Ransomware exponents can target identity, bypassing technical defences. Boards should prioritise identity security, align investments, and embed cyber risk in governance