Many organisations believe they are operating at Essential Eight ML2 or ML3. In reality, their SaaS resilience sits closer to ML0–ML1. This 2026 briefing explains why - and how Essential Eight must evolve for identity-driven, SaaS-dependent operations.