Why Identity Teams Need to Start Reporting to the CISO

This commentary argues that identity management must be treated as a core security function and should report to the CISO, highlighting that tools like Active Directory and Okta are insufficient without unified identity security, consistent MFA, least-privilege enforcement, and combined network-plus-identity segmentation; it cites recent breaches (Okta, CDK Global, Change Healthcare, Santander) as evidence and recommends organizational and technical changes to reduce identity-related risk.