Category: IT Management

Summary: Guest Wi-Fi should provide internet access while blocking connections to your internal business network. A different Wi-Fi name and password do not confirm that the networks are separated. The router, access points, and firewall must also be configured to prevent guest devices from reaching internal systems.

Offering Wi-Fi to customers, contractors, and visitors is convenient. But their phones and laptops should not connect to the same network as your business computers, printers, security cameras, servers, and file storage.

Even when you trust the person, you do not control their device. You do not know whether it has current security updates, whether it contains malware, or who else has used it.

A properly configured guest network gives visitors internet access without allowing their devices to communicate with your business systems.

What Separate Guest Wi-Fi Means

When someone connects to your guest Wi-Fi, they should be able to browse the internet, use email, and access online services. They should not be able to connect to anything on your internal network.

That includes:

• Business computers and servers
• Network printers
• File storage and backup devices
• Security cameras
• Building access systems
• Router and network management pages
• Other devices using the guest network

The Australian Cyber Security Centre recommends separating an organization’s internal network from the guest Wi-Fi used by unmanaged devices.

Both networks can use the same internet connection. The settings that separate them are configured in your network equipment, such as the router, firewall, switches, or wireless access points.

Why One Shared Network Creates Unnecessary Risk

Connecting to the same network does not automatically give a visitor access to every business file. Your passwords, device security settings, and user permissions still apply.

However, a device on the same network may be able to find or contact systems that it does not need to use. This could include a printer, shared folder, storage device, camera, or poorly protected management page.

An infected device may also try to connect to other devices on the network. If the network is divided into separate sections, those connections can be blocked before they reach your business systems.

The UK’s National Cyber Security Centre explains that network segmentation restricts movement between systems. If one device is compromised, separating the network reduces the number of other systems it can contact.

Separating the networks reduces risk by blocking access that visitors and unmanaged devices do not need.

A Different Wi-Fi Name May Not Be Enough

Your business Wi-Fi and guest Wi-Fi may appear as two different names when someone opens the Wi-Fi menu on their phone. Those names are called SSIDs.

A second SSID does not confirm that the devices are properly separated. The settings behind it must place guest devices on a separate network and block access to internal systems.

Business networking equipment commonly uses a separate virtual network, known as a VLAN, for guest traffic. Firewall rules then prevent that traffic from reaching private network addresses. Some small-business routers handle this automatically when guest mode is enabled.

Cisco’s current guidance describes guest Wi-Fi as a separate SSID connected to its own VLAN, with guests limited to internet access. Its small-office reference design also uses firewall rules to deny guest access to local networks.

The exact settings depend on your equipment. Look for terms such as:

• Guest network
• Network isolation
• Deny local network access
• Client isolation
• VLAN
• Guest firewall rules

If you only see a second Wi-Fi name and password, ask your IT provider to confirm what guest devices can reach.

Should Guest Devices Be Able to Connect to Each Other?

Guest devices should usually be blocked from communicating with one another.

This setting may be called client isolation, wireless isolation, peer-to-peer blocking, or Layer 2 isolation.

Without it, one visitor’s laptop may be able to contact another visitor’s device on the same guest network. Blocking those connections provides additional protection for everyone using the Wi-Fi.

Client isolation and business-network separation are two different controls. Client isolation blocks communication between guests. Network separation blocks communication between guests and your internal systems. A business guest network should normally use both.

Where Should Employee Phones and Personal Laptops Connect?

A personal phone that only needs internet access can usually use the guest network. The same applies to a personal laptop that does not need to connect to internal business systems.

If employees use personal devices to access company files, applications, or internal systems, the business needs a clear bring-your-own-device policy. Those devices may require security software, device management, encryption, and specific access rules.

An employee-owned device should not receive unrestricted network access unless the work requires it.

Company-owned and managed devices can use the business network if they need access to internal resources. Personal and unmanaged devices should use a restricted network unless there is a business reason to provide additional access.

What About Smart TVs, Cameras, and Other Connected Devices?

Smart TVs, speakers, cameras, thermostats, digital displays, and similar products often need internet access but do not need to communicate with your computers.

These devices can be placed on a separate network for connected devices. Some smaller businesses use the guest network for this purpose, although that may not work if the devices need to communicate with a controller, phone, or local recording system.

The right setup depends on how the devices work. A smart TV or security camera should not be able to reach business computers just because it uses the same router.

CISA’s network-segmentation guidance notes that separate networks can be used for guests, connected devices, personal computers, and work computers.

How to Check Your Guest Wi-Fi

Use these five checks to confirm that the network is set up correctly:

1. Check which devices use each network. Business computers and other managed equipment should use the business network. Visitors and unmanaged devices should use the guest network.
2. Confirm that local network access is blocked. Guest devices should not be able to connect to printers, file storage, cameras, servers, or network management pages.
3. Check whether guest devices are isolated from each other. Enable client isolation or the equivalent setting if your equipment supports it.
4. Review the Wi-Fi security settings. The Australian Cyber Security Centre recommends WPA3, WPA3 transition mode when compatibility is required, or WPA2 when WPA3 is unavailable. Use a guest password that is different from your business Wi-Fi password.
5. Check the router and access points. Install current firmware, enable automatic updates when supported, replace default administrator credentials, and replace equipment that no longer receives security updates.

Test the guest network again whenever the router, firewall, switches, or wireless access points are replaced or reconfigured.

Do You Need a Separate Internet Connection?

Most small businesses do not need to pay for a second internet connection just for visitors.

A suitable business router or firewall can use one internet connection while keeping the internal and guest networks separate. The guest network can also have its own speed limit so that visitor traffic does not use all the available bandwidth.

Very small or older routers may not support proper isolation. Some provide a guest Wi-Fi option but offer limited control over what guests can access. Check the manufacturer’s documentation or ask your IT provider to test the configuration.

Keep the Guest Password Separate

Do not use the same password for your guest and business Wi-Fi networks.

Sharing the business password with visitors makes it harder to control who can reconnect later. It also means changing the password on every company device if the password needs to be replaced.

A separate guest password can be changed without disconnecting business equipment. Change it when too many people know it, after a large event, or when a contractor no longer needs access.

The password protects access to the guest network. It does not replace network separation.

Frequently Asked Questions

Is a guest Wi-Fi password enough to protect my business network?

No. The password controls who can connect to the guest Wi-Fi. Your equipment must also block guest devices from reaching the internal business network.

Can guests use the same internet connection as employees?

Yes. The networks can share one internet connection while remaining separated inside the router, firewall, and wireless equipment.

Should employees connect their personal phones to guest Wi-Fi?

If the phones only need internet access, the guest network is usually the safer option. Devices that need access to company systems should follow your business’s device and access policies.

Can visitors use a network printer?

Guest access to printers should normally be blocked. If visitor printing is necessary, your IT provider can set up a controlled method without giving guests access to the rest of the business network.

Does guest Wi-Fi prevent cyberattacks?

No. It reduces unnecessary access and can limit how far a compromised device can reach. Your business still needs secure passwords, multifactor authentication, software updates, endpoint protection, backups, and appropriate access controls.

Sources and Further Reading

• Secure Your Wi-Fi and Router: Australian Cyber Security Centre
• Risk Management of Enterprise Mobility: Australian Cyber Security Centre
• How to Implement Zero Trust Network Access: UK National Cyber Security Centre
• Cisco Unified Branch Design Guide
• Cisco Meraki Small Office Reference Architecture
• Federal Mobile Workplace Security Guidance: CISA

Ask your IT provider to confirm that your guest Wi-Fi is properly separated from your business network. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it out.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Summary: Allow personal devices only for approved work, through approved apps, and when the device meets your security requirements. Use company-owned devices for administration, sensitive work, or jobs that require large amounts of data to be stored locally.

Employees often use personal devices for work before the business has made a decision about it. They add work email to a phone, download a file to a home laptop, or sign into a company app from a computer shared with family.

Once business data is stored on a personal device, you have less control over updates, installed apps, backups, and who else uses the device. You also need a way to remove company data when the employee leaves or the device is lost.

Personal devices can be allowed, but the business should decide which devices, applications, and types of work are permitted.

What BYOD includes

Bring your own device, usually shortened to BYOD, means an employee uses a personally owned phone, tablet, or computer for work.

That can include:

• Adding work email to a personal phone
• Signing into Microsoft 365 or Google Workspace
• Joining online meetings
• Opening customer or company files
• Using a business messaging app
• Accessing accounting, CRM, or project management software
• Downloading documents to a personal computer

Depending on the application, business information may remain in the cloud or be downloaded to the device as messages, attachments, cached data, or files.

What you cannot fully control on a personal device

Your IT team can set and monitor security on company-owned devices. With personal devices, employees choose which apps to install, when to update the operating system, who else uses the device, and where files are backed up.

Management software can enforce some rules, but the available controls depend on the device, operating system, application, and enrollment method.

Other people may use the device

An employee may share a home computer or tablet with a partner, child, or another family member. Separate user accounts can reduce the risk, but many personal devices are used through one shared account.

The UK National Cyber Security Centre says BYOD access should not be permitted when an employee cannot follow the required security rules. Its example includes a device that cannot keep the employee’s work separate from other family users. NCSC BYOD guidance

Updates may be missing

Your IT provider may not be able to confirm whether a personal device runs a supported operating system or has current security updates.

An employee may delay an update because the device lacks storage, an older application might stop working, or the device is rarely restarted.

Business files may enter personal storage

A file downloaded from work email or cloud storage may remain in the Downloads folder, a personal document folder, or a device backup.

A personal cloud backup service could then copy the file to an account the business does not manage. Opening the document in a personal application may create another unmanaged copy.

Other applications may access business information

Personal devices contain applications chosen by the employee. Some may have permission to read files, contacts, browser activity, or information copied to the clipboard.

The business may not know which applications are installed or what those applications can access.

Repairs can expose business data

A broken personal phone or laptop may be taken to a repair shop chosen by the employee. Business email, saved sessions, or downloaded files could still be available on the device.

Your policy should tell employees who to contact before a device is repaired and what to do if the device cannot be opened.

Company data may remain after employment ends

Disabling an employee’s account stops future access to many cloud services. It does not remove copies that were downloaded to personal folders, opened in unmanaged applications, or copied to personal storage.

Managed work profiles and protected applications make it easier to remove company data. They can only remove the information they control.

Decide what work is allowed

Set access based on the work being performed and the information involved.

You might allow employees to read work email through an approved mobile app while requiring a company computer for customer database exports. Staff handling financial records, health information, legal documents, or large amounts of customer data may also need company-owned devices.

Administrative work should be performed from a managed device. Anyone responsible for user accounts, security settings, backups, or business systems should not do that work from an unmanaged personal computer.

Apply the same rules to contractors. Their access should be limited to the applications and information required for their work.

Security requirements for personal devices

A personal device should meet your requirements before it can access company information.

Use a supported operating system

The device should run an operating system that still receives security updates. Block access from devices that can no longer install current updates.

Install security updates

Operating system and application updates should install automatically where possible. Employees should restart their devices when an update requires it.

Require a screen lock

Require a PIN, password, fingerprint, or facial recognition to unlock the device. Configure the screen to lock automatically when the device is not being used.

Require device encryption

Encryption helps protect stored information if a device is lost or stolen. The Australian Cyber Security Centre recommends full-device encryption when personal devices may store business information. Cyber.gov.au BYOD guidance

Encryption must be enabled before the device is lost. It also needs to be supported by a strong device password or PIN.

Require MFA

Require MFA for work email, cloud storage, and other important systems. The NCSC recommends MFA as a minimum for BYOD access.

Use MFA for account sign-ins. Protect downloaded information with encryption and managed applications.

Block rooted or jailbroken devices

Rooting or jailbreaking removes some of the operating system’s built-in restrictions. These devices should not be allowed to access company data.

Detection is not perfect, so it should be used with the other security controls in this article.

Approve the applications used for work

Tell employees which applications they may use for email, messaging, file access, and other work.

Where your management service supports it, prevent business information from being saved to personal storage or copied into unmanaged applications.

Use separate accounts on shared computers

A personal computer used for work should have a separate account for the employee. Other users should have their own accounts and should not know the employee’s password.

Do not allow BYOD access when work cannot be kept separate from other users of the device.

Tell employees how to report problems

Employees need to know who to contact if a device is lost, stolen, repaired, replaced, or infected with malware.

Early reporting gives the business more time to disable access, check account activity, and remove managed data.

Control business data with managed apps or work profiles

Device and application management services can help keep work information separate from personal information.

Mobile device management, or MDM, can apply settings to an enrolled device and report whether it meets company requirements. The amount of control depends on the platform and enrollment method.

Mobile application management, or MAM, applies controls to supported work applications and their data. Depending on the product, it may restrict copying, block saving to personal storage, require another PIN, or remove company information from managed apps.

For example, Microsoft Intune can remove company data from protected applications when a device is lost or an employee leaves. Personal information can remain on the device.

Selective removal only affects data managed by the service. It cannot delete a file copied into an unmanaged application, personal backup, or unsupported storage location.

A factory reset removes personal and business data. Microsoft warns administrators about the risk of applying full device management to computers and phones the business does not own. Configure selective removal where possible and tell employees exactly what your management service can see and do. Microsoft Intune planning guide

What your BYOD policy should cover

Your policy should answer these questions:

• Which employees and contractors may use personal devices?
• Which types of devices are permitted?
• What work can be performed on them?
• Which applications must be used?
• Can company files be downloaded?
• Can the device be shared with other people?
• Which security settings are required?
• What information can the business or IT provider see?
• What settings can the business control?
• Can company information be removed remotely?
• What happens if the device is lost or stolen?
• What must happen before the device is repaired or sold?
• What happens when the employee leaves?
• Who pays for mobile data, repairs, or replacement?

Privacy, employment, and data protection requirements vary between countries. Have the policy reviewed for each location where you employ people.

Employees should read and accept the policy before company access is added to their devices.

What to do when a personal device is lost or stolen

The employee should contact the business or IT provider as soon as possible.

Your response may include:

1. Disabling access if the device cannot be accounted for
2. Revoking active sign-in sessions
3. Removing company data from managed applications
4. Removing the device from approved-device lists
5. Checking account activity for unexpected sign-ins
6. Resetting credentials if they may have been exposed
7. Recording which company files may have been stored on the device

Remote locking and removal commands only work after the device connects to the management service. A device that remains switched off or offline may never receive the command.

Encryption and account controls are still required because remote removal might not run.

What to do when an employee leaves

Disable the employee’s account and revoke active sessions at the agreed time. Remove company data from managed applications or work profiles.

Check whether business files were downloaded to the device and confirm how those copies will be returned or deleted.

Remove the device from your approved-device records. Where your management service supports it, remove business applications, certificates, email profiles, and VPN settings.

When personal devices should not be allowed

Provide a company-owned device when:

• The employee handles sensitive information
• The role requires administrator access
• Large amounts of company data must be stored locally
• The device is shared with other people
• The operating system is no longer supported
• Encryption cannot be enabled
• The business cannot separate or remove its data
• The employee does not accept the required security controls
• The device has been rooted or jailbroken

Company-owned devices are easier for your IT provider to support because their settings and installed software are known.

Frequently asked questions

Can employees use a web browser without enrolling their personal device?

You can allow browser access, but information may still remain in the browser cache, Downloads folder, saved passwords, screenshots, or active sessions.

Access policies can limit the devices and browsers that are permitted. Sensitive work may still require a managed device.

Is MFA enough to secure a personal device?

MFA helps protect the employee’s account. Device encryption protects stored files, while managed applications control how company information is used and copied.

You still need updates, screen locks, approved applications, and a process for lost devices.

Can the business see an employee’s personal information?

It depends on the management method. App management focuses on business applications and their data. Device enrollment can show device details and allow broader control.

Give employees a written explanation of what your IT team can see, change, lock, or remove before they enroll.

Can the business erase a personal phone?

Some enrollment methods support a full factory reset, while app-only management does not. A factory reset deletes personal information as well as company data.

Use selective removal for employee-owned devices where it is available.

Is BYOD cheaper than providing company devices?

BYOD may reduce hardware purchases, but it can add costs for management, support, security, and administration. Whether it saves money depends on the devices, applications, and work you allow.

Sources and further reading

• NCSC: Bring your own device guidance
• NCSC: BYOD costs and security requirements
• Australian Cyber Security Centre: Risk management of enterprise mobility and BYOD
• Australian Cyber Security Centre: Securing customer personal data
• Microsoft Learn: Protect data and devices with Intune
• Microsoft Learn: Remove company data from protected applications
• Microsoft Learn: Intune planning guide

If employees already use personal devices for work, ask your IT provider to check what they can access and whether the required controls are in place.

And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it out.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Summary: Employees should use standard accounts for email, web browsing, and everyday work. Administrator access should be limited to approved IT tasks and protected with a separate account.

Administrator access often starts with one request. An employee needs to install a printer, update a specialist program, or change a setting on their computer.

Giving them administrator access gets the job done. The problem is that the access usually stays after the request has been completed.

From then on, the employee can approve other software installations and make changes that would normally require help from IT. If they install the wrong program or someone takes control of their account, those permissions can also be used to change the computer.

For everyday work, employees should use standard accounts. Administrator access should be kept for tasks that require it.

What administrator access allows someone to do

An administrator has more control over a computer than a standard user.

On Windows, members of the local Administrators group have full control over the resources on that computer. According to Microsoft’s guidance on local accounts, Microsoft recommends limiting the number of users in that group.

Depending on the computer and how it is managed, an administrator may be able to:

• Install and remove software
• Add drivers for printers and other equipment
• Create, change, or remove user accounts
• Change system settings
• Change permissions on files and folders
• Install services that continue running in the background
• Make changes to some security settings

Mac computers also have standard and administrator accounts. Apple says administrators can install and remove software, manage other users, and change settings. Apple recommends limiting the number of administrative users and using a standard account when administrator rights aren’t required.

Local administrator access applies to the computer itself. It is different from Microsoft 365, Google Workspace, network, or server administrator access. Those accounts may control email, cloud files, user accounts, or several systems at once.

An employee may have local administrator access to a laptop without being a Microsoft 365 administrator. Both types of access should be reviewed separately.

Why permanent administrator access increases your risk

Software launched by an employee normally starts with the permissions available to that employee.

If the software asks for administrator approval and the employee approves it, the program may be able to install system components, change settings, or affect information belonging to other users.

That matters when someone downloads a fake installer, opens a harmful attachment, or installs software from an untrusted website. The employee may think they are approving a legitimate update while giving the program permission to change the computer.

Windows uses User Account Control to ask for approval before many administrative changes. An employee signed in with an administrator account can approve the request themselves. A standard user is normally asked for credentials belonging to an administrator.

Microsoft describes the standard account as the recommended and more secure way to use Windows.

Standard accounts also reduce the number of people who can change security settings without review. Employees cannot approve every installation themselves, so IT has a chance to check the program, where it came from, and what permissions it needs.

CISA advises businesses to control local administrator access and restrict who can install software. The Australian Cyber Security Centre includes restricting administrative privileges in its Essential Eight security measures and recommends creating separate accounts for administrative work. Cyber.gov.au

Standard accounts are suitable for everyday work

A standard account can still be used for normal business tasks, including:

• Reading and sending email
• Using a web browser
• Working in Microsoft 365 or Google Workspace
• Accessing approved business applications
• Joining online meetings
• Printing with an installed printer
• Opening and saving files
• Changing personal settings that do not affect other users

Some applications can be installed for one user without administrator access. Others need administrator approval because they add drivers, services, or files in protected parts of the computer.

An employee should not receive permanent administrator access because one program needs an update. IT can approve the installation, deploy the update remotely, or use a separate administrator account for that task.

Older business applications sometimes expect the user to have administrator rights. Test those applications before changing account permissions. In many cases, IT can update the application, adjust its configuration, or grant access to the specific folders it needs.

How to manage software installations without permanent administrator access

Staff can still get software installed and updated without keeping administrator rights.

Let IT install approved software

Your IT team or provider can install the program remotely. This also gives them a chance to confirm that the installer came from the software company and that the requested version is supported.

Use managed software deployment

Businesses with managed computers can send approved applications and updates to employees without asking each person to run an installer. The available method will depend on the operating system and device management service.

Approve individual requests

An employee can contact IT when an installation requires administrator approval. IT can review the request and enter the required credentials without giving the password to the employee.

Provide time-limited administrator access

Some roles need to install or test software as part of their work. Give those employees a separate administrator account that is enabled only for the approved task, then disable it afterward.

Create a separate administrator account

Employees who regularly perform approved technical work can have a separate administrator account. They should continue using their standard account for email, browsing, and normal work.

The administrator account should only be used when a task requires the extra permissions.

Who should have administrator access?

Administrator access should be limited to people whose work requires it.

That may include:

• Your internal IT staff
• Your IT provider
• An approved technical employee
• A software specialist responsible for a particular system

Business owners should use standard accounts for their normal work too. Ownership of the company does not require permanent administrator access to every computer.

Your IT provider should keep a managed administrator account so they can support each device. The password should be protected and should not be shared with employees.

Using the same local administrator password on every computer creates another problem. If that password is stolen from one device, it may work on the others. Each computer should have a unique administrator password or use a management service that controls those passwords.

How to remove administrator access safely

Do not remove every administrator account at once. Someone still needs a working way to manage and repair each computer.

1. Check which employees have administrator access

Review the local Administrators group on every Windows computer and the administrator users on every Mac. Include old accounts, shared accounts, vendor accounts, and accounts created during the original setup.

2. Confirm why each person has it

Ask what tasks require administrator access. A clear business need should exist for every account that keeps the permission.

Needing to update one application occasionally does not require permanent access.

3. Make sure IT has a working administrator account

Confirm that your IT team or provider can sign in with a protected administrator account before removing permissions from employees.

Test the account on each device. This prevents the business from being locked out of its own computers.

4. Test important software

Check the programs each employee needs for their job. Confirm that they open, update, and work correctly when the employee uses a standard account.

Any application that fails should be reviewed before administrator access is removed permanently.

5. Change the employee’s account to a standard account

Once the computer has been checked, remove the employee from the local administrator group or change the account type.

The employee should then sign out and sign back in so the new permissions apply correctly.

6. Tell staff how to request an installation

Give employees one place to contact when they need software installed or a setting changed. Explain what information to include, such as the program name, the reason it is needed, and the official download page.

7. Review access when roles change

Check administrator access when an employee changes jobs, receives new responsibilities, or leaves the business. Include it in your regular access reviews as well.

Frequently asked questions

Can a standard user install software?

It depends on the software. Programs that only install inside the employee’s user profile may not need administrator approval. Software that changes protected system files, installs drivers, or adds background services usually requires administrator credentials.

Will removing administrator access stop employees from working?

Normal business applications should continue working. Test specialist and older applications before making the change across every computer.

Does removing administrator access stop malware?

It reduces what many harmful programs can change, but it does not prevent every attack. You still need supported software, security updates, endpoint protection, email security, MFA, and tested backups.

Should the business owner keep administrator access?

Use a standard account for everyday work. If you need administrator access for an approved task, use a separate account and keep its password protected.

Is local administrator access the same as Microsoft 365 administrator access?

No. Local administrator access controls one computer. Microsoft 365 administrator roles can control cloud users, email, files, security settings, and other parts of the company’s Microsoft environment.

Both should be limited and reviewed.

Sources and further reading

• Microsoft Learn: Local accounts
• Microsoft Learn: How User Account Control works
• Apple Support: Set up your Mac to be secure
• CISA: StopRansomware Guide
• Australian Cyber Security Centre: Restricting administrative privileges

If you are not sure who has administrator access or whether your employees need it, ask your IT provider to review the accounts on your business computers.

And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it out.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Summary: Most IT problems don’t appear out of nowhere. Backups quietly stop running, updates sit unfinished for weeks, and old staff accounts stay switched on for months. A short check once a month catches these while they’re still cheap to fix. This post covers the six things to look at.

Most owners only look at their IT when something has already gone wrong. A file won’t open, a laptop won’t start, or an invoice gets paid into a scammer’s account. Fixing it at that point costs more than preventing it would have.

Almost none of it happens without warning. The backup that fails when you finally need it had been failing for weeks. The account a scammer used belonged to someone who left last year. Thirty minutes a month is usually enough to catch that kind of thing.

Why a monthly look is worth the time

Verizon’s 2026 Data Breach Investigations Report found that 31% of breaches started with attackers exploiting software that hadn’t been patched. That makes unpatched software the most common way in, ahead of stolen passwords. The same report found the median time to fully fix a known problem has risen to 43 days.

Most attacks use a problem that was already known, with a fix already available. Nobody had installed it yet.

The check

1. Updates

Check whether Windows updates are installing on your computers, or sitting at “restart required” week after week. Do the same for phones and for the software you use most, like your browser and your accounting app. If people keep clicking “remind me later,” that’s something to fix.

2. Backups

Open your backup tool and look at the last few runs. You want recent successful backups, not a list of errors. Then check when anyone last restored a file from it. If it’s never been tested, you don’t know whether it works.

3. Who has access

Pull up the list of user accounts in Microsoft 365 or Google Workspace and read through it. Every name should be someone who still works for you. Look for people who left, contractors who finished months ago, and shared logins like “office” or “admin” that several people use. Switch off anything you don’t need.

4. Multi-factor authentication

Check that MFA is switched on, and that it’s on for everyone, not just the people who set it up first. Pay closest attention to admin accounts and anyone who handles money. Microsoft’s research shows MFA blocks more than 99.2% of account compromise attacks.

5. Devices

Look at what’s connected to your systems. If there’s a laptop or phone you don’t recognize, find out whose it is. While you’re there, check that laptops are encrypted and that any phone with company email on it has a passcode or fingerprint lock.

6. Subscriptions and licenses

Open your billing page and read what you’re paying for. Businesses regularly pay for licenses belonging to people who left, or for two tools that do the same job. It’s also how you find software somebody signed up for without telling anyone.

Make it a routine

Put it in the calendar on a fixed day, like the first Monday of the month, and give it to the same person each time. That’s you or whoever handles the admin side.

Keep a running note of what you checked and what you found. After a few months you’ll see whether the same problem keeps coming back. If it does, it needs fixing properly instead of clearing each time.

Thirty minutes only works if you don’t stop to fix things along the way. Write down what you find and deal with it afterward.

Who fixes what

Most of it is small, like a laptop that needs restarting, a license to cancel, or an account to switch off. Handle those yourself.

Send the rest to your IT provider: backups that keep failing, MFA that won’t turn on for someone, a device nobody recognizes, or updates that fail on the same machine every month. Those usually mean there’s a bigger problem behind them.

What this check doesn’t do

It isn’t monitoring. A good IT provider has tools watching your systems all day and flagging things you’d never spot from a monthly glance.

The check covers what those tools can’t know. You know who left, which subscriptions you approved, and whose laptop is whose.

Frequently asked questions

How often should a small business check its IT?

Once a month is enough for this list. Backups are worth a quick look more often if losing a day’s work would seriously hurt, since that’s the item most likely to fail quietly.

Who should do it?

You or whoever runs the admin side of the business. Most of the list needs no technical skill, just someone who knows who works there and what the business pays for.

What if I don’t know where to find any of this?

Ask your IT provider to walk you through it once and write down where each thing lives. Many will also send you a monthly summary covering most of it.

Isn’t this my IT provider’s job?

They handle the monitoring, the patching, and the fixing. The check is the part that depends on knowing your business, like who left last month or which subscription nobody approved.

If I only have ten minutes, what matters most?

Backups and updates. Without working backups you can lose everything you’ve stored, and unpatched software is now the most common way attackers get in.

Does this apply if everything we use is in the cloud?

Yes. Cloud tools still need updated devices, working backups, MFA switched on, and access lists that match who actually works for you.

Sources and further reading

• Verizon 2026 Data Breach Investigations Report — the finding that 31% of breaches start with exploitation of unpatched software, and that the median time to fully fix a known problem is 43 days.
• Microsoft: Plan for mandatory Microsoft Entra multifactor authentication — Microsoft’s research that MFA blocks more than 99.2% of account compromise attacks.

If you’d like a hand setting this up, your IT provider can show you where each of these lives in your systems and take the fixing off your plate. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

By the time an employee hands in their notice, the decisions that will make their departure clean or messy have already been made. They were made in the first weeks of the person’s tenure, when nobody was paying close attention because the new hire had just arrived and there were a hundred other things to do. A shared login here, a quick SaaS sign-up there, a personal laptop used until the company hardware arrived. By month six, none of those feel like decisions at all. They feel like how things are.

This post covers what’s really going wrong when offboarding takes three weeks, the four onboarding shortcuts that guarantee a painful exit, how to retrofit hygiene on the team you already have, and what your IT provider should be doing at onboarding that probably isn’t happening.

What’s really going wrong when offboarding takes three weeks

A clean offboarding takes about 90 minutes of IT time. An account is disabled in your identity provider, which cascades access revocation across every tool connected via single sign-on. The device is remotely wiped or collected and wiped on-site. Email is forwarded to a manager or converted to a shared mailbox. The departing person’s accounts in your CRM and project tools are reassigned. A handover note, already templated because it was templated at onboarding, gets filled in and filed.

The messy version of the same process can take three weeks. It starts with a manual list of tools nobody can fully remember, which usually means asking the departing employee to help reconstruct it. You find a Figma account, a Loom workspace, a Notion instance, and an Airtable base, all set up independently, all with passwords sitting in the departing employee’s personal password manager. The laptop is at their house and they’re not in any rush. A client emails to say they received a strange message from a personal address. Six weeks later, a vendor charges the company card for a seat you thought you cancelled.

Whether your offboarding is clean or chaotic depends on what was set up during onboarding.

In the identity management world, this is called the “joiner, mover, leaver” lifecycle. Microsoft and most identity vendors use the same three-phase model. A rushed joiner phase compresses months of identity cleanup into the two weeks after the resignation lands.

Four onboarding shortcuts that guarantee a messy exit

Letting new hires sign up for SaaS tools on their own

When a staff member signs up for a tool independently, using their work email and a password only they know, that account is functionally theirs. You can’t reset it without triggering a notification to them. You may not even know the account exists until a vendor invoice shows up, or until the account goes dark after they leave and a client project breaks.

This is the most common source of the “we can’t find half the logins when someone leaves” problem. The fix is provisioning every tool through a central identity system, where any new SaaS application gets connected to your single sign-on before the first user logs in.

Tolerating personal devices “just until we get them sorted”

Personal devices that get used for work don’t stay temporary. The employee installs apps, connects to client systems, downloads files, and what was a temporary fix becomes how they work permanently. When they leave, you have no ability to wipe company data from a device you don’t own and never enrolled in a management system. You’re relying on their goodwill, which is usually fine, but it is not a security control.

The fix is to issue company-owned devices on day one and enroll them in mobile device management. When you do allow a personal device, require managed app access for company email and files. Browser-saved credentials are not a substitute.

Shared logins for tools you didn’t want to pay per-seat for

Shared credentials are the worst offender at offboarding. When five people use the same login for a tool, you can’t remove one person’s access without changing the password for everyone. You usually find this out at the worst possible time, when the person leaving is the one who set up the account and nobody else remembers the password at all.

Per-seat is the cost of doing this properly. The savings from shared logins reappear during offboarding as wasted hours and exposed access.

Letting client relationships live in one person’s inbox

This one is specific to agencies and professional services. When a senior account manager or consultant leaves, their client relationships often leave with them. The context, the email history, the preferences, and the half-finished threads lived in one person’s inbox. With the person gone, all of that becomes inaccessible or awkward to retrieve.

From the client’s side, your business just doesn’t know who they are anymore.

The fix is a shared inbox or CRM where client communication is logged. Even a Microsoft 365 shared mailbox with a clear expectation that client threads are CC’d to it is a meaningful improvement over what most small businesses have today.

How to retrofit hygiene on the team you already have

The cleanup most businesses need is for the team they already have, before the next hire arrives. You can’t go back and re-onboard your existing staff, but you can audit what’s there and close the gaps before the next departure.

The SaaS audit

Pull three months of credit card statements (every card that gets used for business expenses) and list every recurring SaaS charge. For each one, find out who set it up, who has the login, whether the account uses a personal or company email, and whether anyone else can access it if that person left tomorrow.

You’ll find tools nobody remembers signing up for, tools used by one person with no backup access, and accounts where the original owner has already left while you’re still paying for the seat. None of this is a technical exercise. All it takes is a spreadsheet and an afternoon.

The device register

Build a simple list: who has what, when each device was issued, whether it’s enrolled in a management system, and what company data each device can access. If you don’t have one, build it now. Ask every staff member to confirm the devices they use for work, including personal ones. The goal is to map what you’re working with. Most employees are happy to confirm what device they use once they know nothing punitive will come of it.

For any personal device that has been used to access company systems, the minimum is making sure company email and file access happens through managed apps that can be remotely disconnected.

Client communication in shared places

Move client communication into shared places so the relationship belongs to the business when an individual moves on. Continuity is the goal. Set up a shared inbox or alias for client-facing communication, and use a CRM where contact history and notes are logged. Even a shared Microsoft 365 mailbox with a clear expectation that client threads are CC’d to it is a meaningful improvement over what most small businesses do today.

What your IT provider should be doing at onboarding

Most IT providers get called when someone resigns. They show up, disable the account, collect the laptop if they can find it, and do their best with whatever documentation exists. That’s the wrong end of the lifecycle to be involved in. If that’s the only time your IT provider is involved in staff transitions, you’re not getting much value from the relationship.

The model that works puts your IT provider at onboarding too. They set up the new account in your identity provider, enroll the device in your mobile device management system, and provision access through single sign-on so every tool the new hire uses is connected to a central identity that can be switched off in one action. They should also maintain a handover document for each staff member, updated periodically, listing every system the person accesses, every client relationship they own, and every credential tied to their identity.

When that’s in place, offboarding becomes a checklist and an hour rather than a three-week excavation. Ask your IT provider what they do at onboarding. If the answer is “not much” or “we usually just get called when someone leaves,” that’s worth a conversation.

A 60-day plan before your next round of departures

You don’t need to know the exact date of the next resignation to start. The work is more manageable when nothing is urgent.

Weeks 1 and 2: Run the credit card SaaS audit. Build a list of every tool, every account owner, and every login that only one person controls. Flag the ones where access would be lost or complicated if that person left this week.

Weeks 3 and 4: Build the device register. Confirm what every staff member uses for work. For personal devices with company access, implement managed app access at minimum. Enroll company-owned devices in a management system if they aren’t already.

Weeks 5 and 6: Audit client-facing communication. Identify any client relationships that exist primarily in one person’s inbox or on someone’s mobile phone. Set up shared mailboxes or CRM logging for the highest-risk accounts first.

Weeks 7 and 8: Write the onboarding process you wish you’d had. Use everything you found in the previous six weeks as the input. Apply it to your next hire from day one, and use it as the template for a handover document for every existing staff member.

Most of this is an operational task rather than a technology project. A spreadsheet, some honest conversations with your team, and a few hours of your IT provider’s time will cover the bulk of it.

Frequently asked questions

How long should offboarding take in a small business?

With proper onboarding hygiene and centralized identity, the IT side of offboarding takes about 60 to 90 minutes. Take that foundation away and the same task can stretch to two or three weeks of scattered cleanup.

How do I find SaaS tools my team signed up for without telling me?

The fastest way is a three-month review of every credit card statement used for business expenses. Most shadow SaaS shows up as a recurring charge somewhere on the card.

Can I wipe a personal device after someone leaves?

Only the company data, and only if you set that up while they were still employed. Mobile device management or managed app access lets you remove company email, files, and credentials from a personal device without touching the rest of it. If those tools weren’t in place during their employment, your options are limited.

What’s the role of single sign-on in offboarding?

Single sign-on means every tool a user accesses is tied to a central identity. Disabling that identity in one place revokes access everywhere. Without single sign-on, you have to manually log into each platform and remove the user.

Should I make my employees use only company devices?

Where practical, yes. For personal devices, enrolling them in a management system or requiring managed app access is the next best thing. A personal device with saved company credentials and no management is the highest-risk configuration for offboarding.

Sources and further reading

• Microsoft Learn: What are lifecycle workflows in Microsoft Entra? — Microsoft’s framing of the joiner / mover / leaver lifecycle and the workflows that automate it.
• Microsoft Learn: App Protection Policies overview (Intune) — how managed app access works for personal devices, including selective wipe of company data.

If your offboarding process feels harder than it should be, that’s a good signal that your onboarding needs attention. Your IT provider should be able to walk you through both ends of the lifecycle and help you tighten what’s loose. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Cyber insurance applications include a question that catches a lot of small business owners off guard: “Do you maintain immutable, air-gapped, or offline backups of your critical business data?”

Carriers added that question to renewal forms because ransomware operators worked out that the fastest way to force a payout is to wipe the backups first and encrypt everything else after. CISA, the FBI, and the Internet Crime Complaint Center have all documented this pattern as one of the most common moves in current ransomware playbooks. A business whose backup copies can be deleted using the same admin credentials an attacker just stole has no recovery path other than paying the ransom.

This post covers what immutable backup means, three common backup setups that do not qualify, the questions to send your IT provider before you sign the form, and what to do if your honest answer is no.

Immutable backup, defined

An immutable backup is one that cannot be modified or deleted for a fixed period of time, including by you, by your IT provider, and by anyone using stolen admin credentials.

The stolen credentials piece is what carriers care about. Most backup systems can be wiped by anyone with admin access. Immutability means the backup platform itself enforces the lock at the storage layer, and no credentials, however privileged, can override it during the retention window. Some platforms call this object lock, write-once-read-many, or WORM storage. The terminology varies between vendors, but the underlying control is the same.

Three common backup setups that do not qualify

Three setups come up regularly that don’t satisfy the immutability question, even though business owners often assume they do.

A NAS or external drive in your office

A network-attached storage device sitting in your server room is reachable from your network by design. If ransomware spreads across your environment, it can reach the NAS. An attacker with domain admin credentials can wipe what’s on it. An external drive that someone plugs in once a week and leaves connected has the same exposure.

These devices have a role in a broader backup strategy. On their own, they do not satisfy the immutability question.

Microsoft 365 retention treated as a backup

Microsoft 365 includes data retention features, and some businesses use them as their backup solution. They are not a backup in the sense the form is asking about. An attacker with global admin access to your tenant can delete data and purge retention holds.

Under Microsoft’s shared responsibility model, customers retain responsibility for backup and protection of their own data, separate from what Microsoft provides at the platform level.

If your only protection for Microsoft 365 data is what Microsoft provides natively, the honest answer to the immutability question is no.

A cloud backup with immutability switched off

This is the most common gap. Many reputable backup platforms include immutability as a feature, but the setting is not always enabled by default. The capability exists, and someone needs to turn it on. Your business may be paying for a backup solution that looks credible on paper while the immutability toggle sits in the off position. You cannot tell from the outside without checking.

Three questions to send your IT provider before you sign the form

Copy these into an email and send them before you check the box.

Question one: “Are our backups immutable, and if so, how long is the immutability window?”

Carrier guidance has tightened in the past two years. Most insurers want a window of at least 14 days as a floor, with 30 days increasingly cited as the preferred minimum. Attackers sometimes sit in a network for weeks before triggering ransomware, which means a backup from yesterday may already be compromised. The window needs to be long enough to give you clean restore points from before the attacker arrived.

Question two: “If our domain admin account or Microsoft 365 global admin account were stolen tomorrow, could that account be used to delete our backups?”

The correct answer is no. If the answer is yes, or if your provider is not sure, your backups are not immutable in the way the form means.

Question three: “Can you send me a screenshot or vendor documentation showing that immutability is enabled on our account?”

A provider who can send something concrete has done the work. If they come back with verbal reassurance and nothing to show, treat that as a no until they can demonstrate otherwise.

What a qualifying setup looks like

For your backup to honestly satisfy the question on the form, a few things need to be true at the same time.

The backup platform needs immutability turned on, not only available as a feature. Several major vendors including Veeam, Datto, Rubrik, and Acronis offer the capability, along with most cloud storage providers that support S3-compatible object lock. A vendor name on the invoice does not, by itself, answer the question. The setting has to be turned on, scoped properly, and tied to credentials that aren’t shared with the rest of your environment.

The backup credentials need to sit outside your regular administrative accounts. If the same login that manages your Microsoft 365 environment also controls your backup platform, a compromised admin account can reach both. A qualifying setup uses isolated credentials outside your day-to-day identity environment.

The retention window needs to be long enough. A 24-hour backup that overwrites itself daily does not help if an attacker has been in your environment for a week. CISA’s #StopRansomware Guide lists immutable, tested backups as a baseline control, and most insurers now align with that position.

Restores also need to be tested. A backup nobody has tried to restore in the past 12 months is not something you can rely on when it matters. Most carriers now ask for the date of your last successful restore test, and they want to see one.

What to do if your honest answer is no

Declare what you have on the form, and use the renewal process as the reason to fix what isn’t there.

The first step is to ask your IT provider whether immutability can be enabled on your existing platform. In many cases the platform already supports it, and turning it on is a configuration change rather than a new product purchase. If the platform supports it and nobody has switched it on, that conversation can usually be resolved in a few days.

If your provider does not know what you’re asking, or cannot give a clear answer to the three questions above, that response is itself important information. This area needs attention before your next renewal date, even if other parts of your IT setup are handled well.

One thing to avoid: do not check yes on the form to dodge a premium hike. Cyber insurance applications function as warranty documents. If a forensic investigation after a claim finds your backups did not match what you declared, the carrier can rescind the policy. Coverage is then treated as if it never existed, and any prior payouts under the same policy term can be clawed back. Misrepresentation discovered after a claim is one of the most expensive mistakes a small business can make on an insurance form.

Checking no on the form will likely cost you something at renewal, either in premium or in coverage terms. That’s a known cost, and it’s manageable. Take the hit on the application, and use the months between now and your next renewal to close the gap.

Frequently asked questions

What does immutable backup mean in plain English?

A backup that nobody can change or delete for a set period of time, even with administrator credentials. The storage platform enforces the lock at the system level, so user permissions cannot override it.

Is Microsoft 365’s built-in retention a backup?

No. Native retention can be bypassed by a global admin or by anyone who steals one. Microsoft’s shared responsibility model places backup of your data on the customer, separate from retention.

How long should the immutability window be?

Most insurers and security frameworks point to a minimum of 14 days. 30 days is increasingly the preferred floor, and some carriers want longer. A longer window gives you more confident recovery if an attacker has been inside your environment for an extended period.

Can my IT provider just turn immutability on?

Often, yes. If your backup platform supports the feature and it has not been enabled, this is a configuration change rather than a new purchase. Ask for written confirmation once it’s done.

What happens if I check yes on the form when I shouldn’t?

The carrier can rescind the policy after a claim, which voids coverage retroactively. Any prior payouts under the same policy term can also be clawed back. Misrepresentation is one of the most common reasons cyber claims are denied.

Sources and further reading

• CISA #StopRansomware Guide — federal guidance on ransomware prevention, including backup and immutability recommendations.
• Microsoft shared responsibility model — Microsoft’s own documentation on which protections sit with the platform and which sit with the customer.
• FBI Internet Crime Complaint Center: Ransomware — current FBI guidance on ransomware threats and recommended controls.

If you’re not sure where your backups stand, that’s worth raising with your IT provider before your next renewal date. They should be able to walk you through the configuration and give you a clear answer to the three questions above. And if you don’t have an IT provider, feel free to reach out to us and we’ll help you sort it.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Someone leaves the company on a Friday. By Monday, their email account is disabled, and their laptop is back in the pile.

What nobody checks is their login to the project management tool they signed up for in Q3, the cloud storage folder they shared with a contractor, or the CRM access they still have from two roles ago. 

Three months later, those sessions are still active.

This is how zombie accounts form. nNot through negligence, but through an offboarding process built around corporate IT assets that no longer reflects how people actually use software. 

The average company now runs more than 100 SaaS applications. Most offboarding checklists were written when there were three.

What a Zombie Account Actually Is

A zombie account is an active login that belongs to someone who no longer works for you. The name is informal. The risk is not.

What makes zombie accounts particularly dangerous is that they are valid credentials.

There is nothing to detect. The access was granted intentionally, and the system has no reason to question it. If a former employee walks back in through that door, or if their credentials are compromised after they leave, the access is there waiting.

Industry research finds that 50% of organizations have discovered former employees still accessing SaaS applications months after their departure date.

For most of those organizations, the discovery was accidental rather than the result of a deliberate audit.

The Three Apps Where Access Never Gets Removed

Cloud storage and collaboration tools

Google Drive, OneDrive, and Dropbox are where zombie access causes the most immediate damage. 

These platforms are where offboarding gets messy. Files may be shared with a departing employee’s personal account. Guest permissions granted during a project may never get cleaned up. And folders set to “anyone with the link” access may still be bookmarked.

The departure triggers a license removal in the identity provider. The shared folders, external links, and personal-account shares go untouched.

Project management and CRM platforms

Tools like Asana, Monday.com, Notion, Jira, HubSpot, and Salesforce are frequently provisioned by team leads rather than IT. That means the offboarding checklist has no visibility into them. 

A former account executive’s Salesforce login, or a project manager’s Notion workspace with access to company strategy documents, can persist for months without anyone noticing.

The tools IT didn’t know existed

This is the most dangerous category. 

These are the tools employees signed up for using their work email. A survey platform. An AI writing assistant. A data visualisation tool. They were never formally provisioned, and they were never formally revoked.

When the employee leaves, the account does not get disabled. It sits there, attached to a work email address that may now redirect to an IT catch-all.

Running the Zombie SaaS Audit

Step 1: Build your SaaS inventory

Start by pulling a list of all SaaS applications connected to your identity provider: Microsoft Entra ID, Google Workspace Admin, or Okta, if you use one. 

Cross-reference with billing records, browser extension installs, and email domains showing regular login notifications.

Grip Security’s 2025 SaaS Security Risks Report, analyzing 29 million user accounts, identified 23,987 distinct SaaS applications in use across its customer base. That’s far more than any IT team tracks manually.

Of those applications, 90% remained outside IT’s management. 

For smaller teams without a dedicated identity platform, a 30-minute review of active subscriptions and recent login notifications will surface most of the high-risk tools.

Step 2: Cross-reference against your offboarding list

Take the last 12 months of departures and check each name against the SaaS inventory. 

For each application, ask: 

• Does this platform have an admin console? 
• Can you see who is still active? 
• When did this account last log in?

Access that is months old and belongs to someone who has left is a zombie. Flag it for immediate revocation. Document what you find.

Step 3: Revoke, document, and set a review cadence

Remove the access. Record what was found and when. Then use the audit as the baseline for an offboarding checklist that covers more than the corporate email and laptop. 

Going forward, enforce multi-factor authentication on all remaining active accounts and schedule a SaaS access review every quarter. 

That cadence turns a one-time cleanup into a repeatable control.

Making Offboarding a Security Process

Zombie accounts cannot be removed if no one is looking for them. The SaaS offboarding audit is the starting point.

Want to close the gaps in your SaaS offboarding process? 

Contact us or schedule a consultation to run a zombie SaaS audit and build a repeatable process your team can follow on every exit.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

The most time-consuming ticket in your queue is rarely a hardware failure. It’s the PC infection that started when a user installed something they shouldn’t have been able to. Or it’s the broken configuration left behind after someone changed a setting IT can’t trace.

Local administrator rights (the ability to install software, modify system settings, and override security controls) are given to end users far more often than the risk warrants. 

The usual reason is efficiency. 

The practical result is the opposite. Machines that drift from baseline, infections that spread before they are caught, and remediation tickets nobody planned for. Revoking local admin rights directly removes the root cause of most of those tickets.

The Admin Rights and Support Ticket Connection

A standard user account limits what software can be installed, what system settings can be changed, and what processes can run at an elevated level. These limits are not arbitrary friction. They are the boundary that prevents most common problems from ever reaching the helpdesk.

When users have admin rights, those boundaries disappear. 

Software conflicts arise because no approval step exists to catch the incompatibility. Security tools get disabled because a user decided they were slowing things down. Network settings get modified during attempted self-fixes that go wrong. Each of those actions is a predictable support ticket in waiting.

Admin rights are not the cause of every request in the queue. They are the cause of most of the expensive ones.

What the Security Data Shows

The connection between admin rights and security incidents is well-documented, and the numbers make the operational argument clearly.

From 2015 to 2020, the BeyondTrust Microsoft Vulnerabilities Report found that removing administrative privileges could have mitigated 75% of all Critical Microsoft vulnerabilities.

The pattern holds because most critical vulnerabilities require elevated permissions to fully execute. 

An attacker who compromises a standard user account gets access to that user’s data and session. An attacker who compromises an admin account gets the machine, and often the network.

The IBM Cost of a Data Breach Report 2025 found the average US data breach costs $10.22 million, an all-time high for any region globally.

The remediation cost for breaches that originate through compromised endpoints is consistently higher when the affected user holds elevated system privileges. Revoking local admin rights does not eliminate the risk, but it significantly reduces what an attacker or an infected machine can actually do.

The Three Ticket Categories That Disappear

Malware infections and their cleanup

Most ransomware and many Trojan infections require admin-level permissions to install, disable security tools, and spread. A standard user account does not eliminate phishing risk, but it limits what malware can do after it lands. 

An infection on a standard account is typically contained to that user’s profile. On an admin account, the same infection can encrypt shared drives and require a full OS rebuild. 

A contained malware event might mean one ticket and thirty minutes of work. An admin-level infection often means several tickets and multiple hours of technician time.

Self-inflicted configuration breaks

Users with admin rights occasionally try to fix their own problems by changing settings, uninstalling applications, or modifying network configurations. When it goes wrong, IT inherits the result with little visibility into what changed. 

Standard user accounts remove this category of ticket almost entirely, because those changes are no longer possible without an elevation request.

Patch and compliance drift

Endpoints where users have admin rights tend to diverge from the managed baseline over time. 

Software installed outside the approved process does not receive updates through standard management tools. 

Devices accumulate inconsistencies that create additional work during vulnerability scans, audits, and compliance reviews. 

Revoking admin rights and enforcing managed software deployment closes this drift at the source.

But I Need to Install Things

Just-in-time elevation

The concern is legitimate. As a user on your network, you do occasionally need elevated access for specific tasks. 

The answer is not to restore permanent admin rights. It is just-in-time (JIT) elevation, where you get temporary elevated access for a defined task. The request is approved through an automated policy or by IT, and the elevation expires automatically once the task is complete.

This keeps users productive and IT informed. 

Every elevation request is logged. Unapproved actions do not happen silently. The volume and pattern of requests also becomes useful data in its own right, revealing exactly which tasks genuinely require escalation and which ones users were performing only because nothing was stopping them.

What standard users can already do

Standard accounts support normal application use, browser activity, printing, file access, and the vast majority of day-to-day tasks without any escalation at all. 

The friction you may anticipate is usually larger than the friction you actually experience once the change is made and a JIT process handles the edge cases.

What to Do Before You Flip the Switch

Ready to reduce your support ticket volume and tighten endpoint security for your team at the same time? 

Contact us or schedule a consultation to plan a least-privilege rollout that works for your team.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

The most dangerous thing in a server room is often the phrase, “Don’t touch that.”

It’s usually said with a half-joke and a grimace. It refers to the old box that “still works”, runs something important, and has survived so many fixes and workarounds that nobody feels confident changing it anymore.

That’s legacy debt. 

Not just “old tech”, but old tech that’s become a dependency. It’s the kind that quietly accumulates risk until it turns into downtime, security exposure, or an emergency upgrade at the worst possible time.

A legacy debt audit is the fast way to bring that risk back into the light. 

What Legacy Debt Really Looks Like

Legacy debt isn’t “old gear”. It’s old gear that has become normal. 

It’s the server that runs a critical app, the edge device nobody remembers buying, the workaround that turned into a dependency. Over time, that debt stacks up quietly.

Infinite Lambda describes legacy debt as something that “happens even to the best systems,” “silently accruing costs and constraints,” and it can “accumulate basically unnoticed until it is too costly to ignore.” 

That’s why a legacy debt audit isn’t a theoretical exercise. It’s a visibility exercise to bring the oldest, highest-leverage risks back onto the list of things you actively manage.

The security problem shows up when “old” becomes “unpatchable.” 

The UK’s NCSC guidance on obsolete products says, “Ideally, once out of date, technology should not be used,” and “the only fully effective way to mitigate this risk is to stop using the obsolete product.” 

If something can’t be updated, weaknesses don’t age out. They sit there, waiting for the wrong day.

Legacy debt also looks like basic server hygiene slipping.

NIST SP 800-123 frames secure server operations as an ongoing process: “Maintaining the secure configuration through application of appropriate patches and upgrades, security testing, monitoring of logs, and backups…” 

It also calls out foundational hardening steps like “Patch and upgrade the operating system” and “Remove or disable unnecessary services, applications, and network protocols.” 

When those basics become inconsistent, legacy debt turns into a reliability and incident-response problem, not just a security one.

Finally, legacy debt often hides at the edge. If you have end-of-support internet-facing devices, you’ve got high-leverage risk in the most exposed place. 

The 3 Oldest Risks to Find First

These three categories are where “old” most often turns into outsized risk, because they combine age with leverage: they either sit at the front door, can’t be fixed anymore, or have quietly drifted out of a safe baseline.

Risk #1: End-of-support edge devices

If you’re looking for high-leverage legacy debt, start at the edge. Firewalls, VPN gateways, routers, and other internet-facing devices are the front door to your environment. 

When they reach end-of-support (EOS), they don’t just become outdated. They become harder to defend because security fixes stop arriving.

What to check in your audit

• List every edge device (firewall, VPN, router) and the support status for each one
• Confirm which ones are internet-facing and which services are exposed
• Identify devices that can’t run the current firmware or no longer receive updates.

Risk #2: Obsolete products that can’t be fixed anymore

Obsolete products are the purest form of legacy debt: things that are still operating but no longer receive security updates. That means every new vulnerability becomes permanent.

In other words, there’s no clever workaround that makes an unsupported system “safe”. There are only risk reductions until you can replace it.

What to check in your audit

• Identify anything past support: server OS versions, appliances, old hypervisors, and line-of-business apps
• Flag systems that require exceptions, like the ones with old protocols, weak auth, and special firewall rules
• Find the “business-critical but unsupported” systems
  

Risk #3: “It still works” servers with neglected basics

This is the sneakiest risk because it looks normal. 

The server is supported. The hardware runs. Nobody’s complaining. But the basics have drifted: patching is inconsistent, unnecessary services are still running, and backups haven’t been proven under pressure.

SP 800-123 Guide to General Server Security frames secure server operations as an ongoing discipline, including “patches and upgrades,” “monitoring of logs,” and “backups.” 

It also calls out core hardening steps like “Patch and upgrade the operating system” and “Remove or disable unnecessary services, applications, and network protocols.” 

Those are the unglamorous fundamentals that stop small problems from turning into long outages.

What to check in your audit

• Patch reality: what’s the current patch level and how often do updates slip?
• Service sprawl: what’s running that doesn’t need to be running?
• Admin and service accounts: where are the broad permissions and shared credentials?
• Backup confidence: when was the last restore test and did it succeed?
• Change control: who can make changes, and how are they tracked?

Stop Carrying Silent Risk

Legacy debt doesn’t announce itself. It sits quietly in the background until the day it becomes downtime, exposure, or an emergency upgrade you didn’t plan for.

A legacy debt audit gives you control back by turning “we should deal with that someday” into a shortlist you can act on. Start with the highest-leverage risks: end-of-support edge devices, obsolete products that can’t be patched, and servers where the basics have drifted. Then assign owners, set dates, and move one item at a time from “too scary to touch” to “handled”.

Contact us for help running your next legacy debt audit.

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

When you first sign up for a software-as-a-service (SaaS) platform, everything is designed to feel effortless. 

The problem is that the first real test of a SaaS relationship isn’t the onboarding. It’s the exit. 

For many small businesses, the front door is wide open, but the emergency exit is bolted shut: exports are incomplete, key data sits in proprietary formats, and leaving requires expensive vendor help.

That’s more than inconvenient. It’s a business risk. 

As teams move toward a workforce blended with humans and Agentic AI in 2026, your advantage will come from data you can move, reuse, and trust. If your data can’t leave a vendor cleanly, you don’t fully control your processes. Then your options, timelines, and costs are controlled for you.

Why This Gets Worse in 2026

The “backup exit strategy” question is getting sharper in 2026 because SaaS sprawl and third-party dependence are now normal. 

Your business data isn’t sitting in one system. It’s spread across platforms, integrations, plug-ins, and automation. When one vendor changes pricing, terms, features, or risk profile, you don’t just “switch tools.” You either move your data cleanly or you stay stuck.

The breach environment also raises the stakes. Verizon’s 2025 DBIR Executive Summary says it analysed 22,052 security incidents and 12,195 confirmed breaches, calling it “the highest number of breaches ever analysed in a single report,” across 139 countries. 

That volume matters because exits and migrations often happen under pressure. A backup exit strategy is what prevents “we need to move” from becoming “we can’t move.”

Attackers are also increasingly focused on credentials and data pathways. These are the same pathways you rely on during exports and migrations. 

Microsoft’s Digital Defense Report 2025 notes that credential and access key theft attempts are up 23%, and attempts to extract sensitive data from storage accounts and databases increased 58%. 

Microsoft also reports that data collection showed up in 80% of reactive engagements, which is a reminder that “getting the data” is now a common objective. 

If you can’t export your data safely and predictably, you end up trapped. You can’t rotate away from a risky platform quickly. And you can’t migrate without creating new exposure. 

Finally, being stuck is expensive even before you factor in vendor fees. IBM’s Cost of a Data Breach Report 2025 puts the global average cost of a breach at USD 4.4M.

That’s not a “lock-in” statistic, but it is a useful reality check: data incidents cost real money. A clean exit strategy reduces the chance that a vendor becomes an added cost multiplier during an already expensive situation.

In 2026, the question isn’t whether you’ll ever need to move data. It’s whether you’ll be able to do it without vendor hand-holding, surprise costs, or emergency timelines. 

The Financial Cost of the “Proprietary Trap”

A weak exit plan doesn’t just slow innovation. It quietly increases operating costs because you end up paying for a setup you can’t easily change.

When you’re locked into a vendor, spending becomes sticky. You can’t right-size quickly, consolidate tools, or move workloads to a better-fit platform without turning it into a major project. 

That’s how waste hangs around.

The real cost isn’t the monthly invoice. It’s the lack of options. When your data can’t move easily, every renewal, pricing change, or product shift becomes a forced decision instead of a strategic one.

A true backup exit strategy flips that dynamic. It gives you the ability to migrate on your timeline, reduce duplicate tooling, and make cost decisions based on value rather than inertia. In practical terms, it turns “we can’t leave” into “we can compare, choose, and move when it makes sense.”

Securing the Move

Once you decide to move your data, the migration itself becomes a high-risk moment. Not because migrations are inherently unsafe. But because they concentrate exactly what attackers want: 

• High-privilege access
• Lots of open sessions, 
• A lot of data moving at once

During a data move, your team is often signed into multiple admin-level tools at the same time. That’s where session cookie hijacking becomes relevant. An attacker doesn’t need to “crack” your password if they can steal the session token that proves you’re already authenticated. 

Microsoft has described adversary-in-the-middle phishing campaigns that intercept session cookies so attackers can reuse an authenticated session and bypass the MFA prompt. 

Cloudflare also notes that attackers are finding ways to circumvent MFA as part of broader attack chains, which is why the safest approach is layered rather than relying on one control. 

To protect your backup exit migration:

• Use phishing-resistant sign-ins where possible for migration and admin accounts.
• Tighten session controls so privileged sessions expire sooner and re-authentication is required for risky actions.
• Treat device health as part of access: run the migration from a managed, patched, protected device.
• Monitor for suspicious access during the move.

Ownership is a Discipline

The businesses that thrive over the next few years won’t just adopt new tools. They’ll stay flexible as tools change. 

In a world of SaaS sprawl and AI-driven workflows, that flexibility comes from clean data, clear processes, and the ability to move when you need to.

If you’d like help building an exit-ready baseline across your vendor stack, contact us for a technology consultation. 

—

Featured Image Credit

This Article has been Republished with Permission from The Technology Press.