Bart Zalewski, CEO, Complus IT | Member Insight Blog | 16 July 2026

Most organisations that experience a serious cyber incident had a security strategy. They had invested in tools, engaged suppliers, and addressed the visible risks. What they had not done was ask a more fundamental question: who currently has access to their systems, and should they?

That question is where the real work of cyber resilience begins. Not in the technology, but in the governance of access: who is granted it, how it is maintained, and whether anyone is reviewing it over time. This article sets out a practical approach to addressing that challenge, built around three principles that any organisation can apply.

Why Access, Not Architecture, Defines Your Risk

The traditional security model assumed that protecting the network perimeter was sufficient. That model no longer reflects how most organisations operate. Workforces are distributed, cloud services have replaced on-premise infrastructure, and third-party access has become routine. In this environment, risk is not defined by where systems sit. It is defined by how access is governed.

The evidence confirms this. The Verizon 2025 Data Breach Investigations Report found that stolen credentials were the initial access vector in 22% of all breaches and that 88% of attacks against basic web applications involved the use of stolen credentials (Verizon, 2025). Third-party involvement in breaches doubled year-on-year, reaching 30% of all confirmed incidents. These are not perimeter failures. They are access governance failures: credentials that should have been revoked, permissions that were too broad, third-party access that was never reviewed.

Zero Trust emerged as the conceptual response to this reality. But as Gartner's 2025 IAM Planning Guide advises, organisations should focus on outcomes over tools when modernising identity and access management (Gartner, 2024). The technology matters, but it is the governance layer beneath it that determines whether Zero Trust delivers real protection or becomes an expensive overlay on an unresolved problem.

Structuring Access Around Three Principles

At Complus IT, we work with organisations that have capable technology environments but lack a structured approach to governing who has access to what. The gap is rarely in the tooling. It is in the discipline around it.

We describe that discipline through three interconnected principles:

A more structured view of access and control:

Manage.

Know who has access, to what, and why.

Conduct a full access audit across all systems, including cloud platforms, shared drives, and third-party integrations. Document every active credential.
Map each user's access against their current role. Flag permissions that no longer match responsibilities, particularly for employees who have changed position internally.
Identify all third-party and contractor access. Confirm whether each is time-limited, purpose-specific, and reviewed by a named owner.

Protect.

Apply consistent, enforceable controls across access decisions.

Enforce multi-factor authentication on all critical systems. With only 40% of UK businesses currently using MFA (DSIT, 2025), this remains one of the most impactful and affordable controls available.
Apply least-privilege principles: grant access based on what a role requires, not what is convenient. Remove standing admin rights where they are not operationally justified.
Define a joiners, movers, and leavers process embedded in HR and IT workflows, so that access is granted on day one, reviewed on role change, and fully revoked on departure.

Assure.

Validate that controls are working, not just in place.

Schedule quarterly access reviews with named accountability. These should not be a checkbox exercise. Each review should confirm that every active credential has a justified, documented reason to exist.
Test your offboarding process. Pick five recent leavers and verify whether their access has been fully revoked across all platforms. Most organisations that run this test find gaps.
Assign board-level or senior leadership accountability for access governance. Without ownership at the top, reviews will be inconsistent and policies will drift over time.

What This Looks Like in Practice

A common example sits inside Microsoft 365 and Entra ID environments. Many organisations have invested in Microsoft as their core productivity and identity platform, but the governance layer around it is often weaker than the technology itself.

Teams workspaces are created for short-term projects and never archived. SharePoint permissions are inherited across folders without review. Guest users are invited for a single collaboration and remain active indefinitely. Shared mailboxes are owned by no one. Admin roles are granted permanently rather than on a time-limited basis. Applications are connected to the tenant without a regular review cycle.

None of these issues necessarily means the Microsoft platform is poorly secured. The gap is that the organisation has not translated Microsoft's controls into a governed operating model.

This is the microstructure problem: the risk does not always sit in the headline architecture. It sits in the smaller access structures that accumulate through everyday business use. A guest account, a forgotten project Team, an over-permissioned SharePoint folder, a standing admin role, or an unreviewed enterprise application can all become access debt.

Microsoft can provide the control plane. But the business must still define ownership, review frequency, approval rules, and removal triggers. Without that discipline, Zero Trust becomes a set of available settings rather than a working governance model.

The Governance Gap That Sits Beneath the Surface

The practical steps above are not complex. But they do require something that most organisations have not yet formalised: ownership.

According to the DSIT Cyber Security Breaches Survey 2025, only 27% of UK businesses have a board member with explicit responsibility for cyber security, a figure that has fallen from 38% in 2021 (DSIT, 2025). Access governance spans HR, IT, legal, and operations. Without a named owner at leadership level who can enforce policy across those functions, reviews are inconsistent, offboarding is incomplete, and permissions drift.

The UK Cyber Security and Resilience Bill, introduced in November 2025, adds regulatory weight to this issue. It brings Managed Service Providers and critical third-party suppliers explicitly within scope (UK Parliament, 2025). Organisations that cannot demonstrate clear governance of third-party access will face growing regulatory and operational exposure.

Where to Start

If an organisation has not yet formalised its approach to access governance, the first step is not a technology review. It is a set of honest questions:

Start here: five questions to ask this week

Can you produce a complete list of every person and system that currently holds access to your critical environments?
When was the last time those permissions were formally reviewed against current roles and responsibilities?
Do you have a documented, tested process for revoking all access when someone leaves?
Is third-party and supplier access time-limited, purpose-specific, and monitored by a named internal owner?
Is there a named individual at board or senior leadership level who is accountable for access governance?

If any of these questions cannot be answered with confidence, that is the starting point.

Resilience Is Built on Decisions, Not Deployments

Cyber security is no longer defined by the strength of the perimeter. It is defined by whether the organisation knows who has access, whether that access is appropriate, and whether someone is accountable for maintaining that standard.

The organisations managing this well are not waiting for a better tool. They have made a deliberate decision to govern access as a business priority, and they hold themselves accountable to it. That decision is available to every organisation, regardless of size or sector. The question is whether it has been made.

🔗 Learn more about Complus IT at: https://www.complus-it.com/

References

Department for Science, Innovation and Technology (DSIT) and Home Office (2025) Cyber Security Breaches Survey 2025. [online] Available at: https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025 [Accessed: 15 April 2026]

Gartner (2024) 2025 Planning Guide for Identity and Access Management. Published October 2024. [online] Available at: https://www.gartner.com/en/documents/5823247 [Accessed: 16 April 2026]

National Cyber Security Centre (NCSC) (2025) Demystifying Zero Trust. Updated October 2025. [online] Available at: https://www.ncsc.gov.uk/collection/zero-trust/demystifying-zero-trust [Accessed: 15 April 2026]

UK Parliament (2025) Cyber Security and Resilience Bill. Introduced November 2025. [online] Available at: https://bills.parliament.uk/bills/3744 [Accessed: 15 April 2026]

Verizon (2025) 2025 Data Breach Investigations Report. [online] Available at: https://www.verizon.com/business/resources/reports/dbir/ [Accessed: 16 April 2026]