Why Basic Cybersecurity Practices Fail—and How to Fix Them

Cybercriminals don’t always need sophisticated tactics to cause devastating damage. Sometimes, they just need an opening left by a neglected security safeguard. And the financial stakes are staggering: The average cost of a data breach in the U.S. has reached $11.5 million.

For businesses, implementing foundational cybersecurity practices is only half the battle. The harder challenge is ensuring they remain effective as technology evolves, operations expand and competing priorities pull attention elsewhere. That challenge is becoming increasingly difficult: A 2026 survey found that 68% of IT and cybersecurity professionals say their jobs have become harder over the past two years, with more than half reporting increased complexity and workloads. When security teams are stretched thin, even well-established safeguards can fall victim to inconsistent oversight—leaving preventable gaps that attackers can exploit.

Building lasting cyber resilience requires more than knowing what works; it demands the discipline to keep doing it. Members of the Senior Executive Cybersecurity Think Tank draw on extensive experience in enterprise security, risk management and breach prevention to examine this persistent challenge. Below, they identify foundational security practices organizations still struggle to sustain and explain what it takes to make those protections stick.

“If you do not know what you have, how it is configured or how it is changing, security is guesswork.”

– David Etue, CEO of Cyberbit

SHARE IT

Ensure Asset and Change Management Is a Shared Priority

David Etue, CEO of Cyberbit, draws on more than 20 years of experience in security leadership, consulting and technical implementation. He names asset, configuration and change management as the foundational practice organizations are still struggling to sustain.

“It may be the least glamorous security discipline, but it is among the most consequential,” he says.

Etue emphasizes the importance of maintaining an accurate understanding of an organization’s technology environment.

“If you do not know what you have, how it is configured or how it is changing, security is guesswork,” he says. “You cannot reliably assess exposure, prioritize vulnerabilities, detect abnormal behavior or validate controls in an unknown, shifting environment.”

Etue says that the challenge is that underlying processes usually sit in IT operations, cloud engineering and application teams—not under the CISO.

“That makes this a leadership problem as much as a technology one,” he says. “CISOs must partner with IT operations on a common source of truth, automated asset and configuration discovery, security review of material changes, and shared measures for unapproved and emergency changes. When treated as a common, shared objective, it becomes durable.”

Make Least Privilege Easier to Enforce

For Harikrishnan Muthukrishnan, Principal IT Developer at BCBS FLORIDA, it’s easy for organizations to talk about least privilege—enforcing it effectively, however, is a different story.

“Least privilege is easy to state and nearly impossible to sustain, especially on platforms where business teams configure their own workflows,” he says. “Every urgent request adds a role, and roles are never removed because nobody knows what will break.”

The cumulative effect can be substantial.

“Over a decade, a platform that started with clean access ends up with hundreds of overlapping permissions no one can explain,” Muthukrishnan says.

He advocates an approach that makes access decisions easier to track, evaluate and reverse.

“What makes least privilege stick is treating access like code: Every role has an owner, a documented purpose and an expiration date that forces rejustification,” Muthukrishnan says. “Pair that with automated reports showing which permissions were never exercised, and removal becomes evidence-based rather than a fight.”

Ultimately, he argues, lasting improvement depends on how organizations structure the process itself.

“Least privilege survives only when reducing access is easier than granting it, which is a design choice, not a policy.”

“The organizations that get this right treat asset visibility as a living, adversary-informed process owned by security, not a checkbox owned by IT once a year.”

– Kumar Ritesh, Founder, Chairman and CEO of CYFIRMA

SHARE IT

Treat Asset Visibility as a Continuous Process

Kumar Ritesh, Founder, Chairman and CEO of CYFIRMA, brings experience spanning national intelligence, cybersecurity research and enterprise security leadership to the discussion. He points to a concept that sounds basic—asset visibility—but is becoming increasingly challenging.

“Shadow IT, cloud sprawl and now AI agents spinning up their own access mean an inventory is outdated the moment you finish it,” he says.

For Ritesh, addressing this challenge requires more than regular recurring checks.

“Making it stick isn’t a one-time project; it’s continuous discovery baked into how the business operates,” he says. “That’s the essence of preemptive external threat management: seeing your exposure from the outside in, the way an attacker does, before it becomes an incident—not periodic audits that only capture a moment in time.”

He also stresses the importance of assigning clear responsibility.

“The organizations that get this right treat asset visibility as a living, adversary-informed process owned by security, not a checkbox owned by IT once a year.”

Prioritize Vulnerabilities Based on Business Risk

Bhavya Bhandari, Cybersecurity Risk Management Leader, Financial Services at Ernst & Young US LLP, has spent more than 15 years leading security, regulatory and risk transformation programs for global financial services organizations. He says a foundational practice that organizations still struggle to sustain is asset and vulnerability management.

“Most teams know where their critical systems are today, but cloud adoption, SaaS growth and now AI-driven development are constantly changing the environment,” he says.

Keeping pace with change, Bhandari explains, calls for a more consistent focus on the exposures that matter most to the organization.

“The challenge is less about finding vulnerabilities and more about consistently prioritizing and reducing the ones that create the greatest business risk,” he says.

Rather than relying on occasional assessments, Bhandari urges organizations to embed accountability into their ongoing operations.

“It is important to treat this as an ongoing discipline with clear ownership, meaningful metrics and accountability across technology and business teams, rather than just a periodic security exercise.”

Make Security Fundamentals Stick: Actionable Strategies for Leaders

• Make asset and change management a shared responsibility. Bring security, IT operations and other technology teams together to establish common processes, accountability and measures of success.
• Automate asset discovery and strengthen change oversight. Maintain accurate records of systems and configurations, review significant changes for security risks, and track unauthorized modifications.
• Give every access permission an owner and an expiration date. Document why permissions are needed and require periodic reauthorization to prevent unnecessary privileges from accumulating.
• Make removing unnecessary access easier. Use automated reports to identify unused permissions and support evidence-based decisions about revoking them.
• Make asset discovery continuous, not periodic. Build ongoing monitoring into everyday operations so security teams can keep pace with expanding and changing technology environments.
• Evaluate asset visibility from an attacker’s perspective. Look beyond internal inventories to identify overlooked systems and exposures that could provide opportunities for intrusion.
• Prioritize vulnerabilities according to business risk. Focus remediation efforts on weaknesses that pose the greatest potential threat to critical operations and organizational objectives.
• Make vulnerability management an ongoing, measurable discipline. Establish clear ownership, meaningful performance metrics and shared accountability across business and technology teams.

Strong Cybersecurity Starts With Staying Power

The most effective cybersecurity practices aren’t necessarily the most sophisticated. They’re the ones organizations consistently execute, maintain and improve. From managing assets and access permissions to identifying and prioritizing vulnerabilities, lasting protection depends on clear ownership, cross-functional collaboration and processes designed to keep pace with change.

As technology environments grow more complex and cyberthreats continue to evolve, maintaining security fundamentals will only become more challenging—and more consequential. Organizations that make these practices part of their everyday operations, rather than occasional compliance exercises, will be better positioned to close security gaps, manage emerging risks and build lasting cyber resilience.