In an era where technology evolves faster than organizational structures can adapt, accountability for cyber risk is becoming increasingly distributed across organizations and their digital ecosystems. As responsibilities become more fragmented, maintaining clear ownership, effective oversight and independent assurance becomes significantly more challenging. This article examines whether the Three Lines Model, long regarded as a cornerstone of cybersecurity governance and risk management, is keeping pace with modern technology and increasingly distributed cyber risk ownership.

What major cyber incidents reveal about accountability

When a major cybersecurity incident occurs, organizations naturally focus on the technical details. Investigators analyze attack paths, review vulnerabilities, examine system configurations, and determine how adversaries gained access. Those findings are undoubtedly important.

Yet some of the most valuable lessons often emerge from a very different set of questions.

  • Who owned the risk?
  • Who challenged the decision not to act?
  • Who independently verified that controls were operating effectively?

These questions sit at the heart of cybersecurity governance. While attacks are ultimately executed through technical weaknesses, the conditions that allow those weaknesses to persist are often shaped by decisions around ownership, oversight and assurance.

Whether examining the Equifax breach, the Microsoft Exchange Online intrusion linked to Storm-0558, the Change Healthcare attack or the European Commission incident, a common pattern begins to emerge. The technologies, industries and attack techniques may differ, but many significant cyber incidents ultimately expose the same weakness: accountability became unclear long before a control failed.

Incident observations

The widely cited Equifax breach exposed the personal information of approximately 148 million consumers. Attackers exploited an unpatched Apache Struts vulnerability, while unclear ownership and an expired monitoring certificate contributed to delayed detection. The U.S. House Oversight Committee described the breach as “entirely preventable” and identified gaps in accountability and authority as contributing factors.

The Microsoft Exchange Online intrusion linked to Storm-0558 affected email accounts across approximately 25 organizations, including government agencies. A stolen signing key enabled attackers to forge authentication tokens, while weaknesses in key validation and logging compounded the accountability gaps. The U.S. Cyber Safety Review Board concluded that operational and strategic decisions contributed to the compromise and issued recommendations for Microsoft, cloud service providers, industry and government.

The Change Healthcare ransomware attack disrupted healthcare delivery and provider cash flow. Attackers used stolen credentials to access a legacy external-facing Citrix system that lacked multifactor authentication (MFA), despite organizational policies requiring it. The incident illustrates how security requirements can fail when policy is not implemented consistently across legacy systems.

In the 2026 European Commission incident, attackers gained access to an AWS account supporting Europa.eu after obtaining a cloud secret through a compromised version of the Trivy security tool. CERT-EU linked the breach to a software supply-chain compromise and weaknesses in the isolation of CI/CD secrets. The incident highlights how accountability can extend across software supply chains, cloud credentials and third-party technology dependencies.

Governance implications

Viewed through a governance lens, these incidents reveal different forms of accountability failure. Equifax highlights unclear ownership and authority; Storm-0558 demonstrates the complexity of shared responsibility in cloud environments; Change Healthcare illustrates the gap between policy and implementation; and the European Commission incident shows how accountability can become fragmented across software supply chains and third-party ecosystems.

As illustrated in Figure 1, these challenges become increasingly difficult to manage as accountability is distributed across internal teams, external providers, and interconnected technology environments. Although the incidents involved different technologies, industries, and attack methods, they point to the same underlying lesson: effective cyber resilience depends on clear ownership, credible challenge, and independent assurance.

Figure 1: Governance and accountability lessons from major cyber incidents

Introducing the Three Lines model: Who owns cyber risk?

The Three Lines of Defense emerged as a practical way to clarify responsibilities across operational management, risk and compliance functions, and internal audit. The Institute of Internal Auditors (IIA) later updated it as the Three Lines Model to strengthen accountability, collaboration, and governance in increasingly complex organizations. This article uses the term Three Lines Model throughout.

Figure 2: The Three Lines Model

The Three Lines Model remains relevant, but cyber risk no longer moves through organizations in the same way it did when many governance structures were first established. Today, organizations operate across cloud platforms, SaaS ecosystems, DevSecOps pipelines, outsourced services, AI-enabled business processes and increasingly interconnected digital environments. Responsibility is now shared among business functions, technology teams, external suppliers and platform providers.

The question is no longer whether organizations have implemented the Three Lines Model. The question is whether their implementation has kept pace with the realities of modern cyber risk.

Applying the Three Lines model to modern cybersecurity governance

As technology becomes more interconnected and distributed, accountability becomes harder to maintain. The First Line owns risk, the Second Line provides oversight and challenge, and the Third Line provides independent assurance. However, responsibilities are often spread across multiple teams, suppliers and technology platforms, creating greater potential for gaps, overlaps and unclear ownership. Technology decisions are no longer confined to IT, with business functions increasingly adopting and operating technologies that introduce cyber risk.

When accountability becomes fragmented, governance weaknesses emerge. Vulnerabilities remain unresolved, responsibilities become unclear and risks fall between organizational silos.

Figure 3: How modern technology is challenging the Three Lines model

  • Cloud platforms: Clarifying shared responsibility

Cloud services divide responsibilities between the organization and its providers, but accountability for organizational risk cannot be outsourced. Customers continue to own areas such as data, identities and configurations. Organizations should therefore document provider and customer responsibilities, assign named owners and independently validate critical controls across the end-to-end cloud environment.

  • SaaS applications: Restoring business ownership

SaaS enables business functions to adopt technology rapidly, sometimes outside traditional IT governance. Although providers manage the underlying platform, customers remain responsible for areas such as data, access and configuration. Organizations should name a business owner, define onboarding and security requirements, monitor access and configuration, and assess customer-managed controls rather than relying solely on provider assurance.

  • Artificial intelligence: Governing the full lifecycle

AI risks may span business use, data, models, security, privacy, human oversight and third-party providers. The NIST AI Risk Management Framework organizes AI risk management around Govern, Map, Measure and Manage, with governance applied throughout the AI lifecycle. Organizations should assign ownership for the use case, data and model outcomes, establish risk classifications and approval thresholds, and independently assess testing, monitoring and material changes.

  • DevSecOps: Assuring automated controls

DevSecOps embeds security into software development and deployment pipelines through automated checks, credential protection, artifact verification and CI/CD policy enforcement. Delivery teams should operate secure pipelines, the Second Line should define mandatory controls and exception requirements, and the Third Line should verify whether those controls are enforced and operating reliably.

  • End-user computing: Applying proportionate governance

Business teams increasingly rely on spreadsheets, scripts, databases and automated workflows that may sit outside formal application governance. Organizations should identify critical tools and accountable owners, classify them according to risk, apply proportionate access and change controls, and include higher-risk solutions in assurance activity.

  • Integrated digital ecosystems: Extending accountability

Modern services increasingly depend on APIs, suppliers, digital partners and managed platforms. Organizations should retain an accountable business-service owner, govern interfaces and dependencies, assess supplier controls and define resilience, incident escalation and exit arrangements across the end-to-end ecosystem.

Across all six technologies, the specific challenges differ, but the underlying requirement remains consistent: accountable ownership in the First Line, responsive oversight and challenge in the Second Line, and independent assurance across the full technology lifecycle and dependency chain.

Modern technology does not invalidate the Three Lines Model. It requires the model to operate beyond traditional organizational and system boundaries.

Part 2 examines four recurring challenges that can weaken accountability in practice: constrained challenge, blurred responsibilities, governance bottlenecks and delayed assurance.

Resources

https://oversight.house.gov/report/committee-releases-report-revealing-new-information-on-equifax-data-breach/
https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf
https://www.cisa.gov/resources-tools/resources/CSRB-Review-Summer-2023-MEO-Intrusion
https://blogs.microsoft.com/on-the-issues/2024/06/13/microsofts-work-to-strengthen-cybersecurity-protection/
https://www.finance.senate.gov/imo/media/doc/responses_for_questions_for_the_record_to_andrew_witty.pdf
https://difi.az.gov/change-healthcare-congressional-hearings
https://www.healthcaredive.com/news/change-healthcare-cyberattack-congress-unitedhealth-andrew-witty/714954/
https://cert.europa.eu/blog/european-commission-cloud-breach-trivy-supply-chain
https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project
https://learn.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility
https://airc.nist.gov/airmf-resources/airmf/5-sec-core/
https://www.nist.gov/itl/ai-risk-management-framework/nist-ai-rmf-playbook
https://www.nist.gov/itl/ai-risk-management-framework
https://pages.nist.gov/nccoe-devsecops/
https://csrc.nist.gov/pubs/other/2026/03/24/devsecops-practices/iprd
https://www.nccoe.nist.gov/projects/secure-software-development-security-and-operations-devsecops-practices
https://www.ibm.com/products/api-connect