The Perfect Score Flaw No Insurer Control Could Reach

   / @thehambergerreport   A CVSS 10.0 vulnerability in Microsoft Entra ID, CVE-2026-69836, disclosed on 20 August 2026, required no password, no customer action and no patch, because it sat beneath the authentication layer every insurer-mandated control operates above. Microsoft's bulletin first stated the flaw was under active exploitation, then revised that within days. The book's Fiduciary Risk Exposure formula and its Audit of Intent behavioural control both presuppose a completed login, so a flaw beneath authentication is invisible to either by construction. New Zealand insurers have spent 2026 turning multi-factor authentication from a discount lever into a condition of cover; NCSC New Zealand's 4 August 2026 supply-chain guidance and the Privacy Act 2020 reasonable-safeguards duty name the same identity-provider concentration this flaw exposed. A working proof-of-concept in verification-first AI governance: every episode is produced through gated control points that test real-time verification, source-checking, and containment models, with a person confirming each gate. Practical analysis by Andreas Hamberger, enterprise architect, technology strategist, and author of four books including Lethal By Design. Free As In Theft: https://hamberger.short.gy/freeasintheft 🌐 thehambergerreport.com 💼 linkedin.com/in/andyhamberger Chapters: 00:00 Cold open 00:17 Introduction 01:27 The fix nobody could audit 02:39 What the checklist can't price 03:59 An identity layer you can inspect 05:09 The root of trust nobody chose 06:19 From discount lever to eligibility gate 07:32 The checklist is a floor 08:42 Wrap-up [1] Help Net Security. "Microsoft Entra ID Vulnerability (CVE-2026-69836)." 21 August 2026. https://www.helpnetsecurity.com/2026/... [2] The Hacker News. "Microsoft Entra ID Flaw Scores CVSS 10.0." August 2026. https://thehackernews.com/2026/08/mic... [3] Cybersecurity Dive. "Microsoft Discloses Maximum-Severity Flaw in Entra ID, Then Revises Exploitation Status." 21 August 2026. https://www.cybersecuritydive.com/new... [4] Hamberger, Andreas. The Hamberger Report: Cyber Guide for New Zealand Boards. 2026. (Internal source file; no public URL.) [5] Aon. Q1 2026 Global Insurance Market Insights. Published 4 May 2026. (No URL captured for this source.) [6] Bolivar, Rod. "NZ Cyber Guidance Lands Just as Cheap Cover Gets Cheaper." Insurance Business New Zealand. 18 August 2026. (No URL captured for this source.) [7] National Cyber Security Centre New Zealand. "Strengthening Your Supply Chain Security." 4 August 2026. https://www.ncsc.govt.nz/news/strengt... [8] FIDO Alliance and World Wide Web Consortium (W3C). WebAuthn specification. (No URL captured for this source.)