Guided programmeDemo 2: Three Months LaterIdentityFirstMRI real surfaceRepresentative data

Meridian Crest Financial Services Ltd

Three months of repeated review showing trend, evidence quality, recurring MSP value, and board-level control movement. This page uses the current webapp surface and report structure with a fictional UK financial-services scenario kept explicit about representative data, P1-only licensing, and what is and is not yet mature.

Executive framing: this is the real MRI-led board report surface, driven by representative scenario data for a fictional 1,500-user UK financial-services organisation operating on Entra ID P1. Use this once the run history has already made the movement feel earned.

Board ReportPrepared by IdentityFirst LtdPrepared for Meridian Crest Financial Services LtdSample / Synthetic

Identity Risk Report

Executive posture, trend, financial consequence, and prioritised identity decisions for leadership review.

Prepared by: IdentityFirst Ltd
Prepared for: Meridian Crest Financial Services Ltd
Issue date: 31 March 2026
Classification: Confidential - Demonstration Use Only
Document reference: IF-BRD-MRI-MCFS
Version: 1.0
Assessment scope: UK financial services · three months later
Report run: MRI-MCFS
Product tier: IdentityFirstMRI
Profile: UK financial services · three months later

Report credibility

Scope, methodology, ownership, evidence

Every field is shown explicitly. Items not yet provided are labelled (Roadmap, Unavailable, Not applicable, Missing) rather than hidden.

Classification: Confidential - Demonstration Use Only
Scope of estate: UK financial services · three months later
Reporting period: Representative MRI assessment window
Version: 1.0
Change reference: Not applicable
Methodology: NIST CSF 2.0 functions framing (Govern, Identify, Protect, Detect, Respond, Recover) over the MRI read-only assessment surface. Demo posture and risk numbers are derived from a deterministic seed profile, not live customer telemetry.
Limitations: Public demo only. No live tenant data. Financial impact framing is illustrative; SEC materiality determinations require customer-supplied facts. Risk-appetite line is a roadmap item.
Owner: Roadmap
Preparer: IdentityFirst MRI Engine (deterministic demo profile)
Approver: Roadmap
Regulatory relevance: Supports board oversight expectations under NIS2 Article 20 (management body accountability) and SEC cyber-disclosure governance reporting. Customer legal applicability must be confirmed in scope.
Evidence status: Evidence chain unavailable in public demo

Section 1 - Executive Summary

Mixed provenance

This board view combines real product reporting patterns with curated executive demo framing. Posture and remediation structure are grounded in the platform model; financial interpretation and storyline emphasis remain representative unless a live tenant provides the supporting evidence.

Posture

Projected 83 after remediation

Platforms

Identities

1856

Telemetry streams

Raw findings

Key Risk Drivers

- Residual exposure is now concentrated in guest lifecycle, legacy federation, and a small number of privileged exceptions.
- Repeated runs have improved evidence quality enough for calmer board and audit conversations.
- The MSP value story is now monthly assurance, reporting, and targeted clean-up rather than one-off discovery.

CISO takeaway: Three months of repeated review have turned a messy hybrid estate into a governed operating story with clearer residual risk and stronger evidence.

Section 2 - Strategic Decision Framing

Why this matters now

The report has moved beyond descriptive posture. Current exposure is concentrated in identities and trust paths that can be actioned inside this quarter, and the operating question is whether to accept continued loss exposure or fund the roadmap that bends the next reporting cycle.

Risk trend

Improving

Time to value

30 days

Decision impact

Budget + policy

Investment vs outcome

Estimated remediation investment: £24,800

Modelled loss avoidance multiple: 4.6x

Loss avoidance if funded now: £114,080

The commercial case is not just lower risk. It is a shorter path to measurable exposure reduction than the expected cost of delay.

Board decision required now

The question is not whether identity risk exists. It is whether leadership funds the reduction path now, assigns owners to the highest-consequence findings, and enforces the policy changes needed to collapse the worst attack paths before the next reporting cycle.

Top findings

Ownerless

Modelled exposure

£1,163,000

Top reduction priorities

One shared emergency administration pattern still remains in operations

Microsoft Entra ID · Security operations

critical

Most elevated access has been narrowed, but one shared emergency pattern still exists for weekend branch-servicing support and remains the clearest residual control weakness.

Modelled impact £0

Supplier and guest lifecycle remains the main recurring source of residual access drift

Microsoft 365 · Service partner desk

high

The problem is smaller and better evidenced than in January, but it still recurs around supplier onboarding, tender support, and contract closure.

Modelled impact £0

Legacy MIM exception still drives a narrow set of inherited on-prem application roles

MIM · Identity engineering

high

Only a small number of legacy wealth and servicing apps remain dependent on historic MIM logic, but they still require manual oversight.

Modelled impact £0

Highest modelled loss driver: One shared emergency administration pattern still remains in operations at £0.

Section 3 - How to Read This Report

Posture Score: 0-100 composite where higher is better. Red under 40, amber 40-70, green over 70.

Identity Paths: Correlated attack routes across platforms (for example Okta to Entra to AWS) that reveal blast radius beyond single-system findings.

Drift: Deviation from approved identity policy baseline over time.

Severity: High indicates urgent exploitability, Medium indicates meaningful control weakness, Low indicates hygiene debt.

Blue annotation bars and cards are product-tour cues that explain where each metric comes from.

Section 4 - Identity Risk Score

Posture Score

74/100

90-day trend

Projected after remediation

Risk Category Breakdown

Privilege accumulation52

Drift45

Workload hygiene54

Cross-platform correlation78

High

Medium

Low

Generation methodology blends privileged-access accumulation, cross-platform drift, workload identity hygiene, and correlated path depth from telemetry over the last 90 days.

Section 5 - Top Correlated Identity Paths

medium

Residual shared emergency admin path

Entry: One shared emergency admin pattern remains

Step 1
Invoke emergency admin identity
Microsoft Entra ID
Sign-in
Step 2
Pivot into privileged Azure administration
Azure
Role elevation

Blast Radius

61 identities potentially affected | max depth 3

Why It Matters

The residual path is known and narrow, which is an operating issue rather than an unknown one.

Contributing Misconfigurations

- Shared emergency pattern not fully retired
- Remaining standing role assignment

medium

Guest lifecycle drift into supplier workspaces

Entry: Supplier guest access outlives contract need

Step 1
Historic supplier guest still active
Microsoft 365
Guest access
Step 2
Inherited workspace access remains in collaboration tools
SaaS Applications
Data access

Blast Radius

19 identities potentially affected | max depth 2

Why It Matters

This is now a recurring assurance workstream, not a one-off discovery spike.

Contributing Misconfigurations

- Guest review cadence still manual
- Contract-end trigger not consistently fed into access review

Section 6 - Platform-by-Platform Findings (11 platforms)

High 3Medium 2Low 1

mediumADFS retirement plan is underway, but two line-of-business trusts still remain active

The federation footprint is materially smaller, though two regulated servicing applications still require ADFS until final retirement work completes.

Evidence: The federation footprint is materially smaller, though two regulated servicing applications still require ADFS until final retirement work completes.

Affected:

Section 7 - Cross-Platform Drift and Hygiene

Active Directory

ADFS

Microsoft Entra ID

Azure

AWS IAM

Drift Patterns

MIM|498 days

Small number of MIM-driven entitlement exceptions remain for legacy wealth apps

The issue is bounded and now tracked by named owners.

Microsoft 365|44 days

Supplier collaboration access rises ahead of tenders and renewals

Pattern is predictable enough for monthly review rather than ad hoc clean-up.

Workload identities

142

Stale identities >90d

Over-privileged

Long-lived tokens

Section 8 - Workload Identity Risks

Total workload IDs

142

Stale >90d

Over-privileged

Long-lived tokens

Cross-cloud trust drifts

Risk Distribution

High 3Medium 8Low 12

Section 9 - Remediation Roadmap

Immediate (0-7 days)

Close the final shared emergency admin pattern and move to named accountable access.

PAM | HIGH | 10h

Near-term (30 days)

Keep supplier and guest lifecycle review on a monthly MSP partner operating cadence.

IAM | MEDIUM | 16h

Finish retirement of remaining ADFS-published services and legacy auth exceptions.

AppOps | MEDIUM | 24h

Strategic (90 days)

Complete MIM and legacy provisioning rationalisation across inherited wealth-management apps.

IAM | LOW | 36h

Section 10 - Appendix: Raw Findings

ID	Severity	Platform	Title	Evidence
MCFS-M-001	high	Microsoft Entra ID	One shared emergency administration pattern still remains in operations	Most elevated access has been narrowed, but one shared emergency pattern still exists for weekend branch-servicing support and remains the clearest residual control weakness.
MCFS-M-002	high	Microsoft 365	Supplier and guest lifecycle remains the main recurring source of residual access drift	The problem is smaller and better evidenced than in January, but it still recurs around supplier onboarding, tender support, and contract closure.
MCFS-M-003	high	MIM	Legacy MIM exception still drives a narrow set of inherited on-prem application roles	Only a small number of legacy wealth and servicing apps remain dependent on historic MIM logic, but they still require manual oversight.
MCFS-M-004	medium	AWS IAM	AWS analytics trust path now bounded but not yet fully retired	The shared engineering role has been narrowed significantly, though a transitional trust still exists while the analytics service boundary is being completed.
MCFS-M-005	medium	ADFS	ADFS retirement plan is underway, but two line-of-business trusts still remain active	The federation footprint is materially smaller, though two regulated servicing applications still require ADFS until final retirement work completes.
MCFS-M-006	low	Microsoft Entra ID	P1-based Conditional Access now covers most journeys, with a handful of named exceptions	This is no longer a broad control gap. The remaining exceptions are known, justified, and suitable for monthly challenge rather than crisis handling.

Board Report · Prepared by IdentityFirst Ltd · Prepared for Meridian Crest Financial Services Ltd · Ref IF-BRD-MRI-MCFS · v1.0 · Confidential - Demonstration Use Only · SAMPLE - SYNTHETIC DATA - NOT FOR DISTRIBUTION

Next Step

Turn this executive output into a live customer report

Use this board view to frame the risk conversation, then move into a tailored walkthrough of your own identity estate.

Current buyer path: CISO / Executive

Guided programmeDemo 2: Three Months LaterIdentityFirstMRI real surfaceRepresentative data

Meridian Crest Financial Services Ltd

Board ReportPrepared by IdentityFirst LtdPrepared for Meridian Crest Financial Services LtdSample / Synthetic

Identity Risk Report

Executive posture, trend, financial consequence, and prioritised identity decisions for leadership review.

Prepared by: IdentityFirst Ltd
Prepared for: Meridian Crest Financial Services Ltd
Issue date: 31 March 2026
Classification: Confidential - Demonstration Use Only
Document reference: IF-BRD-MRI-MCFS
Version: 1.0
Assessment scope: UK financial services · three months later
Report run: MRI-MCFS
Product tier: IdentityFirstMRI
Profile: UK financial services · three months later

Report credibility

Scope, methodology, ownership, evidence

Every field is shown explicitly. Items not yet provided are labelled (Roadmap, Unavailable, Not applicable, Missing) rather than hidden.

Classification: Confidential - Demonstration Use Only
Scope of estate: UK financial services · three months later
Reporting period: Representative MRI assessment window
Version: 1.0
Change reference: Not applicable
Methodology: NIST CSF 2.0 functions framing (Govern, Identify, Protect, Detect, Respond, Recover) over the MRI read-only assessment surface. Demo posture and risk numbers are derived from a deterministic seed profile, not live customer telemetry.
Limitations: Public demo only. No live tenant data. Financial impact framing is illustrative; SEC materiality determinations require customer-supplied facts. Risk-appetite line is a roadmap item.
Owner: Roadmap
Preparer: IdentityFirst MRI Engine (deterministic demo profile)
Approver: Roadmap
Regulatory relevance: Supports board oversight expectations under NIS2 Article 20 (management body accountability) and SEC cyber-disclosure governance reporting. Customer legal applicability must be confirmed in scope.
Evidence status: Evidence chain unavailable in public demo

Section 1 - Executive Summary

Mixed provenance

Posture

Projected 83 after remediation

Platforms

Identities

1856

Telemetry streams

Raw findings

Key Risk Drivers

- Residual exposure is now concentrated in guest lifecycle, legacy federation, and a small number of privileged exceptions.
- Repeated runs have improved evidence quality enough for calmer board and audit conversations.
- The MSP value story is now monthly assurance, reporting, and targeted clean-up rather than one-off discovery.

CISO takeaway: Three months of repeated review have turned a messy hybrid estate into a governed operating story with clearer residual risk and stronger evidence.

Section 2 - Strategic Decision Framing

Why this matters now

Risk trend

Improving

Time to value

30 days

Decision impact

Budget + policy

Investment vs outcome

Estimated remediation investment: £24,800

Modelled loss avoidance multiple: 4.6x

Loss avoidance if funded now: £114,080

The commercial case is not just lower risk. It is a shorter path to measurable exposure reduction than the expected cost of delay.

Board decision required now

Top findings

Ownerless

Modelled exposure

£1,163,000

Top reduction priorities

One shared emergency administration pattern still remains in operations

Microsoft Entra ID · Security operations

critical

Most elevated access has been narrowed, but one shared emergency pattern still exists for weekend branch-servicing support and remains the clearest residual control weakness.

Modelled impact £0

Supplier and guest lifecycle remains the main recurring source of residual access drift

Microsoft 365 · Service partner desk

high

The problem is smaller and better evidenced than in January, but it still recurs around supplier onboarding, tender support, and contract closure.

Modelled impact £0

Legacy MIM exception still drives a narrow set of inherited on-prem application roles

MIM · Identity engineering

high

Only a small number of legacy wealth and servicing apps remain dependent on historic MIM logic, but they still require manual oversight.

Modelled impact £0

Highest modelled loss driver: One shared emergency administration pattern still remains in operations at £0.

Section 3 - How to Read This Report

Posture Score: 0-100 composite where higher is better. Red under 40, amber 40-70, green over 70.

Identity Paths: Correlated attack routes across platforms (for example Okta to Entra to AWS) that reveal blast radius beyond single-system findings.

Drift: Deviation from approved identity policy baseline over time.

Severity: High indicates urgent exploitability, Medium indicates meaningful control weakness, Low indicates hygiene debt.

Blue annotation bars and cards are product-tour cues that explain where each metric comes from.

Section 4 - Identity Risk Score

Posture Score

74/100

90-day trend

Projected after remediation

Risk Category Breakdown

Privilege accumulation52

Drift45

Workload hygiene54

Cross-platform correlation78

High

Medium

Low

Generation methodology blends privileged-access accumulation, cross-platform drift, workload identity hygiene, and correlated path depth from telemetry over the last 90 days.

Section 5 - Top Correlated Identity Paths

medium

Residual shared emergency admin path

Entry: One shared emergency admin pattern remains

Step 1
Invoke emergency admin identity
Microsoft Entra ID
Sign-in
Step 2
Pivot into privileged Azure administration
Azure
Role elevation

Blast Radius

61 identities potentially affected | max depth 3

Why It Matters

The residual path is known and narrow, which is an operating issue rather than an unknown one.

Contributing Misconfigurations

- Shared emergency pattern not fully retired
- Remaining standing role assignment

medium

Guest lifecycle drift into supplier workspaces

Entry: Supplier guest access outlives contract need

Step 1
Historic supplier guest still active
Microsoft 365
Guest access
Step 2
Inherited workspace access remains in collaboration tools
SaaS Applications
Data access

Blast Radius

19 identities potentially affected | max depth 2

Why It Matters

This is now a recurring assurance workstream, not a one-off discovery spike.

Contributing Misconfigurations

- Guest review cadence still manual
- Contract-end trigger not consistently fed into access review

Section 6 - Platform-by-Platform Findings (11 platforms)

High 3Medium 2Low 1

mediumADFS retirement plan is underway, but two line-of-business trusts still remain active

The federation footprint is materially smaller, though two regulated servicing applications still require ADFS until final retirement work completes.

Evidence: The federation footprint is materially smaller, though two regulated servicing applications still require ADFS until final retirement work completes.

Affected:

Section 7 - Cross-Platform Drift and Hygiene

Active Directory

ADFS

Microsoft Entra ID

Azure

AWS IAM

Drift Patterns

MIM|498 days

Small number of MIM-driven entitlement exceptions remain for legacy wealth apps

The issue is bounded and now tracked by named owners.

Microsoft 365|44 days

Supplier collaboration access rises ahead of tenders and renewals

Pattern is predictable enough for monthly review rather than ad hoc clean-up.

Workload identities

142

Stale identities >90d

Over-privileged

Long-lived tokens

Section 8 - Workload Identity Risks

Total workload IDs

142

Stale >90d

Over-privileged

Long-lived tokens

Cross-cloud trust drifts

Risk Distribution

High 3Medium 8Low 12

Section 9 - Remediation Roadmap

Immediate (0-7 days)

Close the final shared emergency admin pattern and move to named accountable access.

PAM | HIGH | 10h

Near-term (30 days)

Keep supplier and guest lifecycle review on a monthly MSP partner operating cadence.

IAM | MEDIUM | 16h

Finish retirement of remaining ADFS-published services and legacy auth exceptions.

AppOps | MEDIUM | 24h

Strategic (90 days)

Complete MIM and legacy provisioning rationalisation across inherited wealth-management apps.

IAM | LOW | 36h

Section 10 - Appendix: Raw Findings

ID	Severity	Platform	Title	Evidence
MCFS-M-001	high	Microsoft Entra ID	One shared emergency administration pattern still remains in operations	Most elevated access has been narrowed, but one shared emergency pattern still exists for weekend branch-servicing support and remains the clearest residual control weakness.
MCFS-M-002	high	Microsoft 365	Supplier and guest lifecycle remains the main recurring source of residual access drift	The problem is smaller and better evidenced than in January, but it still recurs around supplier onboarding, tender support, and contract closure.
MCFS-M-003	high	MIM	Legacy MIM exception still drives a narrow set of inherited on-prem application roles	Only a small number of legacy wealth and servicing apps remain dependent on historic MIM logic, but they still require manual oversight.
MCFS-M-004	medium	AWS IAM	AWS analytics trust path now bounded but not yet fully retired	The shared engineering role has been narrowed significantly, though a transitional trust still exists while the analytics service boundary is being completed.
MCFS-M-005	medium	ADFS	ADFS retirement plan is underway, but two line-of-business trusts still remain active	The federation footprint is materially smaller, though two regulated servicing applications still require ADFS until final retirement work completes.
MCFS-M-006	low	Microsoft Entra ID	P1-based Conditional Access now covers most journeys, with a handful of named exceptions	This is no longer a broad control gap. The remaining exceptions are known, justified, and suitable for monthly challenge rather than crisis handling.

Next Step

Turn this executive output into a live customer report

Use this board view to frame the risk conversation, then move into a tailored walkthrough of your own identity estate.

Current buyer path: CISO / Executive