The Overlooked Importance of Identifying Riskiest Users

Executive summary: This report recommends applying a 'see one, teach one, do one' framework to cybersecurity by identifying the organization's most attacked people (MAP) through identity sources (e.g., Active Directory, Azure AD, Okta), showing them targeted threats, enabling them to teach teammates, and enforcing continuous monitoring and personalized controls to reduce risk and minimize tool sprawl.