the BREACH HAD PERMISSION: attacker did not break in. It signed How AI, Identity Failure and Zero Trust Decide Which Companies Survive Next Cyber War

The attacker did not break in. It signed in. MGM fell to a ten-minute phone call. Marks & Spencer lost roughly £300 million to a help-desk conversation. Change Healthcare was taken down through one portal with no MFA - and its CEO had to explain that sentence to Congress. Jaguar Land Rover's five-week shutdown cost the UK economy an estimated £1.9 billion. None of these began with a broken window. Every one began with a working login. THE BREACH HAD PERMISSION is the boardroom doctrine for the identity-first cyber war: twenty-nine principles that turn valid-credential attacks, AI agents, non-human identities, zero trust and supplier risk into questions a board can ask, metrics a board can trust, and plans a leadership team can execute. Inside: - Twenty-nine doctrines - quotable, defensible, built for board papers - From the Headlines in every chapter: MGM, M&S, Okta, Snowflake, Midnight Blizzard, Uber, Change Healthcare, Arup's deepfake CFO, Salesloft-Drift, MOVEit, CrowdStrike, Jaguar Land Rover - sourced, and turned into controls - The AI firewall: governing copilots and agents before they govern you - DORA, NIS2, the SEC's four-business-day rule and the personal-liability era, decoded - The board dashboard, the evidence file, and the five questions that expose soft answers - 90-day rescue, 12-month transformation, 24-month defensible enterprise - plans with dates - Fourteen field appendices: registers, scorecards, three glossaries and a 90-question executive FAQ Written by Professor Kai London, CISSP, CISM - cybersecurity executive and board advisor across banking, aviation, defence, government and critical national infrastructure. The next breach will have permission. Decide now how much.