CyberCQR Top 10 · Identity and access
Identity and access management: ten must-do actions
Most attacks now start with someone signing in. These are the ten identity controls that matter most for a firm of 500 to 2,000 people, in the order to tackle them, with the evidence for each.
Summary
The point for boards. When people work from anywhere and systems live in the cloud, the sign-in is the front door. Attackers no longer need to break through a network; they log in with a stolen password. Most of the controls below are included in Microsoft 365 licences many firms already pay for. The gap is usually configuration and ownership, not budget.
Why identity is the perimeter
Stolen or abused credentials were the most common way into breaches in Verizon's 2025 report, at 22% [1]. Mandiant's incident response work found stolen credentials were the second most common way in, at 16%, behind exploited software flaws [9]. The 2024 attacks on Snowflake customers showed what that looks like at scale: around 165 organisations were notified after attackers used credentials stolen by malware, on accounts that did not require multi-factor authentication, some unchanged for up to four years [8].
The good news is that the main defence is well proven. Microsoft studied real accounts and found multi-factor authentication reduced the risk of compromise by 99.22%, and by 98.56% even where the password had already leaked [2]. Yet fewer than half of UK businesses (47%) used two-factor authentication in 2025/26 [6].
The ten actions
1. Require multi-factor authentication for every account
Why it matters. MFA is the single most effective identity control [2][3]. Partial coverage leaves exactly the accounts attackers look for. In March 2025 the ICO fined a software provider £3.07 million after a ransomware attack that began through an account without MFA [7].
What to do.
- MFA for every user, every cloud service and all remote access, with no exceptions for executives.
- Use number matching for app-based approvals, so a user cannot approve a prompt they did not start [15].
- Remove SMS and voice codes for administrators and sensitive systems. NIST treats them as a restricted method [5].
- Report MFA coverage to the board, with every exception named and owned.
2. Move to phishing-resistant sign-in, starting with the people attackers want most
Why it matters. Codes and app approvals can be phished by a convincing fake sign-in page. Phishing-resistant methods, such as passkeys and FIDO2 security keys, are tied to the real website and cannot be replayed. CISA calls them the gold standard [4].
What to do.
- Start with administrators, executives and finance staff.
- Use passkeys or Windows Hello for Business where devices support them, and security keys elsewhere.
- Set a timetable for everyone else, and track progress.
3. Control administrator access
Why it matters. An administrator account is the most valuable account an attacker can take: it can switch off defences and reach everything. The NCSC advises separate accounts for administration, used only for that purpose, from devices kept for the job [12]. 73% of UK businesses say they restrict admin rights [6]; the question is whether it is done well.
What to do.
- Separate administrator accounts, with no email or web browsing.
- Grant administrator rights when needed and for a limited time (just-in-time access), with approval for the most powerful roles.
- Record and review privileged activity.
- Keep two emergency ("break-glass") accounts, stored securely and monitored.
4. Check every sign-in, not just the first
Why it matters. A correct password proves very little on its own. Conditional access lets each sign-in be judged on who, where, which device and how risky it looks, which is the core of a Zero Trust approach [14].
What to do.
- Block legacy sign-in methods that cannot do MFA.
- Require a managed, healthy device for access to sensitive data.
- Ask for stronger sign-in, or block, when a sign-in looks risky or comes from somewhere unexpected.
5. Give people only the access their job needs
Why it matters. People collect access as they change roles, and every extra permission is something an attacker can use once an account is taken. The NCSC's guidance on identity and access management puts least privilege at the centre [11].
What to do.
- Define roles and grant access through them (role-based access control).
- Review access to sensitive systems at least every quarter, with managers confirming what their team needs.
- Remove access that has not been used for a set period.
6. Protect executives and finance staff as high-value targets
Why it matters. Fraudsters impersonate or take over senior and finance accounts to redirect payments. Business email compromise cost close to $2.8 billion in 2024 in reports to the FBI alone [10].
What to do.
- Phishing-resistant sign-in for executives, board members and finance staff first.
- Keep business and personal accounts completely separate.
- Require a second, independent check before changing payment details or making urgent payments.
- Brief senior staff on impersonation, including voice and video.
7. Automate joiners, movers and leavers
Why it matters. Accounts that stay active after someone leaves, and access that follows people from role to role, are common findings in audits and common routes in for attackers. The HR system knows first when someone joins, moves or leaves.
What to do.
- Make the HR system the trigger for creating, changing and removing access.
- Disable accounts on the day someone leaves, including access to cloud services outside single sign-on.
- Check regularly for accounts with no current owner.
8. Watch for signs of a compromised account
Why it matters. The faster a stolen account is spotted, the less damage it does. Mandiant's median time to detect an intrusion was 11 days in 2024 [9]; with good identity monitoring, the warning signs show up much earlier.
What to do.
- Alert on password-spraying, impossible travel, new MFA methods being added and unexpected admin role changes.
- Agree who can suspend an account or revoke its sessions without waiting for sign-off.
- Keep sign-in logs long enough to investigate an incident.
9. Bring applications into single sign-on
Why it matters. Every application with its own password is another account to manage, another password to reuse and another account to forget when someone leaves. Single sign-on through one identity provider puts MFA, conditional access and removal in one place.
What to do.
- Connect business applications to the identity provider using SAML or OpenID Connect.
- Review partners and suppliers whose accounts can sign in to your systems.
- Plan for the identity provider being unavailable, with tested emergency access.
10. Test identity security regularly, including forgotten accounts
Why it matters. Settings drift and old accounts linger. In 2024 attackers broke into Microsoft's corporate email after a password-spraying attack on a legacy, non-production test account [13]. Test, service and old accounts are easy to forget and attractive to attackers.
What to do.
- Review identity settings against a baseline at least every quarter.
- Include identity in penetration tests: password spraying, privilege escalation and token theft.
- Keep an inventory of test, service and shared accounts, each with a named owner.
- Check passwords against lists of breached passwords. NIST no longer recommends forced regular changes or complexity rules [5].
A suggested order
| When | Actions | Usually owned by |
|---|---|---|
| First 30 days | 1. MFA for every account · 3. Administrator access · 6. Executives and finance | Head of IT or security, finance director |
| Months 2 to 3 | 4. Conditional access · 5. Least privilege · 7. Joiners, movers and leavers | Head of IT or security, HR |
| Months 4 to 6 | 8. Monitoring · 9. Single sign-on | Head of IT or security |
| Ongoing | 2. Phishing-resistant sign-in for everyone · 10. Regular testing | Head of IT or security, reporting to the board |
Table 1. A suggested order. Firms with some controls already in place can move faster.
Five questions for your next board meeting
- What percentage of our accounts use MFA today, and who has an exception?
- Which of our people are on phishing-resistant sign-in, and when will the rest be?
- How many people hold permanent administrator rights, and why?
- How long after someone leaves are all of their accounts disabled?
- When did someone last test our identity settings, and what did they find?
Glossary
| Term | Meaning |
|---|---|
| Business email compromise | Fraud in which attackers take over or impersonate a business email account to redirect payments or data. |
| Conditional access | Rules that allow, block or challenge a sign-in based on the user, device, location and risk. |
| Just-in-time access | Granting administrator rights only when needed and for a limited time. |
| Multi-factor authentication (MFA) | Signing in with something beyond a password, such as an app prompt or a security key. |
| Passkey | A sign-in credential stored on a device and tied to the real website, so it cannot be phished. |
| Password spraying | Trying a few common passwords against many accounts, to avoid lockouts. |
| Phishing-resistant MFA | Methods, such as passkeys and FIDO2 security keys, that a fake website cannot capture and reuse. |
| Single sign-on (SSO) | Signing in once, through one identity provider, to reach many applications. |
Table 2. Terms used on this page (alphabetical).
Further reading
From CyberCQR
- Identity and Access Management: Ten Common Mistakes. The other side of this list: what goes wrong, and how to fix it.
- Secure mobilisation at scale. Our case study on moving tens of thousands of users to cloud identity and Zero Trust access.
- Just-in-Time Privileged Access Strategy. Action 3 in depth.
External
References
- [1]Verizon, 2025 Data Breach Investigations Report, April 2025.
https://www.verizon.com/business/resources/reports/dbir/ - [2]Microsoft Research (Meyer and others), How effective is multifactor authentication at deterring cyberattacks?, May 2023.
https://www.microsoft.com/research/publication/how-effective-is-multifactor-authentication-at-deterring-cyberattacks/ - [3]Microsoft, One simple action you can take to prevent 99.9 percent of attacks on your accounts, 20 August 2019.
https://www.microsoft.com/en-us/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/ - [4]Cybersecurity and Infrastructure Security Agency, Implementing phishing-resistant MFA, October 2022.
https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf - [5]National Institute of Standards and Technology, SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management, 2025.
https://pages.nist.gov/800-63-4/sp800-63b.html - [6]Department for Science, Innovation and Technology and Home Office, Cyber Security Breaches Survey 2025/2026, 30 April 2026.
https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026 - [7]Information Commissioner's Office, Software provider fined £3m following 2022 ransomware attack, 27 March 2025.
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2025/03/software-provider-fined-3m-following-2022-ransomware-attack/ - [8]TechTarget, Mandiant: 'Exposed credentials' led to Snowflake attacks, June 2024.
https://www.techtarget.com/cybersecurity/news/366588655/Mandiant-Exposed-credentials-led-to-Snowflake-attacks - [9]Mandiant (Google Cloud), M-Trends 2025, 23 April 2025.
https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2025/ - [10]Nacha, FBI's IC3 finds almost $8.5 billion lost to business email compromise in last three years, April 2025.
https://www.nacha.org/news/fbis-ic3-finds-almost-85-billion-lost-business-email-compromise-last-three-years - [11]National Cyber Security Centre, 10 Steps to Cyber Security: identity and access management.
https://www.ncsc.gov.uk/collection/10-steps/identity-and-access-management - [12]National Cyber Security Centre, Secure system administration.
https://www.ncsc.gov.uk/collection/secure-system-administration - [13]Microsoft, Form 8-K filing on the Midnight Blizzard attack, January 2024.
https://www.sec.gov/Archives/edgar/data/789019/000119312524011295/d708866dex991.htm - [14]National Cyber Security Centre, Zero Trust architecture design principles.
https://www.ncsc.gov.uk/collection/zero-trust/architecture-design-principles - [15]Cybersecurity and Infrastructure Security Agency, Implementing number matching in MFA applications, October 2022.
https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf
Security is the outcome, not a solution.
CyberCQR is a UK cyber security advisory practice. We help organisations get identity right using the Microsoft licences they already own, without vendor commissions or product resale.