Why modern security requires proof, ownership and consistency
We are happy to help you with concrete answers or a solution that fits your organization.
Personalized advice tailored to your situation
In-depth information not in the white paper
A no-obligation meeting with one of our specialists
Leave your details and we’ll get back to you soon. We look forward to thinking with you!
If you want to read the knowledge document as plain text, you can do so below:
Authors: Remco Pabst, Business Consultant, and Shannon Breuer, Chief Information & Security Officer (CISO), both working at Pegamento.
Date: May 2026
The cyber incident at Odido in February 2026 shows why security can no longer be treated exclusively as an IT issue. Odido reported that personal data had been hit from a used customer contact system, even though operational services had not been disrupted and there was no indication at the time that passwords, call data or billing information had been involved. Strategically, this is relevant because an organization does not have to completely shut down to still face tough questions about access management, logging, retention periods, customer trust and managerial control.
From Pegamento, we see that the central question in the market is shifting. The focus is no longer only on whether an organization has taken security measures, but mainly on whether it can show who had access, what actions were performed, what decisions were made, which measures demonstrably work and who is responsible for what. This shift aligns with broader developments in laws and regulations. In addition to integrity and confidentiality, the AVG also has the accountability principle. Organizations must therefore not only act compliantly, but also be able to convincingly substantiate this.
This same movement is visible outside the privacy domain. NIS2 places cybersecurity more explicitly in the boardroom, with governance, risk management, notification obligations, supply-chain security and management responsibility as recurring themes. For the financial sector, DORA has applied since Jan. 17, 2025, and concretely links digital operational resilience to monitoring, testing, third-party risk and incident management. In the Netherlands, the Cyber Security Act was not yet in effect on April 20, 2026, but preparing for it is already a real organizational issue.
The core conclusion of this white paper is therefore simple but far-reaching: security is no longer a stand-alone IT issue, but an organizational competency that hinges on demonstrable cohesion between technology, processes and governance. |
Organizations that take this shift seriously are investing not just in tooling, but in governable cohesion between identity, logging, off-boarding, awareness, contract agreements, incident response and management accountability. That lowers risk, increases auditability and reinforces trust with customers, partners, regulators and directors.
Every market has tipping points: moments when an incident not only has technical or legal consequences, but raises a broader management question. The incident at Odido is such a moment. Not because one case would explain the entire market, but because events like this make visible how security issues arise in customer contact environments, process chains, supporting systems and governance choices – and thus not only in firewalls, networks or endpoints.
For many organizations, this shift already feels intuitively recognizable. Clients are asking different due-diligence questions. Procurement and legal teams want more substantiation. Auditors are asking not just for policy documents, but for evidence. Regulators are looking not just at whether measures exist, but whether an organization can reconstruct its choices, risk considerations and actions.
This white paper is written from that reality. Not as a product brochure, nor as incident analysis of one brand, but as strategic interpretation of a broader development Pegamento sees in practice: organizations become vulnerable when IT, Legal and Operations each approach security in part, but no one manages the whole.
There are three reasons why this issue is especially urgent now. The first reason is the changing threat landscape. Cyber incidents affect not only the technical environment, but often directly customer processes, data flows and chain dependencies. Good log information and a practiced incident response are therefore no longer a luxury, but preconditions for administrative grip.
The second reason is the escalating impact of incidents. The IBM Cost of a Data Breach Report 2024 reported a global average data breach damage of USD 4.88 million. In addition, 70 percent of the organizations surveyed reported that their operations were significantly or at least noticeably disrupted. This underscores that cyber incidents are not just security problems, but business operations problems.
The third reason is the administrative and legal aggravation of the issue. NIS2 raises the European bar for cybersecurity in critical and important sectors and makes it clear that administrators and senior management cannot remain aloof. For the financial sector, this reality already applies concretely through DORA. The implication is clear: security is increasingly being judged on demonstrable mastery, not just technical intent.
For years, security was translated primarily into technology. Firewalls, endpoint protection, SIEM, IAM, segmentation, monitoring, patching and cloud hardening were all necessary, but rarely sufficient. This technical focus was explicable at a time when the dominant question was: can we prevent attacks or detect them faster?
Today, the bar has been raised. The question is no longer simply whether an organization has measures in place, but whether it can demonstrate their operation in conjunction with processes, responsibilities and decision-making. Accountability is thus not a semantic addition, but a fundamental change in the way organizations are judged.
In addition, digital chains have become more complex. Identities run through central identity providers and through local exceptions. Applications access data through APIs. Employees work hybrid. Suppliers manage parts of the stack. Customer contact platforms are connected to CRM, ticketing, analytics and knowledge bases. This creates risk not only in “the infrastructure,” but precisely in the transition between systems, roles, rights, management processes and contractual responsibilities.
Many organizations still think of security primarily in terms of technology, tooling, certification and checkoff compliance. This easily leads to an appearance of maturity. There is an IAM solution, so access is regulated. There is logging, so reconstruction is possible. There is awareness training, so the people factor is covered. There is policy, so governance exists.
Practice shows a different picture. A central identity solution can coexist perfectly well with local exception accounts in applications. On paper, least privilege is set up, but in practice access persists after role changes or departures. Or there is logging on multiple layers, but the events are not correlated, timestamps are not harmonized and ownership for analysis is missing. Then there is data, but no evidence yet.
The difference between “having measures” and “having control” is almost always in consistency. Security often fails not because of lack of a tool, but because of lack of ownership, lifecycle management, review and explainability.
The questions Pegamento sees in customer processes, audits and due diligence processes are rarely phrased in purely technical terms anymore. They usually revolve around control, demonstrability and accountability.
These questions are strategically relevant because they all test the same thing: not whether an organization is theoretically secure, but whether it can explain its security managerially and operationally. That is the real difference between a technical security approach and a mature organizational approach.
7.1 Logging without context
Logging is essential, but logging without context provides a false sense of security. In many organizations, log data exists, but the connection between application, API, platform and identity is missing. This creates fragments of truth rather than a single manageable factual picture.
A useful logging strategy therefore does not start with “log more,” but with three design questions: what decisions or actions should we be able to reconstruct later, what sources are needed to do so, and who is responsible for quality, correlation, retention and interpretation?
7.2 Off-boarding as a weak link
Off-boarding is still too often seen as an HR afterthought rather than a security moment. That’s risky. The weakness is rarely just in the primary account, but rather in local applications, group memberships, tokens, administrator roles, API keys, mobile access and exception rights.
Organizations that approach off-boarding maturely make departure not a loose checklist at the end of a process, but a controlled chain with trigger, execution, verification and demonstrable closure.
7.3 Fragmented responsibility
Many organizations have expertise, but lack end-to-end ownership. IT manages systems. Legal sets requirements. Operations manages processes. HR processes personnel changes. Security monitors frameworks. But who is responsible for the demonstrable operation of the whole?
Exactly in that in-between space arise the questions on which audits, incidents and customer investigations get bogged down: who decided that an exception was acceptable, who verified that an account was actually closed, and who monitors the relationship between contract agreements, logging, retention periods and access?
7.4 Awareness as a one-time action
Awareness is necessary, but annual training does not make an organization resilient. Employees must not only recognize risks, but also know what to do when in doubt. Awareness only really works when it becomes part of process design: clear verification steps, recognizable communication, simple reporting routes, limited authority and consistent leadership.
From a legal perspective, the key shift is that being compliant on paper is no longer enough. Organizations must be able to show why their setup is appropriate, how measures were chosen, how exceptions are controlled and how actual operation matches what is described in policies, contracts and procedures.
That makes accountability a practical organizational principle. It is not just about privacy documentation, but directly about architecture, access management, logging, retention periods, incident logging, vendor steering and decision-making. The legal risks of weak demonstrability are broader than fines alone. They also touch reputation, contractual relationships, evidentiary position and managerial credibility.
This is precisely why the focus is shifting from “being compliant” to “being demonstrably compliant. Organizations must not only be secure, but be able to explain and prove that their measures are appropriate, current and governable.
In theory, security sounds uncluttered. In practice, it is layered. A user action rarely touches a single system. An employee logs in through an identity provider, uses a customer contact application, accesses data through an API and leaves traces in monitoring, ticketing and management environments. If those sources don’t come together logically, a reconstruction problem arises.
The same is true for access management. The main identity may sit centrally, but rights also live in groups, application roles, local exceptions, vendor accounts, service identities and emergency accesses. As a result, “we have SSO” is not proof of control; at most, it is a part of it.
Procedurally, the reality is equally unruly. A role change in HR does not automatically mean that rights are adjusted in all chains. A supplier can perform management while the client remains legally responsible. A temporary exception can become structural. A project may demand speed, causing governance to be treated as a closing item. Thought leadership therefore does not start with denying trade-offs, but with making them governable.
The biggest misconception in the market is that security fails primarily because of too little technology. Much more often security fails because of lack of coherence. Logging is confused with proof. Compliance is confused with documentation. Awareness is confused with assurance. Governance is confused with designating one responsible function with no mandate over the whole.
A second misconception is that existing systems are obviously out of scope because they are legacy. In reality, legacy environments often actually increase the tension between speed, risk and demonstrability. Legacy systems do not require tolerance, but an explicit managerial consideration: mitigate, isolate, replace or phase out.
A third misconception is that security ownership can, in practice, be placed entirely with IT. Legislation, customer demands and regulatory requirements show that this is not tenable. Cyber resilience touches governance, compliance, operations, procurement and supplier management equally.
The positive flip side is that the same development also offers opportunities. Organizations that can demonstrate security not only strengthen their resilience, but also their market position. Clients, partners and auditors experience demonstrable control as a sign of maturity and reliability.
In addition, a mature security approach can increase operational agility. When identity lifecycle, logging, exception management and governance are well established, changes can occur faster and more securely. Security then becomes not a brake on innovation, but a condition for controlled acceleration.
Finally, the quality of decision-making increases. Those with visibility into access, chains, critical processes and third-party dependencies make better choices about sourcing, platform selection, retention, monitoring, contracting and crisis response. This is precisely why modern regulation places so much emphasis on resilience and managerial grip.
Use case 1 – customer contact platform under due diligence
An organization uses multiple systems for customer contact, CRM and knowledge management. After a market incident, a large customer asks additional questions. Not about firewalls or certificates, but about access, logging, vendor roles, processor agreements and off-boarding.
The organization with a mature model can show within a short time what roles exist, how access is granted, what administrator actions are logged, what exceptions exist, how long log data remains available, and what governance applies to role changes or departures. The organization without consistency is stuck with loose exports, policy documents and assumptions.
Use case 2 – employee leaves with broad operational access
Upon unexpected departure, a mature organization is not just disabling the primary account, but the entire identity lifecycle: SSO, local applications, administrator roles, group memberships, tokens, shared credentials, mobile access and physical access. The difference is in process discipline, automation and authentication.
Use case 3 – incident analysis without administrative confusion
When suspicious access to sensitive data is discovered, layered logging combined with clear team roles makes it possible to quickly determine which accounts were involved, which systems were affected, which notification pathways need to be activated and which communications are actually justified. Without that preparation, the exact opposite occurs: technical teams investigate, legal waits to be sure, operations wants to move on and management wants answers without a shared factual picture.
Pegamento’s vision is that organizations must redefine security. Not as a collection of tools, but as manageable cohesion between identities, rights, processes, logging, decision-making and chain responsibility.
For organizations that want to act now, the most important practical question is not which tool to purchase first, but what evidence will be needed tomorrow to explain to the customer, auditor, regulator or board how the organization maintains control.
The lesson “after Odido” is not that organizations especially need more loose security measures. The real lesson is that modern security hinges on verifiable consistency.
Organizations get stuck when IT secures systems, establishes Legal frameworks and executes Operations processes, but no one is integrally responsible for demonstrable operation. Then the familiar gaps emerge: logging without usability, permissions without lifecycle, awareness without behavior, policy without proof and governance without ownership.
The organizations that will make the difference in the coming years are not necessarily those with the most tooling, but those that can connect security to business operations. That is precisely where Pegamento’s vision of digital resilience lies at its core. |
Incident context and current events
Odido – Cyber incident information page (2026). Used for factual information about the cyber incident, reference to a customer contact system and public indication that operational services had not been affected.
Odido Newsroom – Odido informs customers of cyber attack (Feb. 12, 2026). Used as primary source for initial public interpretation of incident.
Privacy, accountability and demonstrability
European Commission – Data protection explained. Used for AVG principles, including integrity, confidentiality and accountability.
European Data Protection Board – Accountability Tools. Used to explain that organizations must take appropriate technical and organizational measures and be able to demonstrate that processing is compliant.
European Data Protection Board – Data protection by design & by default: When to act and what to do (February 2026). Used for the ongoing duty to take appropriate action and focus on existing or obsolete systems.
Cyber regulation, governance and governance
European Commission – NIS2 Directive: securing network and information systems (Jan. 20, 2026). Used for scope, governance and management responsibility.
Digital Government – Cyber security law (March 5, 2026) and House of Representatives approves Cbw and Wwke (April 15, 2026). Used for Dutch status and expected implementation of the Cybersecurity Act.
De Nederlandsche Bank – DORA. Used for application date, content and supervisory dimension of DORA.
Logging, incident response and operational control
NCSC – The value of log information. Used for the need for log information to reconstruct events and user actions.
NCSC – Incident response plan, Incident response: where do I start? and Keep a grip on a cyber incident: use the Cyber Incident Log. Used for team roles, preparation and structured incident logging.
NIST – SP 800-92 Guide to Computer Security Log Management. Used as an authoritative source for log management as an enterprise-wide discipline.
Identity, awareness and operational discipline
idmanagement.gov – Identity Lifecycle Management Playbook. Used for provisioning, change management and immediate withdrawal of access on exit.
NIST – SP 800-53 Revision 5.1, AC-2 Account Management. Used for account management in relation to personnel termination, inactivity and auditing.
NCSC – Security awareness and related phishing/social engineering pages. Used for human factor, reporting behavior and securing cyber awareness.
Impact and business operations
IBM / Ponemon Institute – Cost of a Data Breach Report 2024 and IBM summary. Used for average global damage from a data breach and reported operational disruption.
The content of this white paper is time-sensitive with respect to the status of the Odido incident, public information about it, and the progress of any follow-up investigation. New facts or technical findings may change the interpretation.
The status of the Dutch Cyber Security Act is also time-sensitive. As of April 20, 2026, the law was not yet in force. Final obligations, further elaboration and implementation dates may change due to parliamentary consideration and lower regulations.
Some of the conclusions in this white paper depend on context, sector and architecture. Organizations in the financial sector are already dealing with DORA; other organizations will be assessed more heavily on AVG, contractual requirements, NIS2/Cybersecurity Act or industry-specific standards.
Finally, this document is a strategic and editorial white paper, not an individual legal advice or technical security audit. Where industry-specific interpretation or concrete compliance review is required, further assessment on an organization-by-organization basis remains necessary.
Deepen your knowledge with Pegamento’s white papers.
When a customer contacts an organization because they have a complaint, it is crucial that the employee of the organization begin by listening carefully. What does this complaint mean for the customer and also for their own organization? How can this complaint be resolved? After listening carefully the employee needs the right information so that a solution can be offered.
This piece was written by Joost Schaap, working as an Account Manager at Pegamento.
Real childhood heroes I never had. But in retrospect, I believe figures like Willie Carrot or Dexter’s lab may have had an influence on me. I get energy from actually making innovative and useful products myself. Nothing like seeing the effect of a project that automates a boring task, or makes a complex process suddenly accessible.
A nice bridge to my photograph is the physical aspect of my work. By working with image recognition, I am often very directly connected to the physical world and my work is more than just programming. For example, our image recognition software ensures safety on bridges, tracks players on a soccer field or uses your own smartphone to accurately measure yourself. This combination between physical and digital provides variety and extra challenge. For me, these are the main reasons for my interest and enthusiasm in what I do!
This piece was written by Tim Treurniet, employed Designer of intelligent systems at Pegamento.
As a UX/UI designer, I deal daily with transforming complex data into user-friendly visualizations. All of this topped off with a digital lick of paint which should attract the visitor’s attention to take action.
One of the interesting aspects of this field I find the effects that small tweaks, both textual and visual, can have on conversion. The psychological impact that a simple background color of a CTA button has on our behavior is huge. After all, that color can determine whether or not you are going to buy that product.
What we see and how our brains process and interpret this information fascinates me. The possibilities of subconsciously pointing potential customers in your chosen direction are endless. I hope to apply my expertise more often within our solutions in the future.
This piece was written by Vera van der Plas, working as a UX/UI Designer at Pegamento.
A Financial Controller within a company should not only be an expert in Finance. You must also have knowledge of the latest IT developments. Because these are also moving very quickly in the world of Finance.
At Pegamento, I can learn all about the latest IT developments. Like the latest development in the field of Machine learning and deep learning.
Through these application areas, as Financial Controller, I can further automate the financial business processes within Pegamento and implement improvements for the automatic processing of financial data.
This piece was written by Fouad Rahaoui, working as a Financial Controller at Pegamento.
Hospitality is one of my deepest motivations.
Not surprisingly, of course, customer service is a common thread in my career. Aspects of hospitality is being able to connect, to facilitate but mainly to make someone feel genuinely welcome. My intuition is my greatest asset to be able to put myself in the shoes of a guest. A customer is my guest.
Fed by various senses, an image forms around the client. I listen to what is being said, watch facial expressions, taste the underlying tone and get a feel for the challenge to be addressed. An image literally forms on my retina. I have to be able to see it. If I can see it, I can create it.
In this, the trick is to pursue simplicity, give the client a warm feeling that the problem is understood, receive good advice, facilitated and carefully guided to the solution. Trust, connect and unburden.
The feeling when a guest arrives at your hotel after a long tiring journey, can sit in front of the fireplace, be handed a good glass of wine and stare carefree at the fire. My guest knows it will be okay.
This piece was written by Ernst Vegter, working as a Business Consultant at Pegamento.
A picture is worth a thousand words, is an expression most of us have heard. We see a lot of things around us on a daily basis and subconciously have the ability to recognize and understand them. This ability of humans to me seems bizarre.
As a computer vision developer at Pegamento that is what I do, break down complex problems and turn them into solutions using images by meticulously extracting useful data.
With the world moving forward and new technologies emerging, complicated problems which were difficult to solve a decade earlier suddenly seem possible and viable. The future is full of new challenges and I look forward to them.
This story is written by Gunish, working as an AI developer at Pegamento.
Hearing the wishes a customer has or the problems a customer is facing is important in order to then be able to help them properly. In both cases, I help find the right solution.
When the customer comes to us with a desire, they don’t know what all the options are. In this I advise them to make the right choices. When problems arise, listening to them is important. For example, a problem arises from a wrong action. By communicating well in this, many problems can be solved quickly by explaining it well. Through poor communication, a small problem can become very big.
This piece was written by Ewold Jansen, working as a Service & Support Engineer at Pegamento.
After completing my studies, I started working as a developer at a young Pegamento with a lot of ambition and enthusiasm. In the first years I learned all about process automation, now better known as RPA. I often had to rack my brains to convert the work instruction into a logical function, with not too many If-statements, so that the robot could perform the work.
I developed further and went to work as a consultant. Listening well to the customer and supporting in the pre-sales phase of projects. Executing projects and listening suited me very well. It was a small, but logical, step to now work as a Scrum Master and Project Manager. I have been supervising projects for a few years now. Such as RPA, Cloud applications and AI, according to the Human lead agile approach, We build this with a large team of specialists.
This piece was written by André Glasbergen, working as a Scrum Master at Pegamento.
Good communication between customer and organization is very important. As an organization, you naturally want to be easily accessible to your customers. Either via social media channels or via the old familiar telephone. Often organizations do not know exactly how they want their telephone line set up. That is why I like to help them think along and give them ideas. I believe there is a solution to every problem. But sometimes you just need someone who looks at the situation a little differently.
This piece was written by Ensar Ari, working as an IT Engineer at Pegamento.
“You get to know someone better by playing for an hour than by talking for a year.”
This quote from Plato is totally hitting home for me. That’s why I like to connect people through play. Because while playing, you are totally on, all your senses at work.
In my great role as Chief Happiness Officer, I want to do that by connecting colleagues with each other and with the organization. In a creative and playful way that suits Pegamento.
When I’m not at work, I also enjoy connecting people. I do this by organizing The Playground, where adults play games you used to play in the schoolyard, gymnasium or neighborhood playground. The pure feeling of fun, total relaxation and no thoughts of anything but playing. That feeling is the goal.
This piece was written by Nini, working as Chief Happiness Officer at Pegamento.
How can I help you? That’s pretty much the first question I ask when talking to people who are curious about our services. In such a conversation, the use of senses is very important. Because not everyone is the same. One person thinks in images, while for another words are important or how something feels. For me, sight and hearing are the most beautiful senses, because both eyes and ears absorb information and can convey or process emotions.
Why hearing? Because listening is essential in contact. And it’s the key to unlocking valuable insights.
I developed this skill early on. As a child, I enjoyed radio plays on the radio, bringing the stories to life in my head.
Programming is more than just “code knocking. For me, listening to what the customer wants and visualizing that is an important part of software development.
Actively listening to a customer to understand the customer’s full story is crucial before building a solution. When you understand a customer’s story, you can think together about a solution that truly helps the customer.
Visualizing solutions is the next step for me. What will be the route we will climb to get to a solution? What challenges are we going to face to get to the top?
Like climbing, good preparation is valuable. Even though you can’t prepare for everything, preparation helps make the application fit the client’s needs as well as possible.
What a beautiful and fascinating profession programming is.
This piece was written by Pim Ritmeijer, working as a Software Developer at Pegamento.
Hearing is something you do a lot of as a programmer but also thinking, for example, when you are tasked with putting together a customer need. If the customer wants a function for his application, it is important that as a programmer you think carefully about which functions are functional and which functions are not. In this way, you will put together the most functional application possible and the customer will have a good end product. Turning needs into code into functionality is something I find interesting.
I am currently doing an internship at Pegamento and studying Software Developer. I get a lot of information that you have to process and apply. The nice thing about this is that you can learn new things but also that you can experience how it works in real business. I started this training last year and knew nothing about programming beforehand. Now I can find my own way with programming and I enjoy working with it. That you can get from a blank page to a functional application through code is cool!
This piece was written by Denise Verhoef, working as a Software Developer intern at Pegamento.
Using innovative software technology for people or business to make “things” easier and smarter is really a driving force. That’s why the connection between the senses appeals to me the most. Our brains connect the senses just like a business process connects people, systems (data) and logic. They register and trigger an action, exactly how it should be in an optimal workflow. Very cool what is already possible today when we add a lot of computational power to that as well.
Hearing also means a lot. Not because I like to listen to Jazz, Soul, Deep House or Focus-like music every day AND have to be able to listen well to interpret a wish or pain point, but more because not everyone can have all the senses at their disposal. Think of him or her with a visual impairment. The fact that in close cooperation we were able to apply AI, TTS/STT technology (which is still in development) for this often underserved group of people in today’s digital world and to improve the interaction and experience with it gives me a lot of energy and meaning to what I try to do with technology; create value.
This piece was written by Remco, working as a Business Consultant at Pegamento.
Once when I had to choose which study I was going to do, I had a hard time making that choice. I was interested in engineering, but what I most wanted to do was just work with a team toward a common goal.
To this day, that is still what I love doing most. The technology has become image recognition and the team the computer vision department of Pegamento. So it’s logical that in terms of sense, I end up with “seeing. By using our image recognition solutions to see things in the real world, our entire team solves relevant problems for our customers. And because of the variation in customers, the places where our solutions end up are never the same. For example, one moment I am in the control room of a bridge and the next day I am on a production line for sandwiches or between the fences of a TBS clinic.
This piece was written by Thomas de Wolf, working as a Computer Vision & AI Lead at Pegamento.
Recognizing and automating patterns. Tasks we are constantly working on when implementing our robots at Pegamento. My 2 Drentsche Patrijshonden are hunting dogs and certainly not robots. The hunting instinct and intuition is basically in their genes. Continuing to offer new forms of training has taught them to recognize and act independently in hunting situations. Even “unsupervised,” even if I’m not around.
But when you try to teach a brain something, it also starts to see things you don’t expect. Dogs pick up on the slightest deviation in your voice or directions. To start recognizing that and correcting it again is perhaps the most complex challenge. But in our work, for the wonderful clients for whom we get to work, it often yields the most beautiful new insights!
This piece was written by Rob, founder of Pegamento and in charge of Marketing and R&D.
Feeling. That’s the best thing Pegamento stands for. Feeling for technology in the broadest sense of the word. Not only feeling for the exciting stuff like AI, but also for the basics of communication.
The very best part of my job is selling, listening, translating and thinking about what really matters. We bring the digital transformation with a great team!
The diversity of our team, how sharp we are, but especially the wonderful things we get to make makes me feel extremely good. Hence, I intuitively chose the sense of “feeling.
Feeling gives life and differentiation!