed environments, the same spend may show up first as better inventory accuracy or improved offboarding speed, not immediate breach reduction.

• In regulated industries, audit readiness can be a valid intermediate outcome if it reflects real control improvement.
• In cloud-native environments, better spend often appears as shorter token TTLs and stronger workload identity coverage.
• In merger or acquisition scenarios, the first win may be visibility, because no measurement baseline existed before integration.

For identity-centric programmes, the best external check is whether attackers have fewer durable credentials to steal and fewer standing paths to exploit. That is why the most useful evidence often looks like reduced privilege, reduced persistence, and reduced time to remediate, not a neat accounting ratio.

Related resources from NHI Mgmt Group

• How do you know if a cybersecurity mesh architecture is actually working?
• How do you know whether cybersecurity nudges are actually working?
• How do you know if agent identity controls are actually working?
• How do you know if Oracle access governance is actually working?