Ransomware can target identity, bypassing technical defences. Boards should prioritise identity security, align investments, and embed risk in governance.