CyberCQR Case study · Identity and Zero Trust
Simpler and stronger: fixing sign-in from the boardroom down
How a UK financial services firm of under 1,000 staff ended years of security exemptions for its senior team. The executives had been excused from a sign-in process that was complex but weak. The fix made sign-in simpler for everyone and far stronger, from the boardroom to the service desk.
About this case study. Neil Brady, CyberCQR's founder, did this work in 2023 as acting chief information security officer (CISO). The firm is not named, and details that could identify it have been left out.
Summary
The point for boards. The senior team had been exempt from security for years. The exemption protected them from inconvenience, not from attack, and it made them the easiest way in. The answer was not to force a clumsy process on them. It was to replace it with one that was easier to use and much harder to defeat, and then to apply it to everyone, with no exceptions.
The value
| Value | What it meant here |
|---|---|
| Stronger where it matters most | The people with the most authority over money and data moved from no multi-factor authentication (MFA) to phishing-resistant sign-in. |
| Simpler for everyone | A fingerprint or a face replaced long passwords, forced changes and codes. Fewer things to remember, fewer calls to the service desk. |
| Productivity | The average wait for a locked-out user to get back in fell from about five days to under an hour. |
| More accessible | Sign-in no longer depended on memory or typing, which helped people with physical or cognitive impairments, and anyone less confident with technology. |
| Better managed | Administrator rights, system passwords and certificates each gained an owner, a record and an expiry. No service failed because of a certificate renewal after the change. |
Table 1. The value of the work.
The starting point
For years, a long-serving executive had arranged for the senior team to be "protected" from security controls, and the board had allowed it. Bad practice was defended rather than fixed, because fixing it meant admitting that earlier decisions had created a security risk. The result was a firm where the people with the most to lose had the least protection:
- No MFA at the top. The senior team was exempt from MFA and other basic account controls. The chief executive's sign-in details were managed by his personal assistant, and his iPad and other personal devices had no passcodes.
- The service desk knew the passwords. Staff knew the senior team's passwords and regularly got round the controls for them. Meanwhile, an ordinary member of staff who was locked out waited about five days, on average, to get back in.
- System passwords in a document. Administrator and system passwords were kept in a weakly encrypted document on a file share, with no proper access control, no versioning and no record of who used what.
- Certificates nobody owned. There was no central management of certificates, and wildcard certificates were used widely. In about four months, three expired certificates took down one internal and two public services.
Then the senior team was targeted by a series of spear phishing emails. Each offered an "invoice" shared through SharePoint Online that led to a fake Microsoft 365 sign-in page. The kit came from Caffeine, a phishing-as-a-service platform that Mandiant reported in 2022 [3]. The attacks failed only because the executives could not remember their own sign-in details. When they asked for help, the security team looked at what they were trying to sign in to and found the fake page.
What changed their minds?
Not the argument; the evidence. For years, the answer to any proposal for change had been the same: if it isn't broken, don't fix it. Neil met it too, for months. The phishing attempts ended that. The moment it landed was when the senior team saw that the same mailboxes received the emails for the firm's bank accounts and for their own personal ones. A criminal in one of those mailboxes could have reset passwords and approved payments across both. For people of considerable personal wealth, that was not an IT problem.
Neil then ran a session with the senior team on why the change had to happen and how it would work for them. After it, no exemptions remained. With the board behind it, the whole programme took about 90 days.
The exemption protected them from inconvenience, not from attack. Luck is not a control.
Why did the exemption make sense to them?
Because the process they were excused from was both annoying and weak. Long passwords, complexity rules and forced changes are exactly what the National Cyber Security Centre (NCSC) warns against. Its password guidance says complexity rules are a poor defence, that regular forced changes harm rather than improve security, and that piling on requirements makes "an unrealistic demand on users", who then reuse passwords, use predictable patterns or write them down [4].
Seen that way, the senior team's exemption was a symptom, not just bad behaviour. If the strongest control is also the most annoying, the people with the most power will find a way round it. So the aim was not to make them comply with the old process. It was to give them one that was easier than what they had been avoiding, and much stronger.
What looked like a strength was a weakness
| Seen as a strength | Why it was a weakness | What replaced it |
|---|---|---|
| Complex passwords, changed often | Predictable patterns, reuse and passwords written down [4] | Passwordless sign-in: Windows Hello for Business, biometric FIDO2 security keys and Microsoft Authenticator |
| "Protecting" the senior team from controls | Made the people with most authority the easiest target | The same strong, simple sign-in as everyone else, with no exemptions |
| A service desk that could sort out any executive's access | Anyone who could persuade the service desk could get in | Self-service password reset with registered methods; nobody but the user knows a password |
| One document with every system password | No access control, no versioning, no audit trail | A central secrets manager (HashiCorp Vault), with access by role and a record of every use |
| Wildcard certificates covering everything | One key shared across many systems, with no owner and no reminder before expiry | Certificates issued and renewed from the same central secrets manager, each with an owner |
| Administrator accounts always ready to use | Always ready for an attacker too | Privileged Identity Management: administrator rights only when needed, for a set time |
Table 2. Weaknesses that had been treated as strengths, and what replaced them.
What changed
Identity foundations
Accounts were synchronised from the internal directory to Microsoft Entra ID, the identity service behind Microsoft 365, with password hash synchronisation so cloud sign-in did not depend on servers in the office. Self-service password reset let people get back into their accounts with methods they had registered, which Microsoft notes reduces service desk calls [5]. It also removed the reason for the service desk to know anyone's password. The service desk was part of the change rather than bypassed by it, and with self-service reset enforced, the average wait for a locked-out user fell from about five days to under an hour. That was a large productivity saving on its own.
The personal assistant's role barely changed. The difference was that they no longer managed the chief executive's sign-in.
Sign-in that is simpler and stronger
Windows Hello for Business on managed laptops, Microsoft Authenticator on phones, and biometric FIDO2 security keys that worked across the senior team's different devices. The NCSC ranks FIDO2 methods first among MFA types because they resist phishing [6]. A fake sign-in page like the one in the Caffeine attacks gets nothing it can use. For the user, signing in became a touch of a finger or a glance at the screen. The NCSC now reports that a passkey sign-in can take up to eight times less time than a password and a code [1].
Administrator rights only when needed
Standing administrator accounts were replaced with Microsoft Entra Privileged Identity Management (PIM). Administrators hold rights they must activate, for a limited time, with MFA and a reason, and every activation is recorded [7].
Secrets and certificates under management
The password document was retired. System passwords, keys and certificates moved into HashiCorp Vault, a central secrets manager, with access by role and a record of every use. Certificates gained owners and managed renewal. After the change, no service failed because of a certificate renewal.
The design principles
- No exemptions. The people with the most authority get the strongest protection, not the least.
- Simpler is the test. If a control is harder to use than the thing it replaces, people will find a way round it. Make the secure way the easy way.
- Nobody but the user knows a password. Not the personal assistant, not the service desk.
- Administrator rights only when needed. Time-limited, approved and recorded.
- Every secret has an owner and an expiry. Passwords, keys and certificates are managed in one place, not in a document.
Who else benefited?
Everyone. The senior team was the reason for the change, but the same simpler sign-in went across the firm. It also made the firm more accessible. Remembering a password is what the web accessibility standard, WCAG 2.2, calls a cognitive function test. Its accessible authentication requirement asks that sign-in does not depend on one, unless there is an alternative or help such as a password manager [8]. Sign-in with a fingerprint, a face or a key removes that test. That helps people with memory, reading or processing difficulties, people who find typing hard, and anyone who is simply less confident with technology.
If we did it today
- Passkeys first. In April 2026 the NCSC said passkeys are at least as secure as, and generally more secure than, the strongest password with two-step verification, and that businesses should offer them by default [1]. Passkeys stored on managed phones and laptops would now cover many people, with security keys for those who need a separate device.
- Certificate management is no longer optional. The maximum life of a public website certificate fell to 200 days in March 2026, falls to 100 days in March 2027 and to 47 days in March 2029 [2]. A firm that renews certificates by hand will have outages. Automated renewal from a central service is the only realistic answer.
- The same principle, no exemptions, applies to the board's own devices, as our briefing on what UK regulators expect of boards argues.
Lessons for a firm of up to 2,000 people
- Ask who is exempt. Formally or in practice: who has no MFA, whose password does someone else know, whose devices have no passcode?
- Do not let the author of a risk be its only judge. Problems linked to someone's past decisions are the ones most likely to be defended rather than fixed. The board should make sure someone without that stake looks at them.
- Fix the process, not just the people. If people avoid a control, find out why. Usually it is hard to use.
- Use what you already own. Windows Hello for Business, Microsoft Authenticator, phishing-resistant sign-in and self-service password reset are part of Microsoft Entra ID. Check which your plan includes before buying anything. This is tool mastery, the argument of our paper More tools, less security.
- Find the password document. Most firms have one. Replace it with a managed secrets store.
- Accountability stays with the board. An adviser or IT provider can design and do the work. The decision to end exemptions, and the accountability for the risk while they last, belong to the firm's directors.
Glossary
| Term | Meaning |
|---|---|
| Certificate | A digital credential that proves a website or system is genuine and encrypts traffic to it. It has a fixed expiry date. |
| Chief information security officer (CISO) | The person responsible for an organisation's information and cyber security, full-time, interim or fractional. |
| FIDO2 security key | A small device, here with a fingerprint reader, that signs a person in without a password and will not work on a fake sign-in page. |
| HashiCorp Vault | A secrets manager from HashiCorp, part of IBM since February 2025. |
| Multi-factor authentication (MFA) | Signing in with something beyond a password, such as an app prompt, a passkey or a security key. |
| Passkey | A sign-in credential stored on a device or security key and opened with a fingerprint, face or personal identification number (PIN), replacing a password. |
| Password hash synchronisation | A Microsoft Entra feature that copies a protected form of each password from the internal directory to the cloud, so cloud sign-in still works if office servers are down. |
| Phishing-as-a-service | A criminal subscription service that supplies ready-made phishing emails and fake sign-in pages. |
| Privileged Identity Management (PIM) | A Microsoft Entra feature that gives administrator rights only when they are activated, for a limited time, and records each use. |
| Secrets manager | A central, access-controlled store for system passwords, keys and certificates, with a record of every use. |
| Self-service password reset | Letting people reset their own password using methods they registered in advance, without calling the service desk. |
| Spear phishing | A phishing email written for one named person or a small group, often senior people or those who handle money. |
| Wildcard certificate | One certificate that covers every name under a domain, so the same key is often copied to many systems. |
| Windows Hello for Business | Sign-in to a Windows laptop with a face, fingerprint or PIN tied to that device. |
Table 3. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- Identity and Access Management: Top 10 Common Mistakes
- Identity and Access Management: Top 10 Must-Do Actions
- Board Member Identity Protection
- Secure mobilisation at scale: from the office network to cloud identity
- Document library: every paper and tool
External
References
- [1]National Cyber Security Centre, Leave passwords in the past, passkeys are the future, 23 April 2026.
https://www.ncsc.gov.uk/news/ncsc-leave-passwords-in-the-past-passkeys-are-the-future - [2]CA/Browser Forum, Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates, version 2.3.1, section 1.2.2 (from Ballot SC-081, April 2025).
https://cabforum.org/working-groups/server/baseline-requirements/requirements/ - [3]Mandiant (Google Cloud), The fresh phish market: Caffeine phishing-as-a-service platform, 10 October 2022.
https://cloud.google.com/blog/topics/threat-intelligence/caffeine-phishing-service-platform - [4]National Cyber Security Centre, Password policy: updating your approach.
https://www.ncsc.gov.uk/collection/passwords/updating-your-approach - [5]Microsoft, How it works: Microsoft Entra self-service password reset, updated 6 October 2026.
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks - [6]National Cyber Security Centre, Multi-factor authentication for your corporate online services: recommended types of MFA, reviewed 26 September 2024.
https://www.ncsc.gov.uk/collection/mfa-for-your-corporate-online-services/recommended-types-of-mfa - [7]Microsoft, What is Microsoft Entra Privileged Identity Management?, updated 23 April 2026.
https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure - [8]World Wide Web Consortium (W3C), Understanding Success Criterion 3.3.8: Accessible Authentication (Minimum), WCAG 2.2 (Recommendation, 12 December 2024).
https://www.w3.org/WAI/WCAG22/Understanding/accessible-authentication-minimum.html
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We help boards end security exemptions at the top and replace complex, weak sign-in with simpler, stronger access, using the Microsoft 365 controls they already own, without vendor commissions or product resale.