Ask a board what their cyber risk looks like and you’ll often get a list of tools. Ask what an attacker could actually reach if one login were compromised tomorrow, and the room can go quiet.
What a typical cyber briefing tells you
Cyber briefings tend to report activity (tools installed, incidents logged, training completed) rather than exposure. That reassures a board without informing it. It is possible to have every recommended tool in place and still not know the answer to the one question that actually matters.
What’s really happening
Attackers do not always breach a perimeter. The government’s own Cyber Security Breaches Survey 2025/2026 (DSIT) confirms 43% of UK businesses reported a breach or attack in the past year, and phishing was experienced by 38% of businesses and rated the most disruptive type of attack by 69% of those affected. That is a legitimate login obtained through a convincing email or a leaked password, not a hacked firewall. Once inside, the question is no longer whether the front door held. It’s what that single compromised credential can now reach. That’s the “blast radius”, and in a flat, legacy estate, one login can reach far more than any board has been told to expect. Layering more security tools onto an estate built on old assumptions narrows that exposure. It rarely closes it, and nobody has told the board the difference.
Ask the structural question, not the tooling one
The useful question isn’t “are we protected.” It’s “if one account is compromised tomorrow, what exactly can the attacker reach from there, and how would we know.” An identity-led estate, where no user or device is trusted by default and every request is verified, contains that answer to a small, known perimeter. A legacy estate usually can’t answer it at all.
Where the real exposure sits
If your last cyber update was a list of products, you have not yet had the conversation that matters. The gap between “we have tools” and “we know our blast radius” is where real exposure sits until someone who isn’t on your side tests it.
Where this leads
The Sovereignty Index® scores this directly under its Security pillar, one of five dimensions the diagnostic uses to produce a board-level position, giving a board a concrete blast-radius position, not a reassurance built on a list of installed products. For businesses that want continuous visibility rather than a point-in-time snapshot, Etosira monitors the estate specifically for the identity anomalies and sovereignty drift that generic security tooling is not built to detect.