Why can two organisations with similar security posture still have different breach risk?

Why breach risk can diverge even when security posture looks similar

Two organisations can score similarly on controls and still face very different breach likelihood because posture only tells part of the story. Breach risk also depends on what is exposed to the internet, how many third parties can reach the environment, how much privilege is concentrated, and whether an attacker can move from one asset to another once inside.

A strong posture can still sit on top of a large attack surface. A weaker posture can sometimes be less exposed if it has fewer externally reachable services, fewer trust relationships, and tighter segmentation. That is why breach risk should be judged as posture plus exposure, not posture alone.

What changes the breach equation beyond control maturity

Similarity in control maturity does not mean similarity in attack path. Two firms may both have MFA, logging, patching, and incident response, yet one may expose more SaaS integrations, partner links, admin portals, or legacy internet-facing systems. Those differences change how easily an attacker can find initial access and how many routes exist to sensitive data or privileged workflows.

Historical loss patterns also matter. Prior incidents often reveal where an organisation has repeated weaknesses, such as stale external accounts, weak offboarding, or overexposed service credentials. A current control review may look healthy while the organisation still carries inherited exposure that the breach path can exploit. For identity-heavy exposure patterns, an Identity Security Posture Management (ISPM) Guide is useful because it connects posture findings to attack paths rather than treating them as isolated configuration issues.

External reach also changes blast radius. If one environment allows broad partner connectivity, shared tokens, or reused machine credentials, a single compromise can spread farther than it would in a more constrained design. That is why the same “good” control score can coexist with very different breach impact.

How practitioners should compare risk when posture scores look alike

When two organisations appear similar on paper, compare the exposure model, not just the control checklist. The more useful question is: what can an attacker actually reach, authenticate to, and move through?

• Inventory exposed services, partner connections, and externally reachable admin paths.
• Separate internal control maturity from identity and network exposure.
• Review third-party and federated access as part of the breach path, not as a procurement detail.
• Check whether privileged access is narrowly scoped or broadly reusable across systems.

A practical way to validate this is to look at segmentation, privilege boundaries, and internet exposure together. If one organisation has similar governance maturity but materially more external entry points, it should usually be treated as higher breach risk even before any specific vulnerability is found.

Risk and Threat Considerations

Organisations with similar posture can still diverge sharply in breach risk when one has a much richer attack surface, broader third-party trust, or more reusable identity paths. That makes the same control score far less reassuring in environments where an initial foothold can be turned into lateral movement or credential abuse more quickly.

Failure mechanism: Attackers exploit exposed services, partner connections, stolen credentials, or weak trust boundaries to bypass the apparent similarity in baseline controls and reach high-value assets through the easiest available path.

Impact: Two well-governed organisations can experience very different breach likelihood and blast radius because one gives an attacker more ways in, more places to persist, and more routes to spread once access is obtained.

Practitioner Guidance

What to prioritise: Compare exposure and reachability before you compare control maturity. If one environment has more internet-facing services, more third-party pathways, or more reusable privileged access, treat that as a stronger risk signal than a small difference in control ratings.

What to verify: Confirm whether the same controls are protecting the same assets. A shared security posture score is not meaningful if one organisation has tighter segmentation, shorter credential lifetimes, and fewer externally reachable identities than the other.

Practitioner takeaway: The right comparison is not “who has better controls?”, but “who has less exploitable exposure if a control fails?” That distinction usually explains why two apparently similar environments do not share the same breach risk.

Related resources from NHI Mgmt Group

• Why can two computer vision models with similar mAP still create very different operational risk?
• Why do network security tools still leave organisations exposed to access risk?
• Why does email still create so much data leakage risk in organisations with mature security controls?
• How should security teams reduce breach risk when remote access still depends on passwords and weak MFA factors?