“Even the biggest corporates struggle with identity governance: understanding what users are doing, how credentials are being created, and what happens when people change roles,” said Barn. “The positive thing is that M&S did have insurance, which helped. But what insurers and boards now look at is not just ‘Are we covered?’ but ‘How fast can we recover?’ The restoration phase is becoming more important.”