Protection priorities
The identities, data and systems that matter most, and the routes to each.
Who uses itCISO, CIO, risk committee
Solution 2 of 6
Protect What Matters
Decide which identities, data and systems matter most, protect them with controls built for the job, and test that those controls hold.
- 01Identify
- 02Design
- 03Validate
- 79%of ransomware attacks started with an identity-based approach, in a survey of 2,158 victims in 17 countries.Sophos State of Ransomware 2026
- 97%of victims whose root cause was compromised credentials had some form of MFA turned on at the time.Sophos State of Ransomware 2026
- 11%of intrusions began with voice phishing, the second most common way in. Email phishing was 6%.Mandiant M-Trends 2026
- $8Maverage cost of a data breach in the Middle East, against $4.99M globally.IBM Cost of a Data Breach 2026
The problem
MFA turned on does not mean identity is protected.
In Sophos’s 2026 survey of ransomware victims, 79% of attacks started with an identity-based approach. Of the victims whose root cause was compromised credentials, 97% had some form of MFA turned on at the time. Mandiant’s 2026 casework shows one way around it: voice phishing rose to 11% of intrusions, second only to exploits.
MFA comes in different strengths. CISA ranks SMS and voice codes weakest, and says app codes can still be typed into a fake login page. It calls FIDO/WebAuthn the only widely available phishing-resistant option. Coverage has gaps too. Sophos found SaaS accounts often had MFA, while VPNs, firewall admin consoles and legacy apps often did not. Verizon found only 23% of third parties fully fixed missing or weak MFA on cloud accounts.
Attackers go where the sign-in is weakest, so controls need testing against the routes in use today.
Identity and MFA gaps in Sophos cases
- 661Cases in the Sophos Active Adversary ReportIncident response and managed detection cases
- 67%Root causes that were identity-relatedShare of those cases
- 59%Cases where MFA was missing where it matteredShare of those cases
This is not a strict funnel. Both percentages are shares of the same 661 cases, and Sophos does not say how they overlap. As cited in Sophos’s State of Ransomware 2026.
- 22% → 13%Breaches that began with credential abuse2025 report to 2026 report
- 30% → 48%Breaches with third-party involvement2025 report to 2026 report
What you hold
What you can use the week we finish.
| Account group | Accounts | Sign-in today | Sign-in target |
|---|---|---|---|
| Domain admins | 14 | Push approval | Hardware key |
| Cloud admins | 22 | Code by text | Hardware key |
| Finance users | 86 | Code app | Code app |
| Service accounts | 240 | No expiry | Rotated, owned |
| Partner access | 31 | Shared logins | Named, reviewed |
Critical systems with a tested route
5 of 5from 1 of 5
Open gaps on those routes
1from 6
Admin accounts on strong sign-in
100%from 0%
Control design
The controls to build, in order, with owners, effort and the gap each one closes.
Who uses itArchitects, engineering leads
Identity and access plan
Who gets what access, which accounts get the strongest sign-in first, and how access is reviewed.
Who uses itIT and identity owners
Test report and retest
What we tried, what worked, what we could not test, and proof that fixes held.
Who uses itSecurity operations, application owners
Leadership summary
A one-page view of what is protected, what was tested, and what is still open.
Who uses itCFO, board
Where this starts
Start with the question you are stuck on.
Choose a question4 questions · select any
- Where we would start
- We list the admin, service and partner accounts that reach critical systems, then check how each one signs in and what it can do.
- Who works on it
- Identity and access specialists, led by a senior consultant.
- What you hold at the end
- A ranked list of accounts to harden first, and a plan to move them to phishing-resistant sign-in.
- Where we would start
- We find where the data lives, trace who and what can reach it, and check encryption and key handling at each point.
- Who works on it
- Cloud and data security specialists.
- What you hold at the end
- A data and access map, with the gaps ranked and the fixes in order.
- Where we would start
- We agree what you most need to prove, then test that with a penetration test, a red team exercise or a phishing exercise.
- Who works on it
- Offensive security practitioners, led by a senior consultant.
- What you hold at the end
- A report with evidence of what was tried and what held, then a retest after fixes.
- Where we would start
- We review how applications are designed, built and released, and test the ones that handle your most sensitive data.
- Who works on it
- Application security engineers and architects.
- What you hold at the end
- Findings tied to owners, plus fixes built into the way your teams already release.
How it works
How the work runs, step by step.
5systems that matter most
14routes to them
6routes with a gap
| System | Who can reach it | Routes | Gaps |
|---|---|---|---|
| Payments platform | Admins, 2 partners, 1 service account | 4 | 2 gaps |
| Customer database | DBAs, support tier 2, BI tool | 3 | 1 gap |
| Source code | Engineers, build server | 3 | 2 gaps |
| Identity provider | Help desk, admins | 2 | 1 gap |
| Finance ledger | Finance team, auditors | 2 | No gaps |
We agree what would hurt most to lose: the identities, data, applications and systems the business runs on. Then we map who and what can reach each one today, including admins, service accounts, partners and cloud roles, and which controls already stand in the way.
- We work from
- Business priorities, identity and access records, cloud and application inventories, data locations, existing control evidence.
- You get
- A short list of what matters most, with the routes to each one and the gaps on those routes.
ControlGap closedOwnerEffort
- 1Phishing-resistant sign-in for admins34%Identity teamMedium
- 2Remove standing access to the ledger22%Finance ITLow
- 3Verify callers before help-desk resets18%Service deskLow
- 4Deny-by-default rules for the cloud account15%Cloud teamMedium
- 5Encrypt customer data with managed keys11%Data teamHigh
We design controls for the gaps that matter, in order. Typical choices are stronger sign-in for privileged accounts, narrower access, encryption with managed keys, secure application builds, and cloud and network settings that deny by default. We follow zero trust principles where they fit.
- We work from
- The priority list, current architecture, technology in place, delivery capacity and constraints.
- You get
- A control design with owners, effort and sequence, written so engineering teams can build it.
23attempts
19held
4failed, now fixed
| Attempt | Result | Owner | Retest |
|---|---|---|---|
| Help-desk password reset by phone | Held | Service desk | Not needed |
| Phish an admin, push approval | Failed | Identity team | Passed |
| Partner VPN to finance network | Held | Network | Not needed |
| Stolen cloud key to storage | Failed | Cloud team | Passed |
| Test a legacy app login | Not testable | App owner | Scoped out |
| Build server to production | Failed | Platform | Passed |
We test whether the controls hold against realistic attacks. That can include penetration tests, red team exercises, configuration reviews and phishing by email, phone and text. Findings are fixed, then retested.
- We work from
- The control design, agreed scope and rules of engagement, test accounts, access to the people who run the systems.
- You get
- A test report with evidence, fixes assigned to owners, and a retest showing what changed.
A different way to look
The same controls, two ways to judge them.
- ✓MFA enabledAll users
- ✓Annual penetration testLast year
- ✓Encryption at restMost systems
- ✓Admin access reviewedQuarterly
- ✓Phishing training done92%
- ✓Cloud rules reviewedYearly
6 of 6 controls on. Nothing says whether they hold.
- Unit of work
- A control that is switched on
- How it is judged
- Present or absent
- Where it looks
- The systems that are in scope
- What gets reported
- Percent of accounts or systems covered
- ✕Phish an admin, push approvalFailed, fixed, retested
- ✓Help-desk reset by phoneHeld
- ✓Partner VPN to financeHeld
- ✕Stolen cloud key to storageFailed, fixed, retested
- –Legacy app loginNot testable, scoped out
Three routes tried the way an attacker would. Two failed and were fixed.
- Unit of work
- A route to a critical asset, with the control on it
- How it is judged
- Tried against a realistic attack, then retested
- Where it looks
- The weakest sign-in on the route, including admin, partner and legacy
- What gets reported
- What was attempted, what held, what failed and when it was fixed
What leadership hears
We have MFA and a pen test from last year.→
Admin sign-in is phishing-resistant. We tried the help desk reset and it held.
Common mistakes
Beliefs worth dropping.
“We have MFA, so identity is covered.”
MFA is a family of methods, not one control. Codes and push approvals can be phished or worn down, and some systems have none. Sophos’s 2026 survey found MFA on in nearly every compromised-credential case. Strength and coverage decide the result, so test both.
“We passed our penetration test, so we are secure.”
The UK NCSC says a test can only show that systems are free of known issues on the day. It is a check on your own processes, not a primary way to find vulnerabilities. Treat a pass as a dated result, and test again after major change.
“Phishing is an email problem.”
Phone and text now matter as much as email. Mandiant saw voice phishing become the second most common way in, and says interactive social engineering often gets past traditional MFA. In Verizon’s simulations, voice and text had a median click rate 40% higher than email.
Regional view
What it costs in the Middle East.
IBM’s 2026 study put the average breach in the Middle East at $8 million, against $4.99 million globally. For the region, IBM named mismanaged secrets and keys, and excessive privileges with poor role management, among the leading cost drivers. It named encryption among the factors that lower cost. Only 35% of breached Middle East organizations had encrypted sensitive data both at rest and in transit. UAE Federal Decree-Law No. 45 of 2021 sets general duties for organizations to secure the personal data they hold.
- Phishing, 18% of incidents$10.41M
- Supply chain compromise, 16%$8.45M
- Social engineering, 16%$7.32M
Average cost of a data breach by first attack vector, Middle East, 2026. IBM. The share of incidents is in each label.
Standards we work from
- NIST SP 800-207, Zero Trust ArchitectureOur common language for zero trust: no implicit trust, and a separate check of each user and device before access.
- NIST Cybersecurity Framework 2.0We map controls to Protect: identity and access (PR.AA), data security (PR.DS), platform security (PR.PS) and infrastructure resilience (PR.IR).
- OWASP Top 10:2025The application risk list we test against. Broken access control is first, security misconfiguration second.
Using a standard as a common language is not certification or endorsement.
Where our specialists come in
Specialist work, placed along the lifecycle.
Your problem decides which of these we use. You do not have to pick.
- Govern
- Identify
- Protect
- Detect
- Respond
- Recover
- Comply
- Evolve
Identify
Know your exposure
- Identity Security Posture Management (ISPM)
Protect
Build the right controls
- OT/ICS & IoT Security
- Cloud Security
- Identity & Access Security
- Application Security
- Data Security
- Security Architecture
- Penetration Testing & Red Teaming
- Security Engineering
- Phishing Operations
- Identity Security as a Service
- Key Management as a Service
- Data Security as a Service
- Firewall Professional Services
Read first
What our practitioners have written on this.
Article
Cloud Security: Where Responsibility Breaks Down
Providers secure the platform. You configure, connect and operate what runs on it. The failures sit in the space between.
Cybrilliant Cloud Security SME
Read →Practitioner Field Note
Field Note: Cloud Security Review Without Slowing Engineering
How to divide cloud review work so engineering keeps its pace and security keeps its grip on the changes that matter.
Cybrilliant Cloud Security SME
Read →Threat Intelligence
Adversary-in-the-Middle Attacks: When MFA Is Not the End of the Story
An AiTM attacker never breaks MFA. The user completes it, and the attacker keeps the result. What that means for how authentication is designed, enforced and recovered.
Cybrilliant Identity Security SME
Read →Expert Briefing
Expert Briefing: Cloud Attack Paths and Control-Plane Risk
How attackers move through cloud identity, trust and management APIs, and which controls break the chain.
Cybrilliant Cloud Security SME
Read →Architecture Guide
Securing Multi-Cloud Without Creating Three Security Programs
Define the controls once. Implement them thinly in each cloud. Prove them in one place.
Cybrilliant Cloud Security SME
Read →Article
Why Application Security Fails at the Handoff
Findings do not fix themselves. Application security breaks where one team’s output has to become another team’s work.
Cybrilliant Application Security SME
Read →Questions
What people ask before they start.
Is zero trust a product we can buy?
No. NIST SP 800-207 describes zero trust as a set of principles: no implicit trust based on location or ownership, and a separate check of each user and device before a session starts. Products can help. The design decides the result.
Where does the work start?
With what would hurt most to lose. We agree that list with you, map who and what can reach each item, and fix the weakest route first. We do not start with a full control review.
What is the difference between a penetration test and a red team exercise?
A penetration test checks agreed systems for weaknesses. A red team exercise tests a realistic attack against your people, processes and detection, usually with a narrower goal. We agree which one fits your question before we scope.
Do we need to buy new tools?
Not as a starting condition. We work with the tools you run where we can. If a gap needs a new tool, we say so and agree it with you first.
Will testing disrupt our operations?
We agree scope, timing and stop rules in writing before anything starts, and name a contact on your side. Systems that cannot tolerate live testing are tested in a copy, or reviewed by walkthrough.
Sources and notes
- Sophos, The State of Ransomware 2026
- Google Cloud / Mandiant, M-Trends 2026
- IBM Newsroom Middle East, 2026 Cost of a Data Breach findings for the Middle East
- IBM, Cost of a Data Breach Report 2026
- Verizon, 2026 Data Breach Investigations Report: Executive Summary
- Verizon, 2025 Data Breach Investigations Report: news release
- Verizon, 2025 DBIR Executive Summary
- CISA, Implementing Phishing-Resistant MFA (fact sheet)
- UK NCSC, Penetration testing guidance
- NIST, SP 800-207 Zero Trust Architecture
- NIST, Cybersecurity Framework 2.0 (CSWP 29)
- OWASP, Top 10:2025
- UAE Government portal, Data protection laws