What do organisations get wrong about cybersecurity and sustainability?

Why This Matters for Security Teams

Organisations usually split cybersecurity and sustainability into different reporting lanes, then miss how tightly they interact in production. If access is overbroad, a device is unmanaged, or a service outage drags on, the result is not just a security incident. It can also mean wasted energy, disrupted operations, unsafe fallback processes, and avoidable hardware replacement. That is why NHI Management Group treats identity, continuity, and environmental impact as connected control problems rather than separate dashboards.

The practical issue is that modern environments depend on non-human identities, APIs, automation, and connected devices that keep operating when people are not watching. When those identities are poorly governed, organisations often compensate by leaving systems on longer, restarting them more often, or replacing components that could have been remediated. NHIMG’s The 52 NHI breaches Report shows how identity failures repeatedly become operational failures, not just security findings. Industry guidance from CISA cyber threat advisories reinforces that resilience and security controls must be maintained together, especially when critical services are digitally mediated.

In practice, many security teams encounter sustainability waste only after an incident has already forced prolonged downtime, emergency manual work, or unnecessary asset turnover.

How It Works in Practice

The control model works best when sustainability outcomes are treated as downstream effects of identity, asset, and recovery decisions. A connected device or agent should have only the access required for its current task, for the shortest time possible, with clear ownership and logging. That reduces the chance of lateral movement, runaway automation, and prolonged containment work, all of which increase both security risk and resource consumption.

For operational teams, this usually means combining privileged access controls, device governance, and resilience planning. A practical approach is to map every high-impact service to the identities that can touch it, then review whether those identities are persistent, overprivileged, or difficult to revoke. If a workload or device can be remediated remotely, that is usually preferable to physical replacement. If a service can fail over cleanly, the organisation avoids both extended downtime and the energy cost of ad hoc recovery. NHIMG’s Ultimate Guide to NHIs — Key Challenges and Risks is useful here because it frames NHI sprawl, credential drift, and monitoring gaps as operational risks that compound over time.

• Use short-lived credentials for automated services instead of long-lived shared secrets.
• Tie device and workload ownership to named teams so remediation is faster and less wasteful.
• Measure recovery time, failed access attempts, and replacement events together, not separately.
• Prefer policy enforcement at runtime rather than broad standing access that outlives the task.

Current guidance suggests aligning sustainability targets to the same control points used for cyber governance, but there is no universal standard for this yet. These controls tend to break down in highly distributed environments with legacy devices because ownership is unclear and remote revocation is incomplete.

Common Variations and Edge Cases

Tighter security controls often increase operational overhead, so organisations have to balance reduced risk against faster response, device lifespan, and reporting burden. The main tradeoff is that aggressive lock-down can create more manual exceptions, which may themselves increase waste if teams start replacing rather than repairing assets.

One common edge case is legacy operational technology. In those environments, a patched or fully segmented architecture may be the right long-term goal, but short-term sustainability goals can be undermined if teams rush to decommission equipment without a safe migration path. Another edge case is cloud and SaaS sprawl, where each service may look efficient on its own, yet duplicated identities, duplicated logs, and duplicated retention policies create hidden overhead. In these cases, the right question is not only whether controls are “secure enough,” but whether they reduce avoidable churn across systems.

Best practice is evolving, especially for organisations trying to connect carbon, resilience, and access governance in one operating model. The most useful lens is to ask whether identity decisions shorten outages, reduce emergency interventions, and extend the useful life of equipment. That is also where the security signal becomes clearer in real incidents. As Top 10 NHI Issues shows, credential sprawl and weak governance turn small misconfigurations into repeated operational cost, while broader threat context from MITRE ATLAS adversarial AI threat matrix helps teams understand how automation can compound failure modes.

Related resources from NHI Mgmt Group

• What do organisations get wrong about breach defence and cybersecurity frameworks?
• What do organisations get wrong about cybersecurity training APIs?
• What do organisations get wrong about combining fraud prevention with cybersecurity controls?
• What do organisations get wrong when they assume cybersecurity hiring is only about technical certifications and tool knowledge?