Honest Security Reporting: Why We Count the Exceptions

Every firm has accounts that cannot use multi-factor authentication (MFA) in the normal way. A security score that ignores this fact is wrong in one of two directions.

Security reporting has one job. It tells the people who run the firm what is protected and what is not. The report earns trust only when the number on the page is the number an outsider can check.

Every firm has exceptions

Some accounts exist to serve machines, not people. They cannot approve a sign-in on a phone.

• A break-glass admin account. It exists for the day the normal admin path fails, so it must work without a second device.
• A scanner or multifunction printer. It sends scans by email through a service account.
• A copier mailbox or a shared mailbox. Nobody signs in to it directly.
• A legacy application that authenticates with a password alone, until it is replaced.

These accounts are not mistakes. They are decisions. The question is how the report treats them.

Two ways a score can be wrong

The first way is to count them. A firm with 40 accounts and 4 service accounts shows 90 percent MFA coverage. The principal asks why the firm is not at 100 percent. The technician explains the four accounts. Next quarter, the same conversation happens again. The number trains people to ignore it.

The second way is to drop them without a word. The report shows 100 percent. It looks complete. Nobody outside the technical team knows the four accounts exist. Nobody reviews them. One of them is an admin account with a password set in 2021.

Both reports are tidy. Neither one is honest.

What we do instead

We treat an exception as a record, not a footnote.

1. We record the exception with the account name, the reason, the owner, and a review date.
2. We leave it out of the figure. The MFA number counts only the accounts that can and should use MFA.
3. We show the count next to the number. The tile reads: “MFA enforced on 100 percent of 36 accounts. 4 agreed exceptions not counted.”
4. We review every exception at least once a year, and we close the ones that no longer need to exist.

“Agreed” means you signed off on it. The sign-off is kept on your record in your client portal, with a name and a date. When the review date arrives, the exception comes back to the table.

The same rule for devices

A laptop in the replacement queue is not a “device without protection.” It is an exception with a date. The same applies to a workstation that is powered off while someone is on leave.

The device figure counts the devices in service. The exceptions appear below it, each with a reason and a date. A principal can read the tile in 10 seconds and know both numbers.

Why this matters for insurance

Cyber insurance applications ask direct questions. “Is MFA enforced on all accounts?” is one of them. The honest answer is “yes, with 4 documented exceptions,” and a list that shows why.

If your report says 100 percent, and the insurer’s review after a claim finds four accounts without MFA, your firm has a problem at the worst possible time. The number on the report must be the number the insurer can check. That rule protects you more than a perfect-looking score ever will.

What this means for your firm

Ask your current provider three questions. How many accounts are excluded from the MFA figure? Why is each one excluded? When was each one last reviewed?

If the answer to any of them is a pause, the figure on your report is a story, not a measurement.

This is the standard we hold ourselves to in every quarterly strategy review. If you want to see where your firm stands, a Strategic Technology Assessment starts with the real numbers, exceptions included.