Spoiler alert: Cybersecurity has never been about the attacks

**Expel’s forthcoming 2026 Annual Threat Report** underscores that identity remains the most targeted surface—accounting for **68.6% of incidents in 2025**—and argues that cybersecurity success should be expressed in business terms (risk reduction in dollars) rather than raw security metrics. The piece urges framing controls like SSO/MFA/passkeys as measurable risk mitigations, using ATR metrics to inform likelihoods and justify investments, aligning SOC outcomes with board-level objectives ahead of the report’s release.