Your perimeter is a login
With cloud services and remote work, the office network no longer marks the edge of your organisation. Every account is a way in. Ten actions close most of those doors. Mark each one as done, partly done or not started, and the ring shows how much of your identity perimeter is covered.
What the evidence says
Three figures from named, current sources. Each one points at a different part of the list below.
Reduction in account compromise risk from multi-factor authentication (MFA), in a Microsoft study of business accounts. It was still 98.56% where the password had already leaked.[1]
Share of breaches involving a human element, such as a stolen login, a phishing click or a mistake, in the 2026 Verizon Data Breach Investigations Report (DBIR).[2][3]
Share of third-party organisations that fully fixed missing or weak MFA on their cloud accounts, in the same report. Your suppliers' logins are part of your perimeter too.[2]
The ten actions
Be honest with yourself: "partly" usually means "not for everyone". Open any action to see what it involves. Your answers stay on this page and are cleared when you leave.
The roadmap
Order matters. The first phase closes the doors attackers try most often; later phases make the protection continuous. Actions you have marked done are struck through, and your next three moves are outlined in white.
Your next three moves
You may already be paying for much of this.
If you run Microsoft 365, many of these controls sit in licences you already hold, switched off or half-configured. CyberCQR is an independent practice with nothing to sell you but the advice: we help you use what you have before you buy anything new.
Talk to CyberCQRSources
- Meyer, L. A. et al., How effective is multifactor authentication at deterring cyberattacks?, Microsoft Research, 2023. https://www.microsoft.com/research/publication/how-effective-is-multifactor-authentication-at-deterring-cyberattacks/
- Verizon, 2026 Data Breach Investigations Report, as reported by Infosecurity Magazine, 20 May 2026. https://www.infosecurity-magazine.com/news/verizon-dbir-exploits-top-access/
- Verizon, 2026 Data Breach Investigations Report (full report). http://www.verizon.com/business/resources/T1f0/reports/2026-dbir-data-breach-investigations-report.pdf
Glossary
- Conditional access
- Rules that check who, where and on what device before letting someone in
- FIDO2 / passkey
- A login method using a device or security key instead of a password, which cannot be phished
- Identity governance and administration (IGA)
- Keeping accounts in step with joiners, movers and leavers
- Identity provider (IdP)
- The single system that checks who people are, such as Microsoft Entra ID
- Identity threat detection and response (ITDR)
- Watching login activity for signs of attack and acting on them
- Just-Enough Access (JEA)
- Giving only the permissions a task needs
- Just-in-Time (JIT) access
- Granting admin rights only when needed, for a limited time
- Multi-factor authentication (MFA)
- Proving who you are with more than a password
- Privileged access management (PAM)
- Controls on the accounts that can change systems
- Role-based access control (RBAC)
- Giving access by job role rather than person by person
- Security information and event management (SIEM)
- A system that gathers security logs in one place to spot attacks
- Single sign-on (SSO)
- One login, checked in one place, for many applications