In office buildings around the world, the instruction is clear and universally understood: in case of fire, break glass. The act is deliberate, visible and reserved for emergencies only. In cybersecurity, however, the equivalent mechanism, the so-called “break glass account”, is far more controversial. Designed to provide emergency access when normal systems fail, break glass accounts sit at the intersection of resilience and risk. For chief information security officers, they represent a necessary safeguard in theory, yet a potential liability in practice. As cyber threats grow more sophisticated and identity systems become more complex, organisations are being forced to confront an uncomfortable question:...